chainlesschain 0.162.182 → 0.162.184

package/src/lib/agent-batch.js

@@ -94,7 +94,10 @@ export async function runBatch(opts, deps) {
     try {
       worktreePath = createWorktree(unit.key, branch);
       onEvent({ type: "unit:start", key: unit.key, branch });
-      await runAgent(unit.prompt, worktreePath);
+      await runAgent(unit.prompt, worktreePath, {
+        key: unit.key,
+        branch,
+      });
 
       const stat = diffStat(worktreePath);
       record.filesChanged = stat.filesChanged;

package/src/lib/agent-team/team-runner.js

@@ -51,6 +51,10 @@ export class TeamRunner {
     this._executions = 0;
     this._inFlight = 0;
     this._maxInFlight = 0;
+    // Keys executing in this runner process. An event-loop stall may let a
+    // short lease expire before its heartbeat callback runs; peer loops in the
+    // same process must not steal and double-run that still-active task.
+    this._activeKeys = new Set();
     this._members = new Map(); // holder → lifecycle record
     this._budgetStopped = false;
   }
@@ -208,6 +212,7 @@ export class TeamRunner {
     let best = null;
     let bestScore = Infinity;
     for (const key of claimable) {
+      if (this._activeKeys.has(key)) continue;
       const t = this.registry.getTask(key);
       const score = rank[t?.priority] ?? 1;
       if (score < bestScore) {
@@ -222,10 +227,22 @@ export class TeamRunner {
     const task = this.registry.getTask(key);
     this._executions++;
     this._inFlight++;
+    this._activeKeys.add(key);
     this._maxInFlight = Math.max(this._maxInFlight, this._inFlight);
     this._setState(holder, "running", { key });
     this._emit("task:claimed", { key, holder, attempts: task.attempts });
-    const renew = () => this.registry.renew(key, { holder, ttlMs: this.ttlMs });
+    const renew = () => {
+      const result = this.registry.renew(key, {
+        holder,
+        ttlMs: this.ttlMs,
+      });
+      // A delayed timer may wake just after expiry. Reacquire is safe and
+      // optimistic: it succeeds only if no external runner has taken the
+      // lease; a real takeover remains authoritative and stops the heartbeat.
+      return !result?.ok && result?.reason === "not_holder_or_expired"
+        ? this.registry.acquire(key, { holder, ttlMs: this.ttlMs })
+        : result;
+    };
     // Heartbeat: the built-in executors (shell / agent / worktree) never call
     // `renew` themselves, so before this ANY task outliving the lease TTL was
     // indistinguishable from a crash — a peer could steal it and the SAME task
@@ -338,6 +355,7 @@ export class TeamRunner {
       });
     } finally {
       clearInterval(heartbeat);
+      this._activeKeys.delete(key);
       this._inFlight--;
     }
   }

package/src/lib/agent-team/team-worktree.js

@@ -126,6 +126,8 @@ export class TeamWorktreeCoordinator {
       sparsePaths: options.sparsePaths ?? null,
       symlinkDirectories: options.symlinkDirectories ?? null,
     };
+    this._onWorktree =
+      typeof options.onWorktree === "function" ? options.onWorktree : null;
   }
 
   isGitRepo() {
@@ -173,6 +175,7 @@ export class TeamWorktreeCoordinator {
         wtOptions,
       );
       this._created.set(key, { branch, path: worktreePath, committed: false });
+      this._onWorktree?.({ key, branch, path: worktreePath, holder });
       if (typeof runInWorktree === "function") {
         await runInWorktree({ key, task, holder, cwd: worktreePath });
       } else {

package/src/lib/async-hook-supervisor.cjs

@@ -36,6 +36,13 @@ const {
   tryParseDecision,
   resolveHookSandboxPolicy,
 } = require("./hook-runner.cjs");
+const {
+  buildExplicitHookShellInvocation,
+  issueTrustedHookSandboxContract,
+  requireTrustedHookRoot,
+  requiresExplicitHookShell,
+  sandboxBoundaryError,
+} = require("./hook-shell-command.cjs");
 
 const DEFAULT_TIMEOUT_MS = 60000;
 const MAX_TIMEOUT_MS = 600000;
@@ -117,8 +124,25 @@ class AsyncHookSupervisor {
    * the process 'exit' reaper, where async work would be cut off. A child with no
    * real pid (the unit-test fakes) falls back to its own `.kill()`.
    */
-  _killChildTree(child, signal = "SIGTERM") {
+  _killChildTree(
+    child,
+    signal = "SIGTERM",
+    { sandboxManagedTree = false } = {},
+  ) {
     if (!child) return;
+    if (sandboxManagedTree) {
+      // The Linux generic backend launches bubblewrap with --die-with-parent,
+      // --new-session, and a private PID namespace. Killing the Broker child
+      // therefore tears down the complete sandbox tree; a negative host PID
+      // would be both unnecessary and invalid because strong launches must not
+      // use detached:true.
+      try {
+        child.kill(signal);
+      } catch {
+        /* already gone */
+      }
+      return;
+    }
     const pid = child.pid;
     if (typeof pid !== "number" || pid <= 0) {
       try {
@@ -361,25 +385,39 @@ class AsyncHookSupervisor {
         : DEFAULT_TIMEOUT_MS;
 
     let child;
+    let sandboxManagedTree = false;
     try {
       const sandboxPolicy = resolveHookSandboxPolicy(hook, opts);
+      const explicitSandboxShell = requiresExplicitHookShell(sandboxPolicy);
+      const trustedRoot = explicitSandboxShell
+        ? requireTrustedHookRoot(opts.cwd)
+        : null;
+      const workingDirectory = trustedRoot || opts.cwd || process.cwd();
+      sandboxManagedTree =
+        explicitSandboxShell && this._deps.platform === "linux";
       const spawnOptions = {
-        cwd: opts.cwd || process.cwd(),
-        shell: true,
+        cwd: workingDirectory,
+        shell: explicitSandboxShell ? false : true,
         // POSIX: own process group so a timeout / stopAll can signal the whole
         // tree (shell + the real hook command), not just the shell wrapper.
         // No-op on Windows, where the tree is reaped via `taskkill /T` instead.
-        detached: this._deps.platform !== "win32",
+        detached: this._deps.platform !== "win32" && !sandboxManagedTree,
         env: {
           ...process.env,
           CLAUDE_HOOK_EVENT: hook.event || payload.hook_event_name || "",
         },
         ...(sandboxPolicy ? { sandboxPolicy } : {}),
       };
-      if (typeof this._deps.run !== "function") {
+      const brokerRun =
+        explicitSandboxShell &&
+        opts.broker &&
+        typeof opts.broker.spawn === "function"
+          ? opts.broker.spawn.bind(opts.broker)
+          : null;
+      if (typeof (brokerRun || this._deps.run) !== "function") {
         throw new Error("async hook process runner unavailable");
       }
-      child = this._deps.run(hook.command, {
+      const processOptions = {
         ...spawnOptions,
         origin: hook.origin || "async-hook:command",
         policy: "allow",
@@ -387,7 +425,39 @@ class AsyncHookSupervisor {
         pluginId: hook.pluginId || null,
         pluginVersion: hook.pluginVersion || null,
         pluginSource: hook.pluginSource || null,
-      });
+      };
+      if (explicitSandboxShell) {
+        const invocation = buildExplicitHookShellInvocation(hook.command, {
+          platform: this._deps.platform,
+        });
+        const run = brokerRun || this._deps.run;
+        let brokerOptions = processOptions;
+        if (brokerRun) {
+          const issuer =
+            opts.broker.issueLinuxWorkspaceSandboxExecutionContract;
+          const sandboxExecutionContract = issueTrustedHookSandboxContract({
+            issuer,
+            receiver: opts.broker,
+            file: invocation.file,
+            args: invocation.argv,
+            options: processOptions,
+            trustedRoot,
+            label: "trusted async-hook sandbox contract issuance failed",
+          });
+          if (this._deps.platform === "linux" && !sandboxExecutionContract) {
+            throw sandboxBoundaryError(
+              "trusted Linux async-hook sandbox contract issuer is unavailable",
+            );
+          }
+          brokerOptions = {
+            ...processOptions,
+            ...(sandboxExecutionContract ? { sandboxExecutionContract } : {}),
+          };
+        }
+        child = run(invocation.file, invocation.argv, brokerOptions);
+      } else {
+        child = this._deps.run(hook.command, processOptions);
+      }
     } catch (err) {
       const sandboxDenied =
         err?.code === "ERR_PROCESS_SANDBOX_BOUNDARY_UNSATISFIED";
@@ -406,7 +476,7 @@ class AsyncHookSupervisor {
     let out = "";
     let errOut = "";
     let killedByTimeout = false;
-    const rec = { child, timer: null };
+    const rec = { child, timer: null, sandboxManagedTree };
     this._running.set(key, rec);
 
     try {
@@ -432,7 +502,7 @@ class AsyncHookSupervisor {
       killedByTimeout = true;
       // Tree-kill: a hook that spawned a subprocess (e.g. `npm test`) must not
       // leave that subprocess orphaned when it exceeds its timeout.
-      this._killChildTree(child, "SIGTERM");
+      this._killChildTree(child, "SIGTERM", { sandboxManagedTree });
     }, timeout);
     if (typeof timer.unref === "function") timer.unref();
     rec.timer = timer;
@@ -594,7 +664,9 @@ class AsyncHookSupervisor {
       }
       // Tree-kill (not a bare child.kill) so a session end / process exit never
       // leaves an orphaned hook subprocess — the guarantee this class documents.
-      this._killChildTree(rec.child, "SIGTERM");
+      this._killChildTree(rec.child, "SIGTERM", {
+        sandboxManagedTree: rec.sandboxManagedTree === true,
+      });
       this._running.delete(key);
     }
     try {

package/src/lib/async-hook-supervisor.js

@@ -1,5 +1,13 @@
 import supervisor from "./async-hook-supervisor.cjs";
 import executionBroker from "./process-execution-broker/index.js";
+import hookShellCommand from "./hook-shell-command.cjs";
+
+const {
+  issueTrustedHookSandboxContract,
+  requireTrustedHookRoot,
+  requiresExplicitHookShell,
+  sandboxBoundaryError,
+} = hookShellCommand;
 
 const brokerRunner = executionBroker.spawn.bind(executionBroker);
 const brokerSyncRunner = executionBroker.spawnSync.bind(executionBroker);
@@ -9,12 +17,50 @@ export const _processDeps = {
   runSync: brokerSyncRunner,
 };
 
-function runAsyncHook(command, options = {}) {
-  return _processDeps.run(command, [], {
-    ...options,
-    origin: options.origin || "async-hook:command",
+function normalizeInvocation(argsOrOptions, maybeOptions) {
+  return Array.isArray(argsOrOptions)
+    ? { args: argsOrOptions, options: maybeOptions || {} }
+    : { args: [], options: argsOrOptions || {} };
+}
+
+function runAsyncHook(command, argsOrOptions = {}, maybeOptions) {
+  const { args, options } = normalizeInvocation(argsOrOptions, maybeOptions);
+  const callerOptions = { ...options };
+  delete callerOptions.sandboxExecutionContract;
+  const processOptions = {
+    ...callerOptions,
+    origin: callerOptions.origin || "async-hook:command",
     policy: "allow",
     scope: "async-hook",
+  };
+  const requiresContract = requiresExplicitHookShell(
+    processOptions.sandboxPolicy,
+  );
+  const trustedRoot = requiresContract
+    ? requireTrustedHookRoot(processOptions.cwd)
+    : null;
+  const sandboxExecutionContract = requiresContract
+    ? issueTrustedHookSandboxContract({
+        issuer: executionBroker.issueLinuxWorkspaceSandboxExecutionContract,
+        receiver: executionBroker,
+        file: command,
+        args,
+        options: processOptions,
+        trustedRoot,
+      })
+    : null;
+  if (
+    process.platform === "linux" &&
+    requiresContract &&
+    !sandboxExecutionContract
+  ) {
+    throw sandboxBoundaryError(
+      "trusted Linux async-hook sandbox contract could not be issued",
+    );
+  }
+  return _processDeps.run(command, args, {
+    ...processOptions,
+    ...(sandboxExecutionContract ? { sandboxExecutionContract } : {}),
   });
 }
 

package/src/lib/background-agent-supervisor.js

@@ -762,6 +762,47 @@ export function normalizeBackgroundWorktree(worktree, cwd) {
   return normalized;
 }
 
+/**
+ * Persist only the bounded, secret-free governance envelope needed by IDE task
+ * rows. The supervisor owns `owner`; callers cannot forge it. Prompt text,
+ * argv, credentials and tool arguments are deliberately excluded.
+ */
+export function normalizeBackgroundGovernance(
+  governance,
+  { id, sessionId } = {},
+) {
+  const source = governance && typeof governance === "object" ? governance : {};
+  const budget =
+    source.resourceBudget && typeof source.resourceBudget === "object"
+      ? source.resourceBudget
+      : {};
+  const positive = (value) => {
+    const n = Number(value);
+    return Number.isFinite(n) && n > 0 ? n : null;
+  };
+  const permissionMode = new Set([
+    "manual",
+    "auto",
+    "dontAsk",
+    "default",
+    "plan",
+    "acceptEdits",
+    "bypassPermissions",
+  ]).has(source.permissionMode)
+    ? source.permissionMode
+    : "default";
+  return {
+    version: 1,
+    owner: `background:${String(id || "").slice(0, 160)}`,
+    sessionId: sessionId ? String(sessionId).slice(0, 256) : null,
+    permissionMode,
+    resourceBudget: {
+      maxTurns: positive(budget.maxTurns),
+      maxCostUsd: positive(budget.maxCostUsd),
+    },
+  };
+}
+
 function persistedWorktree(state) {
   if (!state?.worktreePath) return null;
   return {
@@ -817,6 +858,7 @@ export function resumeBackgroundAgent(id, prompt, options = {}) {
     cliEntry: options.cliEntry,
     followUpArgv: ["agent", "--session", state.sessionId],
     worktree,
+    governance: state.governance,
   });
 }
 
@@ -855,10 +897,15 @@ export function launchBackgroundAgent({
   cliEntry,
   followUpArgv,
   worktree,
+  governance,
 }) {
   assertUsableCwd(cwd);
   const worktreeState = normalizeBackgroundWorktree(worktree, cwd);
   const id = createBackgroundAgentId();
+  const governanceState = normalizeBackgroundGovernance(governance, {
+    id,
+    sessionId,
+  });
   const dir = backgroundAgentsDir();
   const jobFile = join(dir, `${id}.job.${process.pid}.json`);
   const worker = fileURLToPath(
@@ -873,6 +920,7 @@ export function launchBackgroundAgent({
     cliEntry: cliEntry || process.argv[1],
     logFile: logPath(id),
     ...(worktreeState || {}),
+    governance: governanceState,
     // Present = interactive attach can start follow-up turns; absent = the
     // transport rejects prompts (log-only session).
     ...(Array.isArray(followUpArgv) ? { followUpArgv } : {}),
@@ -897,6 +945,7 @@ export function launchBackgroundAgent({
     exitCode: null,
     logFile: job.logFile,
     ...(worktreeState || {}),
+    governance: governanceState,
   };
   writeBackgroundAgentState(state);
   let child;