chainlesschain 0.162.182 → 0.162.184

package/src/lib/plugin-runtime/monitors.js

@@ -22,7 +22,10 @@ import fs from "fs";
 import { discoverPlugins } from "./scopes.js";
 import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
 import { componentCapabilityDenial } from "./capabilities.js";
-import { mergePluginSandboxPolicies } from "./sandbox-policy.js";
+import {
+  issuePluginWorkspaceAuthority,
+  mergePluginSandboxPolicies,
+} from "./sandbox-policy.js";
 
 export const _deps = { readFileSync: fs.readFileSync };
 
@@ -55,7 +58,7 @@ export function _resetMonitorWarnings() {
 }
 
 /** Normalize one raw monitor entry into a validated descriptor, or null. */
-function normalizeMonitor(plugin, raw) {
+function normalizeMonitor(plugin, raw, pluginWorkspaceAuthority) {
   if (!raw || typeof raw !== "object") return null;
   if (typeof raw.name !== "string" || raw.name === "") return null;
   if (typeof raw.command !== "string" || raw.command === "") return null;
@@ -91,6 +94,7 @@ function normalizeMonitor(plugin, raw) {
     intervalMs,
     env,
     cwd: plugin.root,
+    pluginWorkspaceAuthority,
     origin: "plugin:monitor",
     pluginId: plugin.name,
     pluginVersion: plugin.version,
@@ -131,6 +135,18 @@ export function collectPluginMonitors(opts = {}) {
       denied.push({ name: p.name, reason: denial.reason });
       continue;
     }
+    let pluginWorkspaceAuthority;
+    try {
+      pluginWorkspaceAuthority = issuePluginWorkspaceAuthority({
+        root: p.root,
+        origin: "plugin:monitor",
+        pluginId: p.name,
+        pluginVersion: p.version,
+        pluginSource: p.manifest?.manifestPath || "",
+      });
+    } catch {
+      continue;
+    }
     let parsed;
     if (m.absPath) {
       try {
@@ -159,7 +175,7 @@ export function collectPluginMonitors(opts = {}) {
         ? parsed
         : [];
     for (const raw of list) {
-      const desc = normalizeMonitor(p, raw);
+      const desc = normalizeMonitor(p, raw, pluginWorkspaceAuthority);
       if (desc) out.push(desc);
     }
   }

package/src/lib/plugin-runtime/sandbox-policy.js

@@ -1,3 +1,6 @@
+import fs from "node:fs";
+import path from "node:path";
+
 /**
  * Normalize the small, declarative sandbox contract exposed to plugins.
  *
@@ -14,6 +17,8 @@ export const PLUGIN_SANDBOX_BOUNDARIES = Object.freeze([
 ]);
 
 const SUPPORTED_BOUNDARIES = new Set(PLUGIN_SANDBOX_BOUNDARIES);
+const PLUGIN_WORKSPACE_AUTHORITY_KIND = "trusted-plugin-workspace";
+const pluginWorkspaceAuthorities = new WeakMap();
 
 function invalidPolicy(message) {
   const error = new Error(message);
@@ -21,6 +26,100 @@ function invalidPolicy(message) {
   return error;
 }
 
+function normalizedProvenance(value = {}) {
+  return Object.freeze({
+    origin: typeof value.origin === "string" ? value.origin : "",
+    pluginId: typeof value.pluginId === "string" ? value.pluginId : "",
+    pluginVersion:
+      typeof value.pluginVersion === "string" ? value.pluginVersion : "",
+    pluginSource:
+      typeof value.pluginSource === "string" ? value.pluginSource : "",
+  });
+}
+
+function sameProvenance(left, right) {
+  return (
+    left.origin === right.origin &&
+    left.pluginId === right.pluginId &&
+    left.pluginVersion === right.pluginVersion &&
+    left.pluginSource === right.pluginSource
+  );
+}
+
+/**
+ * Mint an opaque, reusable authority from a plugin root produced by trusted
+ * installed-plugin discovery. Manifest/server/monitor data receives only the
+ * token: the canonical writable root stays in this module's WeakMap.
+ *
+ * A token is reusable because MCP reconnects and interval monitors can launch
+ * more than once. The process broker still mints a separate one-shot execution
+ * contract for every child.
+ */
+export function issuePluginWorkspaceAuthority(value = {}) {
+  if (
+    typeof value.root !== "string" ||
+    value.root.length === 0 ||
+    value.root.includes("\0")
+  ) {
+    throw invalidPolicy("trusted plugin workspace root must be a path");
+  }
+  const requestedRoot = path.resolve(value.root);
+  let canonicalRoot;
+  let stat;
+  try {
+    const implementation = fs.realpathSync.native || fs.realpathSync;
+    canonicalRoot = implementation.call(fs.realpathSync, requestedRoot);
+    stat = fs.statSync(canonicalRoot);
+  } catch {
+    throw invalidPolicy("trusted plugin workspace root is unavailable");
+  }
+  if (!stat.isDirectory()) {
+    throw invalidPolicy("trusted plugin workspace root must be a directory");
+  }
+
+  const provenance = normalizedProvenance(value);
+  if (
+    !provenance.origin.startsWith("plugin:") ||
+    !provenance.pluginId ||
+    !provenance.pluginVersion
+  ) {
+    throw invalidPolicy("trusted plugin workspace provenance is incomplete");
+  }
+
+  const authority = Object.freeze({
+    contractVersion: 1,
+    kind: PLUGIN_WORKSPACE_AUTHORITY_KIND,
+  });
+  pluginWorkspaceAuthorities.set(
+    authority,
+    Object.freeze({ root: canonicalRoot, provenance }),
+  );
+  return authority;
+}
+
+/**
+ * Resolve an authority only for the exact plugin/component provenance to which
+ * the loader bound it. Structurally similar manifest objects are not accepted.
+ */
+export function resolvePluginWorkspaceAuthority(authority, provenance = {}) {
+  if (
+    !authority ||
+    typeof authority !== "object" ||
+    authority.contractVersion !== 1 ||
+    authority.kind !== PLUGIN_WORKSPACE_AUTHORITY_KIND
+  ) {
+    return null;
+  }
+  const binding = pluginWorkspaceAuthorities.get(authority);
+  if (
+    !binding ||
+    !sameProvenance(binding.provenance, normalizedProvenance(provenance))
+  ) {
+    return null;
+  }
+  return binding.root;
+}
+
 /**
  * @param {unknown} raw
  * @param {{ label?: string }} [opts]

package/src/lib/plugin-runtime/scopes.js

@@ -42,6 +42,7 @@ export const _deps = {
 
 // Lowest → highest precedence.
 export const SCOPES = ["user", "project", "local"];
+export const DISABLED_FILENAME = ".disabled";
 
 /** Filesystem-safe encoding of a (possibly scoped, e.g. @org/name) plugin name. */
 export function encodeName(name) {
@@ -105,6 +106,13 @@ export function activeVersion(scope, name, opts = {}) {
   return versions[0];
 }
 
+/** Whether one scoped plugin install is eligible for runtime discovery. */
+export function isPluginEnabled(scope, name, opts = {}) {
+  return !_deps.existsSync(
+    path.join(pluginNameDir(scope, name, opts), DISABLED_FILENAME),
+  );
+}
+
 /**
  * Discover every installed plugin's ACTIVE version across all scopes, applying
  * scope precedence (local > project > user) so a name installed at multiple
@@ -116,8 +124,8 @@ export function activeVersion(scope, name, opts = {}) {
  * for tooling that must see even blocked plugins (e.g. `cc plugin installed`
  * showing why something is blocked). No managed settings file → no filtering.
  *
- * @param {object} [opts] { cwd, scopes?, skipPolicy?, env?, managedSettingsFile? }
- * @returns {Array<{scope, name, version, root, manifest}>}
+ * @param {object} [opts] { cwd, scopes?, skipPolicy?, includeDisabled?, env?, managedSettingsFile? }
+ * @returns {Array<{scope, name, version, root, manifest, enabled}>}
  */
 export function discoverPlugins(opts = {}) {
   // `cc agent --bare` (CC_PLUGINS=0): the plugin runtime is fully off. Every
@@ -139,6 +147,8 @@ export function discoverPlugins(opts = {}) {
     if (!dirExists(root, opts.strictIo === true)) continue;
     for (const encoded of listDirs(root, opts.strictIo === true)) {
       const nameDir = path.join(root, encoded);
+      const enabled = !_deps.existsSync(path.join(nameDir, DISABLED_FILENAME));
+      if (!enabled && opts.includeDisabled !== true) continue;
       const version = activeVersionForDir(nameDir, opts.strictIo === true);
       if (!version) continue;
       const versionDir = path.join(nameDir, version);
@@ -158,6 +168,7 @@ export function discoverPlugins(opts = {}) {
         version: manifest.metadata?.version || version,
         root: versionDir,
         manifest,
+        enabled,
       });
     }
   }

package/src/lib/plugin-usage-attribution.js

@@ -0,0 +1,44 @@
+/**
+ * Extract a secret-free plugin identity from a tool result. Plugin bins expose
+ * an explicit `plugin_bin` record; extension-tier tools may expose a
+ * `toolAttribution.source` in the stable `plugin:<id>` / `plugin/<id>` form.
+ */
+export function extractPluginUsageAttribution(result) {
+  const pluginBin =
+    result?.plugin_bin && typeof result.plugin_bin === "object"
+      ? result.plugin_bin
+      : null;
+  if (pluginBin?.plugin) {
+    const plugin = boundedIdentity(pluginBin.plugin, 256);
+    if (!plugin) return {};
+    return {
+      plugin,
+      pluginVersion: pluginBin.version
+        ? boundedIdentity(pluginBin.version, 128) || undefined
+        : undefined,
+    };
+  }
+  const attribution =
+    result?.toolAttribution && typeof result.toolAttribution === "object"
+      ? result.toolAttribution
+      : null;
+  const source =
+    typeof attribution?.source === "string" ? attribution.source : "";
+  const match = source.match(/^plugin(?::|\/)(.+)$/i);
+  const plugin = match ? boundedIdentity(match[1], 256) : null;
+  return plugin
+    ? {
+        plugin,
+        pluginVersion: attribution.version
+          ? boundedIdentity(attribution.version, 128) || undefined
+          : undefined,
+      }
+    : {};
+}
+
+function boundedIdentity(value, max) {
+  const clean = String(value ?? "")
+    .replace(/\p{Cc}/gu, "")
+    .trim();
+  return clean ? clean.slice(0, max) : null;
+}