chainlesschain 0.162.182 → 0.162.184

package/src/lib/plugin-runtime/install.js

@@ -26,22 +26,33 @@ import {
   listInstalledVersions,
   activeVersion,
   discoverPlugins,
+  DISABLED_FILENAME,
 } from "./scopes.js";
-import { verifyPluginManifest } from "../plugin-security.js";
+import {
+  enforcePluginPolicy,
+  verifyPluginManifest,
+} from "../plugin-security.js";
 import {
   writePluginLock,
   buildPluginSbom,
   LOCK_FILENAME,
+  readPluginLock,
+  verifyInstalledSignature,
 } from "./signature.js";
+import { loadManagedPluginPolicy, filterByManagedPolicy } from "./policy.js";
+import { managedSettingsPath } from "../settings-loader.cjs";
 import executionBroker from "../process-execution-broker/index.js";
 
 export const MAX_LISTED_PLUGIN_VERSIONS = 64;
+export const SOURCE_METADATA_FILENAME = ".plugin-source.json";
 
 export const _deps = {
   existsSync: fs.existsSync,
   mkdirSync: fs.mkdirSync,
   rmSync: fs.rmSync,
+  renameSync: fs.renameSync,
   readdirSync: fs.readdirSync,
+  readFileSync: fs.readFileSync,
   copyFileSync: fs.copyFileSync,
   lstatSync: fs.lstatSync,
   writeFileSync: fs.writeFileSync,
@@ -49,6 +60,8 @@ export const _deps = {
   spawnSync: (...args) => executionBroker.spawnSync(...args),
 };
 
+const pendingPluginTransactions = new WeakMap();
+
 /**
  * Install a plugin from a local directory into a scope's immutable version dir.
  * @param {string} srcDir  directory containing the plugin (with its manifest)
@@ -69,6 +82,17 @@ export function installFromDirectory(srcDir, opts = {}) {
     );
   }
   const { name, version } = manifest.metadata;
+  const sourceMetadata = normalizeSourceMetadata(opts.sourceMetadata);
+  if (opts.managedPolicy) {
+    enforcePluginPolicy(
+      {
+        name,
+        source: opts.policySource || sourceMetadata?.source || null,
+        action: "install",
+      },
+      opts.managedPolicy,
+    );
+  }
 
   // Optional signature/integrity verification of the manifest at install time
   // (Phase 3.3l). verifyPluginManifest THROWS on any mismatch/failure — a signed
@@ -90,55 +114,116 @@ export function installFromDirectory(srcDir, opts = {}) {
   }
 
   const dest = pluginVersionDir(scope, name, version, { cwd: opts.cwd });
-  if (_deps.existsSync(dest)) {
-    if (!opts.force) {
-      throw new Error(
-        `${name}@${version} is already installed at ${scope} scope (immutable). ` +
-          `Use --force to reinstall, or bump the version.`,
-      );
-    }
-    _deps.rmSync(dest, { recursive: true, force: true });
+  const destExists = _deps.existsSync(dest);
+  if (destExists && !opts.force) {
+    throw new Error(
+      `${name}@${version} is already installed at ${scope} scope (immutable). ` +
+        `Use --force to reinstall, or bump the version.`,
+    );
   }
 
-  _deps.mkdirSync(dest, { recursive: true });
-  copyDirGuarded(src, dest, dest);
+  const nameDir = pluginNameDir(scope, name, { cwd: opts.cwd });
+  _deps.mkdirSync(nameDir, { recursive: true });
+  const transactionRoot = _deps.mkdtempSync(path.join(nameDir, ".install-"));
+  const staged = path.join(transactionRoot, "staged");
+  const backup = destExists ? path.join(transactionRoot, "previous") : null;
+  const previousActive = getActiveVersion(name, { scope, cwd: opts.cwd });
+  let installedAtDest = false;
+  let transactionRetained = false;
 
-  // A lock may ONLY exist if THIS installer wrote it. The source is untrusted
-  // and may ship its own `.plugin-lock.json` (copied verbatim above) — on an
-  // unsigned install that forged lock would otherwise survive into the
-  // "immutable" version dir and defeat load-time requireSignedPlugins.
-  _deps.rmSync(path.join(dest, LOCK_FILENAME), { force: true });
+  try {
+    _deps.mkdirSync(staged, { recursive: true });
+    copyDirGuarded(src, staged, staged);
 
-  // Record the verified signature into the installed (immutable) version dir so
-  // load-time enforcement can re-check it. The manifest was copied verbatim, so
-  // its bytes/sha in `dest` match what we verified in `src`.
-  if (verification) {
-    const destManifest = path.join(
-      dest,
-      path.relative(src, manifest.manifestPath),
-    );
-    writePluginLock(dest, {
-      manifestFile: destManifest,
-      sha256: verification.sha256,
-      publicKeySha256: verification.publicKeySha256,
-      signatureVerified: verification.signatureVerified === true,
-      signatureBase64: verification.signatureBase64,
-      publicKeyPem: verification.publicKeyPem,
-      sbom: buildPluginSbom(dest),
-    });
-  }
+    // A lock may ONLY exist if THIS installer wrote it. The source is untrusted
+    // and may ship its own `.plugin-lock.json` or provenance metadata.
+    _deps.rmSync(path.join(staged, LOCK_FILENAME), { force: true });
+    _deps.rmSync(path.join(staged, SOURCE_METADATA_FILENAME), { force: true });
 
-  // Make the freshly-installed version active.
-  setActiveVersion(name, version, { scope, cwd: opts.cwd });
+    if (sourceMetadata) {
+      _deps.writeFileSync(
+        path.join(staged, SOURCE_METADATA_FILENAME),
+        JSON.stringify(sourceMetadata, null, 2),
+        "utf8",
+      );
+    }
 
-  return {
-    name,
-    version,
-    scope,
-    dir: dest,
-    warnings: manifest.warnings,
-    signatureVerified: verification?.signatureVerified === true,
-  };
+    // Record the verified signature into the staged immutable version. The
+    // manifest and complete component SBOM are re-verified below before any
+    // active bytes or pointer can change.
+    if (verification) {
+      const stagedManifest = path.join(
+        staged,
+        path.relative(src, manifest.manifestPath),
+      );
+      writePluginLock(staged, {
+        manifestFile: stagedManifest,
+        sha256: verification.sha256,
+        publicKeySha256: verification.publicKeySha256,
+        signatureVerified: verification.signatureVerified === true,
+        signatureBase64: verification.signatureBase64,
+        publicKeyPem: verification.publicKeyPem,
+        sbom: buildPluginSbom(staged),
+      });
+    }
+    validateStagedInstall(staged, { name, version, verification });
+
+    // Commit the fully validated directory with same-volume renames. A forced
+    // same-version reinstall retains the old bytes until the caller finalizes
+    // the upgrade transaction.
+    if (backup) _deps.renameSync(dest, backup);
+    try {
+      _deps.renameSync(staged, dest);
+      installedAtDest = true;
+    } catch (error) {
+      if (backup && _deps.existsSync(backup) && !_deps.existsSync(dest)) {
+        _deps.renameSync(backup, dest);
+      }
+      throw error;
+    }
+
+    try {
+      setActiveVersion(name, version, { scope, cwd: opts.cwd });
+    } catch (error) {
+      restoreInstalledBytes({ dest, backup });
+      restoreActivePointer(name, previousActive, { scope, cwd: opts.cwd });
+      installedAtDest = false;
+      throw error;
+    }
+
+    const result = {
+      name,
+      version,
+      scope,
+      dir: dest,
+      warnings: manifest.warnings,
+      signatureVerified: verification?.signatureVerified === true,
+      sourceMetadata,
+      enabled: isPluginEnabled(name, { scope, cwd: opts.cwd }),
+      loadValidated: true,
+    };
+    if (opts.transactional === true) {
+      pendingPluginTransactions.set(result, {
+        name,
+        version,
+        scope,
+        cwd: opts.cwd,
+        dest,
+        backup,
+        transactionRoot,
+        previousActive,
+      });
+      transactionRetained = true;
+    }
+    return result;
+  } finally {
+    if (!transactionRetained) {
+      if (installedAtDest && backup && _deps.existsSync(backup)) {
+        _deps.rmSync(backup, { recursive: true, force: true });
+      }
+      _deps.rmSync(transactionRoot, { recursive: true, force: true });
+    }
+  }
 }
 
 /**
@@ -150,8 +235,21 @@ export function installFromDirectory(srcDir, opts = {}) {
  */
 export function installFromSource(source, opts = {}) {
   return _withMaterializedSource(source, (dir, info) => {
-    const res = installFromDirectory(dir, opts);
-    return info ? { ...res, source: info.url, ref: info.ref || null } : res;
+    const sourceMetadata =
+      normalizeSourceMetadata(opts.sourceMetadata) ||
+      normalizeSourceMetadata(
+        info
+          ? { type: "git", source: info.url, ref: info.ref || null }
+          : { type: "local", source: path.resolve(String(source || "")) },
+      );
+    const res = installFromDirectory(dir, { ...opts, sourceMetadata });
+    return info
+      ? {
+          ...res,
+          source: sourceMetadata?.source || null,
+          ref: sourceMetadata?.ref || null,
+        }
+      : res;
   });
 }
 
@@ -202,6 +300,13 @@ export function updatePlugin(source, opts = {}) {
       );
     }
     const { name, version } = manifest.metadata;
+    const sourceMetadata =
+      normalizeSourceMetadata(opts.sourceMetadata) ||
+      normalizeSourceMetadata(
+        info
+          ? { type: "git", source: info.url, ref: info.ref || null }
+          : { type: "local", source: path.resolve(String(source || "")) },
+      );
     const previousVersion = getActiveVersion(name, { scope, cwd: opts.cwd });
     const dest = pluginVersionDir(scope, name, version, { cwd: opts.cwd });
     const sameVersionExists = _deps.existsSync(dest);
@@ -212,28 +317,105 @@ export function updatePlugin(source, opts = {}) {
       if (previousVersion !== version) {
         setActiveVersion(name, version, { scope, cwd: opts.cwd });
       }
-      return {
+      const result = {
         name,
         version,
         previousVersion,
         updated: previousVersion !== version,
         reinstalled: false,
-        source: info ? info.url : null,
+        source: sourceMetadata?.source || null,
+        ref: sourceMetadata?.ref || null,
       };
+      if (opts.transactional === true && previousVersion !== version) {
+        pendingPluginTransactions.set(result, {
+          name,
+          version,
+          scope,
+          cwd: opts.cwd,
+          dest,
+          backup: null,
+          transactionRoot: null,
+          previousActive: previousVersion,
+          pointerOnly: true,
+        });
+      }
+      return result;
     }
 
-    const res = installFromDirectory(dir, { ...opts, scope, force: true });
-    return {
+    const res = installFromDirectory(dir, {
+      ...opts,
+      scope,
+      force: true,
+      sourceMetadata,
+      transactional: opts.transactional === true,
+    });
+    const result = {
       ...res,
       previousVersion,
       updated: previousVersion !== version,
       reinstalled: sameVersionExists,
-      source: info ? info.url : null,
-      ref: info ? info.ref || null : null,
+      source: sourceMetadata?.source || null,
+      ref: sourceMetadata?.ref || null,
     };
+    transferPendingTransaction(res, result);
+    return result;
   });
 }
 
+/**
+ * Commit a transactional update after capability consent and command-layer
+ * validation have succeeded. Backup cleanup is best-effort: an active,
+ * validated install must not be reported as failed solely because antivirus or
+ * another reader briefly holds the hidden rollback directory open.
+ */
+export function finalizePluginUpdate(result) {
+  const transaction = pendingPluginTransactions.get(result);
+  if (!transaction) return { finalized: false };
+  pendingPluginTransactions.delete(result);
+  let cleanupPending = false;
+  if (transaction.transactionRoot) {
+    try {
+      _deps.rmSync(transaction.transactionRoot, {
+        recursive: true,
+        force: true,
+      });
+    } catch {
+      cleanupPending = true;
+    }
+  }
+  return { finalized: true, cleanupPending };
+}
+
+/**
+ * Restore the active version and, for a forced same-version reinstall, the
+ * exact prior bytes. New rejected versions are removed so `.active` fallback
+ * cannot silently select them later.
+ */
+export function rollbackPluginUpdate(result) {
+  const transaction = pendingPluginTransactions.get(result);
+  if (!transaction) return { rolledBack: false, version: null };
+
+  restoreActivePointer(
+    transaction.name,
+    transaction.previousActive,
+    transaction,
+  );
+  if (!transaction.pointerOnly) {
+    restoreInstalledBytes(transaction);
+  }
+  pendingPluginTransactions.delete(result);
+  if (transaction.transactionRoot) {
+    _deps.rmSync(transaction.transactionRoot, {
+      recursive: true,
+      force: true,
+    });
+  }
+  return {
+    rolledBack: true,
+    version: transaction.previousActive || null,
+  };
+}
+
 /**
  * Classify a source string into a git URL (+ optional ref), or null when it is
  * not remote-looking. `owner/repo` expands to a GitHub HTTPS URL.
@@ -319,10 +501,26 @@ export function fetchGitRepo(url, ref) {
  * invisible and impossible to inspect / uninstall / un-deny.
  */
 export function listInstalled(opts = {}) {
+  let managed = null;
+  let managedError = null;
+  try {
+    managed = loadManagedPluginPolicy({
+      env: opts.env,
+      managedSettingsFile: opts.managedSettingsFile,
+    });
+  } catch (error) {
+    managedError = error;
+  }
+  const policySource = managedSettingsPath({
+    env: opts.env,
+    managedSettingsFile: opts.managedSettingsFile,
+  });
+
   return discoverPlugins({
     cwd: opts.cwd,
     scopes: opts.scopes,
     skipPolicy: true,
+    includeDisabled: true,
   }).map((p) => {
     const allVersions = listInstalledVersions(p.scope, p.name, {
       cwd: opts.cwd,
@@ -335,6 +533,16 @@ export function listInstalled(opts = {}) {
     ) {
       versions[versions.length - 1] = p.version;
     }
+    const lock = readPluginLock(p.root);
+    const signature = verifyInstalledSignature(p);
+    const policyResult =
+      managed && !managedError
+        ? filterByManagedPolicy([p], managed)
+        : { kept: [p], dropped: [] };
+    const policyDrop = policyResult.dropped[0] || null;
+    const sbomFiles = Array.isArray(lock?.sbom?.files)
+      ? lock.sbom.files.slice(0, 100000)
+      : [];
     return {
       name: p.name,
       version: p.version,
@@ -342,6 +550,45 @@ export function listInstalled(opts = {}) {
       scope: p.scope,
       dir: p.root,
       ok: p.manifest?.ok === true,
+      enabled: p.enabled !== false,
+      source: readSourceMetadata(p.root),
+      integrity: {
+        signature: {
+          present: Boolean(lock?.signatureBase64 && lock?.publicKeyPem),
+          verified: signature.signed === true,
+          reason: signature.signed ? null : signature.reason || "unsigned",
+          manifestSha256: lock?.sha256 || null,
+          publicKeySha256:
+            signature.publicKeySha256 || lock?.publicKeySha256 || null,
+        },
+        sbom: {
+          present: Boolean(lock?.sbom),
+          digest: lock?.sbom?.digest || null,
+          fileCount: sbomFiles.length,
+          totalBytes: Math.min(
+            Number.MAX_SAFE_INTEGER,
+            sbomFiles.reduce(
+              (sum, file) =>
+                sum +
+                (Number.isFinite(Number(file?.bytes)) && Number(file.bytes) > 0
+                  ? Number(file.bytes)
+                  : 0),
+              0,
+            ),
+          ),
+        },
+      },
+      policy: {
+        managed: Boolean(managed) || Boolean(managedError),
+        source: policySource,
+        allowed: !managedError && !policyDrop,
+        reason: managedError
+          ? managedError.message
+          : policyDrop?.reason || (managed ? "allowed by managed policy" : ""),
+        requireSigned:
+          managed?.requireSignedPlugins === true ||
+          managed?.requireSignedPlugins === "require",
+      },
     };
   });
 }
@@ -407,16 +654,120 @@ export function setActiveVersion(name, version, opts = {}) {
   if (!_deps.existsSync(versionDir)) {
     throw new Error(`${name}@${version} is not installed at ${scope} scope`);
   }
-  const activeFile = path.join(pluginNameDir(scope, name, { cwd }), ".active");
-  _deps.writeFileSync(activeFile, String(version), "utf8");
+  const nameDir = pluginNameDir(scope, name, { cwd });
+  const activeFile = path.join(nameDir, ".active");
+  const tempDir = _deps.mkdtempSync(path.join(nameDir, ".active-"));
+  const tempFile = path.join(tempDir, "next");
+  try {
+    _deps.writeFileSync(tempFile, String(version), "utf8");
+    _deps.renameSync(tempFile, activeFile);
+  } finally {
+    _deps.rmSync(tempDir, { recursive: true, force: true });
+  }
   return { name, version, scope, active: version };
 }
 
+/** Enable or disable one scoped plugin without deleting immutable versions. */
+export function setPluginEnabled(name, enabled, opts = {}) {
+  const scope = opts.scope || "user";
+  const cwd = opts.cwd;
+  const nameDir = pluginNameDir(scope, name, { cwd });
+  if (
+    !_deps.existsSync(nameDir) ||
+    listInstalledVersions(scope, name, { cwd }).length === 0
+  ) {
+    throw new Error(`${name} is not installed at ${scope} scope`);
+  }
+  const marker = path.join(nameDir, DISABLED_FILENAME);
+  if (enabled) {
+    _deps.rmSync(marker, { force: true });
+  } else {
+    _deps.writeFileSync(
+      marker,
+      JSON.stringify(
+        {
+          disabled: true,
+          reason: String(opts.reason || "disabled by user").slice(0, 256),
+        },
+        null,
+        2,
+      ),
+      "utf8",
+    );
+  }
+  return { name, scope, enabled: Boolean(enabled) };
+}
+
+/** Current lifecycle state for one scoped plugin. */
+export function isPluginEnabled(name, opts = {}) {
+  const scope = opts.scope || "user";
+  return !_deps.existsSync(
+    path.join(pluginNameDir(scope, name, { cwd: opts.cwd }), DISABLED_FILENAME),
+  );
+}
+
 /** Which version is active for a plugin at a scope (or null). */
 export function getActiveVersion(name, opts = {}) {
   return activeVersion(opts.scope || "user", name, { cwd: opts.cwd });
 }
 
+function readSourceMetadata(versionDir) {
+  const file = path.join(versionDir, SOURCE_METADATA_FILENAME);
+  if (!_deps.existsSync(file)) return null;
+  try {
+    return normalizeSourceMetadata(
+      JSON.parse(_deps.readFileSync(file, "utf8")),
+    );
+  } catch {
+    return null;
+  }
+}
+
+function normalizeSourceMetadata(value) {
+  if (!value || typeof value !== "object") return null;
+  const type = ["local", "git", "registry"].includes(value.type)
+    ? value.type
+    : "git";
+  const source = sanitizeSource(value.source, type === "local");
+  if (!source) return null;
+  const metadata = {
+    version: 1,
+    type,
+    source,
+    ref: cleanBounded(value.ref, 256),
+  };
+  const registry = sanitizeSource(value.registry);
+  const resolvedSource = sanitizeSource(value.resolvedSource);
+  const packageName = cleanBounded(value.package, 256);
+  if (registry) metadata.registry = registry;
+  if (resolvedSource) metadata.resolvedSource = resolvedSource;
+  if (packageName) metadata.package = packageName;
+  if (value.offline === true) metadata.offline = true;
+  return metadata;
+}
+
+function sanitizeSource(value, preservePath = false) {
+  const raw = cleanBounded(value, 4096);
+  if (!raw) return null;
+  if (preservePath) return raw;
+  try {
+    const parsed = new URL(raw);
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+  } catch {
+    return raw;
+  }
+}
+
+function cleanBounded(value, max) {
+  if (typeof value !== "string") return null;
+  const clean = value.replace(/\p{Cc}/gu, "").trim();
+  return clean ? clean.slice(0, max) : null;
+}
+
 // ── guarded recursive copy ────────────────────────────────────────────────
 
 /**
@@ -437,3 +788,63 @@ function copyDirGuarded(src, dst, root) {
     }
   }
 }
+
+function validateStagedInstall(root, { name, version, verification }) {
+  const parsed = parsePluginManifest(root);
+  if (
+    !parsed.ok ||
+    parsed.metadata.name !== name ||
+    parsed.metadata.version !== version
+  ) {
+    const details = parsed.errors?.length
+      ? `: ${parsed.errors.join("; ")}`
+      : "";
+    throw new Error(`staged plugin failed load validation${details}`);
+  }
+  if (verification) {
+    const signature = verifyInstalledSignature({ root });
+    if (!signature.signed) {
+      throw new Error(
+        `staged plugin failed signature/SBOM validation: ${signature.reason || "unknown error"}`,
+      );
+    }
+  }
+}
+
+function transferPendingTransaction(from, to) {
+  const transaction = pendingPluginTransactions.get(from);
+  if (!transaction) return;
+  pendingPluginTransactions.delete(from);
+  pendingPluginTransactions.set(to, transaction);
+}
+
+function restoreActivePointer(name, version, opts = {}) {
+  if (version) {
+    setActiveVersion(name, version, opts);
+    return;
+  }
+  _deps.rmSync(
+    path.join(
+      pluginNameDir(opts.scope || "user", name, { cwd: opts.cwd }),
+      ".active",
+    ),
+    { force: true },
+  );
+}
+
+function restoreInstalledBytes({ dest, backup, transactionRoot }) {
+  if (!backup) {
+    _deps.rmSync(dest, { recursive: true, force: true });
+    return;
+  }
+  const rejected = path.join(transactionRoot, "rejected");
+  _deps.renameSync(dest, rejected);
+  try {
+    _deps.renameSync(backup, dest);
+  } catch (error) {
+    if (_deps.existsSync(rejected) && !_deps.existsSync(dest)) {
+      _deps.renameSync(rejected, dest);
+    }
+    throw error;
+  }
+}

package/src/lib/plugin-runtime/mcp.js

@@ -21,7 +21,10 @@ import {
   componentCapabilityDenial,
   networkTargetDenial,
 } from "./capabilities.js";
-import { mergePluginSandboxPolicies } from "./sandbox-policy.js";
+import {
+  issuePluginWorkspaceAuthority,
+  mergePluginSandboxPolicies,
+} from "./sandbox-policy.js";
 
 export const _deps = { readFileSync: fs.readFileSync };
 
@@ -89,6 +92,21 @@ export function collectPluginMcpServers(opts = {}) {
     if (!p.manifest || p.manifest.ok !== true) continue;
     const m = p.manifest.components?.mcp;
     if (!m) continue;
+    const pluginSource = m.absPath || p.manifest.manifestPath;
+    let pluginWorkspaceAuthority;
+    try {
+      pluginWorkspaceAuthority = issuePluginWorkspaceAuthority({
+        root: p.root,
+        origin: "plugin:mcp",
+        pluginId: p.name,
+        pluginVersion: p.version,
+        pluginSource,
+      });
+    } catch {
+      // The discovery root disappeared or stopped resolving safely. Refuse the
+      // component instead of copying an attacker-controlled path downstream.
+      continue;
+    }
     // Component-level capability gate: a plugin that declared a permissions
     // block but under-declared the `mcp` capability its server needs gets its
     // MCP component refused here (mirrors the hooks/monitors/bin/lsp denial).
@@ -150,7 +168,8 @@ export function collectPluginMcpServers(opts = {}) {
         policy: "allow",
         pluginId: p.name,
         pluginVersion: p.version,
-        pluginSource: m.absPath || p.manifest.manifestPath,
+        pluginSource,
+        pluginWorkspaceAuthority,
       };
       added++;
     }