chainlesschain 0.162.181 → 0.162.183

package/src/lib/repl-bang-memorize.js

@@ -21,6 +21,7 @@ import fsDefault from "fs";
 import pathDefault from "path";
 import { findProjectRoot } from "./project-instructions.js";
 import executionBroker from "./process-execution-broker/index.js";
+import { collectPluginBinSandboxPolicy as collectDefaultPluginBinSandboxPolicy } from "./plugin-runtime/bin.js";
 
 export const BANG_TIMEOUT_MS = 120_000;
 export const BANG_MAX_BUFFER = 10 * 1024 * 1024;
@@ -33,6 +34,8 @@ export const MEMO_NOTE_MAX = 4_000;
 
 export const _deps = {
   spawnSync: (...args) => executionBroker.spawnSync(...args),
+  collectPluginBinSandboxPolicy: (opts) =>
+    collectDefaultPluginBinSandboxPolicy(opts),
   fs: fsDefault,
   path: pathDefault,
 };
@@ -44,6 +47,46 @@ function cap(s) {
     : str;
 }
 
+function resolveWindowsCommandShell(opts = {}) {
+  const path = opts.deps?.path || _deps.path;
+  const env = opts.env || process.env;
+  const normalizeLocalPath = (candidate) => {
+    const value =
+      typeof candidate === "string"
+        ? candidate.trim()
+        : String(candidate || "");
+    // `path.win32.isAbsolute("\\foo")` is true even though the result still
+    // depends on the process's current drive. Require a drive-qualified local
+    // path so the helper receives one deterministic executable identity.
+    if (!/^[a-z]:[\\/]/i.test(value)) return null;
+    return path.win32.normalize(value);
+  };
+
+  for (const candidate of [opts.comSpec, env.ComSpec, env.COMSPEC]) {
+    const value = normalizeLocalPath(candidate);
+    if (value && path.win32.basename(value).toLowerCase() === "cmd.exe") {
+      return value;
+    }
+  }
+
+  for (const candidate of [
+    opts.systemRoot,
+    env.SystemRoot,
+    env.SYSTEMROOT,
+    env.WINDIR,
+    "C:\\Windows",
+  ]) {
+    const value = normalizeLocalPath(candidate);
+    if (value) {
+      return path.win32.join(value, "System32", "cmd.exe");
+    }
+  }
+
+  // The literal fallback above is absolute, so this is unreachable with Node's
+  // path.win32 implementation. Keep a fail-closed guard for injected path seams.
+  throw new Error("No absolute Windows command shell is available");
+}
+
 /** True when the REPL line is a `!` bash passthrough. */
 export function isBangCommand(trimmed) {
   return (
@@ -70,24 +113,37 @@ export function isMemorizeLine(trimmed) {
  */
 export function runBangCommand(line, opts = {}) {
   const spawnSync = opts.deps?.spawnSync || _deps.spawnSync;
+  const collectPluginBinSandboxPolicy =
+    opts.deps?.collectPluginBinSandboxPolicy ||
+    _deps.collectPluginBinSandboxPolicy;
   const cwd = opts.cwd || process.cwd();
   const isWin =
     opts.platform != null
       ? opts.platform === "win32"
       : process.platform === "win32";
   const cmd = String(line).replace(/^!/, "").trim();
+  // A bang command is another arbitrary workspace process surface. Collect the
+  // tighten-only Plugin bin boundary union before the shell starts so it cannot
+  // bypass a policy that run_shell already pins for the same workspace.
+  const sandboxPolicy = collectPluginBinSandboxPolicy({ cwd });
+  const sandboxOptions = sandboxPolicy ? { sandboxPolicy } : {};
 
   const res = isWin
-    ? spawnSync("cmd.exe", ["/d", "/s", "/c", `chcp 65001 >nul && ${cmd}`], {
-        encoding: "utf-8",
-        timeout: BANG_TIMEOUT_MS,
-        maxBuffer: BANG_MAX_BUFFER,
-        cwd,
-        origin: "repl:bang-command",
-        policy: "allow",
-        scope: "repl",
-        shell: false,
-      })
+    ? spawnSync(
+        resolveWindowsCommandShell(opts),
+        ["/d", "/s", "/c", `chcp 65001 >nul && ${cmd}`],
+        {
+          encoding: "utf-8",
+          timeout: BANG_TIMEOUT_MS,
+          maxBuffer: BANG_MAX_BUFFER,
+          cwd,
+          origin: "repl:bang-command",
+          policy: "allow",
+          scope: "repl",
+          shell: false,
+          ...sandboxOptions,
+        },
+      )
     : spawnSync("/bin/sh", ["-c", cmd], {
         encoding: "utf-8",
         timeout: BANG_TIMEOUT_MS,
@@ -97,6 +153,7 @@ export function runBangCommand(line, opts = {}) {
         policy: "allow",
         scope: "repl",
         shell: false,
+        ...sandboxOptions,
       });
 
   const exitCode = res.status == null ? (res.error ? -1 : 0) : res.status;

package/src/lib/session-usage.js

@@ -12,6 +12,7 @@ import {
   readEvents,
   listJsonlSessions,
 } from "../harness/jsonl-session-store.js";
+import { extractPluginUsageAttribution } from "./plugin-usage-attribution.js";
 
 // Injectable disk seams (tests override). readEvents skips malformed JSON lines
 // but does NOT guard readFileSync, so an unreadable session file (EACCES /
@@ -228,6 +229,7 @@ function _isToolResultError(event) {
 export function aggregateToolCalls(events) {
   const byTool = new Map();
   const byServer = new Map();
+  const byPlugin = new Map();
   let totalCalls = 0;
   let totalErrors = 0;
 
@@ -253,19 +255,42 @@ export function aggregateToolCalls(events) {
     }
     return s;
   };
+  const bumpPlugin = (plugin, version = null) => {
+    const key = `${plugin}@${version || "?"}`;
+    let row = byPlugin.get(key);
+    if (!row) {
+      row = {
+        plugin,
+        version: version || null,
+        calls: 0,
+        errors: 0,
+        turnTokens: 0,
+      };
+      byPlugin.set(key, row);
+    }
+    return row;
+  };
 
   let turnTools = new Set();
   let turnServers = new Set();
+  let turnPlugins = new Set();
   let turnTokens = 0;
+  let pendingPlugin = null;
   const flushTurn = () => {
     if (turnTokens > 0) {
       for (const name of turnTools) bumpTool(name).turnTokens += turnTokens;
       for (const server of turnServers)
         bumpServer(server).turnTokens += turnTokens;
+      for (const key of turnPlugins) {
+        const row = byPlugin.get(key);
+        if (row) row.turnTokens += turnTokens;
+      }
     }
     turnTools = new Set();
     turnServers = new Set();
+    turnPlugins = new Set();
     turnTokens = 0;
+    pendingPlugin = null;
   };
 
   for (const evt of events || []) {
@@ -292,6 +317,21 @@ export function aggregateToolCalls(events) {
         if (isErr) s.errors++;
         turnServers.add(server);
       }
+      const plugin =
+        typeof evt.data?.plugin === "string" && evt.data.plugin
+          ? evt.data.plugin
+          : null;
+      const pluginVersion =
+        typeof evt.data?.plugin_version === "string"
+          ? evt.data.plugin_version
+          : null;
+      pendingPlugin = { tool: name, plugin, version: pluginVersion };
+      if (plugin) {
+        const p = bumpPlugin(plugin, pluginVersion);
+        p.calls++;
+        if (isErr) p.errors++;
+        turnPlugins.add(`${plugin}@${pluginVersion || "?"}`);
+      }
       continue;
     }
     if (evt.type === "tool_result") {
@@ -304,6 +344,26 @@ export function aggregateToolCalls(events) {
         bumpTool(name).errors++;
         if (server) bumpServer(server).errors++;
       }
+      const extracted = extractPluginUsageAttribution(evt.data?.result);
+      const plugin =
+        typeof evt.data?.plugin === "string" && evt.data.plugin
+          ? evt.data.plugin
+          : extracted.plugin || null;
+      const pluginVersion =
+        typeof evt.data?.plugin_version === "string"
+          ? evt.data.plugin_version
+          : extracted.pluginVersion || null;
+      if (plugin) {
+        const p = bumpPlugin(plugin, pluginVersion);
+        const countedByCall =
+          pendingPlugin?.tool === name &&
+          pendingPlugin?.plugin === plugin &&
+          (pendingPlugin?.version || null) === (pluginVersion || null);
+        if (!countedByCall) p.calls++;
+        if (_isToolResultError(evt) && !countedByCall) p.errors++;
+        turnPlugins.add(`${plugin}@${pluginVersion || "?"}`);
+      }
+      pendingPlugin = null;
       continue;
     }
     const u = extractUsage(evt);
@@ -317,6 +377,7 @@ export function aggregateToolCalls(events) {
     totalErrors,
     byTool: Array.from(byTool.values()).sort(byCallsDesc),
     byMcpServer: Array.from(byServer.values()).sort(byCallsDesc),
+    byPlugin: Array.from(byPlugin.values()).sort(byCallsDesc),
   };
 }
 
@@ -457,6 +518,7 @@ export function allSessionsUsage({ limit = 1000 } = {}) {
   const gSubagent = new Map();
   const gTool = new Map();
   const gServer = new Map();
+  const gPlugin = new Map();
   let gToolCalls = 0;
   let gToolErrors = 0;
   const mergeRow = (map, key, row, seed) => {
@@ -508,6 +570,20 @@ export function allSessionsUsage({ limit = 1000 } = {}) {
       entry.turnTokens += row.turnTokens || 0;
       gServer.set(row.server, entry);
     }
+    for (const row of tools.byPlugin || []) {
+      const key = `${row.plugin}@${row.version || "?"}`;
+      const entry = gPlugin.get(key) || {
+        plugin: row.plugin,
+        version: row.version || null,
+        calls: 0,
+        errors: 0,
+        turnTokens: 0,
+      };
+      entry.calls += row.calls || 0;
+      entry.errors += row.errors || 0;
+      entry.turnTokens += row.turnTokens || 0;
+      gPlugin.set(key, entry);
+    }
   }
   const byCallsDesc = (a, b) => b.calls - a.calls;
 
@@ -527,6 +603,7 @@ export function allSessionsUsage({ limit = 1000 } = {}) {
         totalErrors: gToolErrors,
         byTool: Array.from(gTool.values()).sort(byCallsDesc),
         byMcpServer: Array.from(gServer.values()).sort(byCallsDesc),
+        byPlugin: Array.from(gPlugin.values()).sort(byCallsDesc),
       },
     },
   };

package/src/lib/slash-commands.js

@@ -24,11 +24,14 @@ import { homedir } from "node:os";
 import { expandFileRefs } from "../runtime/file-ref-expander.js";
 import { projectRootBase } from "./project-root.cjs";
 import executionBroker from "./process-execution-broker/index.js";
+import { collectPluginBinSandboxPolicy as collectDefaultPluginBinSandboxPolicy } from "./plugin-runtime/bin.js";
 
 const _deps = {
   fs: fsDefault,
   path: pathDefault,
   execSync: (...args) => executionBroker.execSync(...args),
+  collectPluginBinSandboxPolicy: (opts) =>
+    collectDefaultPluginBinSandboxPolicy(opts),
 };
 
 /**
@@ -186,8 +189,16 @@ export function substituteArgs(text, args = []) {
   return out;
 }
 
+function isSandboxFailClosedError(error) {
+  return (
+    error?.sandboxFailClosed === true ||
+    (typeof error?.code === "string" &&
+      error.code.startsWith("ERR_PROCESS_SANDBOX"))
+  );
+}
+
 /** Run every `!`cmd`` and replace it with the command's stdout (best-effort). */
-function runBangs(text, { cwd, execSync }) {
+function runBangs(text, { cwd, execSync, sandboxPolicy }) {
   return text.replace(/!`([^`]+)`/g, (_, cmd) => {
     try {
       const out = execSync(cmd, {
@@ -199,9 +210,13 @@ function runBangs(text, { cwd, execSync }) {
         policy: "allow",
         scope: "slash-command",
         shell: true,
+        ...(sandboxPolicy ? { sandboxPolicy } : {}),
       });
       return String(out).trim();
     } catch (err) {
+      // Broker boundary failures are security decisions, not ordinary command
+      // failures. Preserve the exact structured error for the caller.
+      if (isSandboxFailClosedError(err)) throw err;
       return `[command failed: ${cmd} — ${err.message?.split("\n")[0] || err}]`;
     }
   });
@@ -215,18 +230,26 @@ function runBangs(text, { cwd, execSync }) {
  *
  * @param {object} command  output of getCommand/parseCommandFile (needs .body)
  * @param {string[]} args
- * @param {object} [opts] { cwd, allowBang, deps:{ execSync } }
+ * @param {object} [opts] { cwd, allowBang,
+ *   deps:{ execSync, collectPluginBinSandboxPolicy } }
  * @returns {{ prompt:string, warnings:string[] }}
  */
 export function expandCommand(command, args = [], opts = {}) {
   const cwd = opts.cwd || process.cwd();
   const execSync = opts.deps?.execSync || _deps.execSync;
+  const collectPluginBinSandboxPolicy =
+    opts.deps?.collectPluginBinSandboxPolicy ||
+    _deps.collectPluginBinSandboxPolicy;
   const warnings = [];
 
   let text = substituteArgs(command.body || "", args);
 
-  if (opts.allowBang !== false) {
-    text = runBangs(text, { cwd, execSync });
+  if (opts.allowBang !== false && /!`[^`]+`/.test(text)) {
+    // Resolve and pin once before the first bang. Every expansion in this macro
+    // receives the same immutable policy object, so no earlier command can run
+    // before a later discovery failure or observe a weaker boundary set.
+    const sandboxPolicy = collectPluginBinSandboxPolicy({ cwd });
+    text = runBangs(text, { cwd, execSync, sandboxPolicy });
   }
 
   // @file expansion appends a <referenced-files> block when anything resolves.

package/src/repl/agent-repl.js

@@ -108,6 +108,7 @@ import {
 import { resolveSlashMacro } from "./slash-macro.js";
 import { expandMcpPrompt, renderMcpSurface } from "./mcp-prompt.js";
 import { newCostStore, addUsage } from "./session-cost.js";
+import { extractPluginUsageAttribution } from "../lib/plugin-usage-attribution.js";
 import { parseThinkCommand, parseEffortCommand } from "./think-command.js";
 import { parseBtwCommand, buildAsideBlock, applyAside } from "./btw-command.js";
 import { shouldStreamLive } from "./stream-decision.js";
@@ -360,9 +361,9 @@ export async function agentLoop(messages, options) {
       );
     } else if (event.type === "tool-result") {
       // 用量归因: persist a compact tool_call record (name + error flag +
-      // skill hint — never args, which can carry whole file bodies) so
-      // `cc session usage --by tool|mcp` and `cc insights` can aggregate
-      // tool use for REPL sessions. Best-effort; opt out with
+      // skill/plugin hints — never args, which can carry whole file bodies)
+      // so `cc session usage --by tool|mcp|plugin` and `cc insights` can
+      // aggregate tool use for REPL sessions. Best-effort; opt out with
       // options.persistToolCalls === false.
       if (options.sessionId && options.persistToolCalls !== false) {
         try {
@@ -373,6 +374,7 @@ export async function agentLoop(messages, options) {
               event.tool === "run_skill" && _lastExec?.tool === "run_skill"
                 ? _lastExec.args?.skill_name
                 : undefined,
+            ...extractPluginUsageAttribution(event.result),
           });
         } catch (_e) {
           // persistence is best-effort — never break the turn
@@ -915,8 +917,9 @@ export async function startAgentRepl(options = {}) {
     _pluginMonitors = null;
   }
 
-  // Put trusted plugins' bin/ executables on PATH for the session (Phase 3.3n),
-  // restored at SessionEnd. Trust-gated inside collectPluginBinDirs.
+  // Preserve PATH compatibility for trusted legacy bin components without a
+  // sandboxPolicy, restored at SessionEnd. Policy-bearing bins stay off PATH
+  // and use agent-core's exact direct Broker route.
   try {
     const { applyPluginBinPath } = await import("../lib/plugin-runtime/bin.js");
     const res = applyPluginBinPath({ cwd: process.cwd() });
@@ -1843,9 +1846,7 @@ export async function startAgentRepl(options = {}) {
                   "  Open this secure page? [y/N] ",
               ),
               async (answer) => {
-                const approved = /^(y|yes)$/i.test(
-                  String(answer || "").trim(),
-                );
+                const approved = /^(y|yes)$/i.test(String(answer || "").trim());
                 if (!approved) {
                   resolve({ action: "decline" });
                   rl.prompt();
@@ -3876,7 +3877,7 @@ export async function startAgentRepl(options = {}) {
           /* monitor restart is best-effort */
         }
 
-        // Re-apply plugin bin PATH (a newly-trusted plugin's executables).
+        // Re-apply legacy plugin bin PATH; strict bins remain direct-only.
         try {
           const { applyPluginBinPath } =
             await import("../lib/plugin-runtime/bin.js");