chainlesschain 0.162.183 → 0.162.185

package/src/gateways/terminal/PtyManager.js

@@ -20,6 +20,7 @@
 import EventEmitter from "events";
 import { randomUUID } from "crypto";
 import { createRequire } from "module";
+import path from "node:path";
 import { RingBuffer } from "./RingBuffer.js";
 import { executionBroker } from "../../lib/process-execution-broker/index.js";
 
@@ -91,11 +92,17 @@ export class PtyManager extends EventEmitter {
     ) {
       throw new TypeError("resolveSandboxPolicy must be a function or null");
     }
-    this._policyCwd = opts.policyCwd || process.cwd();
+    this._policyCwd = path.resolve(opts.policyCwd || process.cwd());
     this._resolveSandboxPolicy = resolveSandboxPolicy;
     this._deps = {
       loadNodePty: opts._deps?.loadNodePty || (() => require("node-pty")),
       spawnPty: opts._deps?.spawnPty || null,
+      issueLinuxWorkspaceSandboxExecutionContract:
+        opts._deps?.issueLinuxWorkspaceSandboxExecutionContract ||
+        executionBroker.issueLinuxWorkspaceSandboxExecutionContract.bind(
+          executionBroker,
+        ),
+      platform: opts._deps?.platform || (() => process.platform),
       now: opts._deps?.now || (() => Date.now()),
     };
     this._sessions = new Map();
@@ -120,7 +127,10 @@ export class PtyManager extends EventEmitter {
       throw new Error("shell_not_allowed");
     }
 
-    const cwd = req.cwd || this.config.defaultCwd || process.cwd();
+    const cwd = path.resolve(
+      this._policyCwd,
+      req.cwd || this.config.defaultCwd || this._policyCwd,
+    );
     // A remote cwd may discover a stricter policy, but it must never replace
     // the fixed workspace root supplied by the host. Resolve and validate the
     // pinned policy before loading node-pty or allocating a native terminal.
@@ -133,15 +143,6 @@ export class PtyManager extends EventEmitter {
         )
       : null;
 
-    let pty;
-    try {
-      pty = this._deps.loadNodePty();
-    } catch {
-      const err = new Error("pty_native_unavailable");
-      err.cause = "node-pty failed to load (native binding missing)";
-      throw err;
-    }
-
     const cols = Number.isFinite(req.cols) ? req.cols : 80;
     const rows = Number.isFinite(req.rows) ? req.rows : 24;
     const cmd = resolveShellCmd(shell);
@@ -152,9 +153,7 @@ export class PtyManager extends EventEmitter {
       req.env && typeof req.env === "object" && !Array.isArray(req.env)
         ? req.env
         : {};
-    const spawnPty =
-      this._deps.spawnPty || executionBroker.spawnPty.bind(executionBroker);
-    const proc = spawnPty(pty, cmd, [], {
+    const brokerSpawnOptions = {
       name: "xterm-256color",
       cols,
       rows,
@@ -163,8 +162,39 @@ export class PtyManager extends EventEmitter {
       origin: "terminal:pty",
       policy: "allow",
       scope: "terminal",
+      shell: false,
       ...(sandboxPolicy ? { sandboxPolicy } : {}),
-    });
+    };
+    if (sandboxPolicy && this._deps.platform() === "linux") {
+      const contract = this._deps.issueLinuxWorkspaceSandboxExecutionContract(
+        cmd,
+        [],
+        brokerSpawnOptions,
+        this._policyCwd,
+        { pty: true },
+      );
+      if (!contract) {
+        const error = new Error("pty_sandbox_contract_unavailable");
+        error.code = "ERR_PTY_SANDBOX_CONTRACT_UNAVAILABLE";
+        error.sandboxFailClosed = true;
+        error.requiredBoundaries = [...sandboxPolicy.requiredBoundaries];
+        throw error;
+      }
+      brokerSpawnOptions.sandboxExecutionContract = contract;
+    }
+
+    let pty;
+    try {
+      pty = this._deps.loadNodePty();
+    } catch {
+      const err = new Error("pty_native_unavailable");
+      err.cause = "node-pty failed to load (native binding missing)";
+      throw err;
+    }
+
+    const spawnPty =
+      this._deps.spawnPty || executionBroker.spawnPty.bind(executionBroker);
+    const proc = spawnPty(pty, cmd, [], brokerSpawnOptions);
 
     const sessionId = randomUUID();
     const session = new PtySession({

package/src/gateways/ws/ws-agent-handler.js

@@ -27,6 +27,10 @@ import { runnableTaskModel } from "../../lib/runnable-provider.js";
 import { PlanState } from "../../lib/plan-mode.js";
 import { CLISlotFiller } from "../../lib/slot-filler.js";
 import { createAbortError, isAbortError } from "../../lib/abort-utils.js";
+import {
+  resolveRegisteredHostHooksV2Workspace,
+  runWithHostHooksV2Workspace,
+} from "../../lib/hooks-v2-workspace-context.js";
 import { createWsApprovalGate } from "./ws-approval-gate.js";
 
 export class WSAgentHandler {
@@ -166,7 +170,7 @@ export class WSAgentHandler {
       diffReviewFollowUps = new DiffReviewFollowUpTracker(sideEffectLedger);
       let currentSideEffectOpId = null;
 
-      const runAgentTurn = async () => {
+      const executeAgentTurn = async () => {
         for await (const event of agentLoop(session.messages, loopOptions)) {
           switch (event.type) {
             case "slot-filling":
@@ -250,6 +254,16 @@ export class WSAgentHandler {
           }
         }
       };
+      const hooksWorkspaceBinding = resolveRegisteredHostHooksV2Workspace(
+        session.hooksV2WorkspaceBindingId,
+      );
+      const runAgentTurn = () =>
+        hooksWorkspaceBinding
+          ? runWithHostHooksV2Workspace(
+              hooksWorkspaceBinding.workspaceRoot,
+              executeAgentTurn,
+            )
+          : executeAgentTurn();
 
       if (session.mcpClient?.withElicitationContext) {
         await session.mcpClient.withElicitationContext(

package/src/gateways/ws/ws-session-gateway.js

@@ -45,6 +45,52 @@ import {
   CODING_AGENT_MVP_TOOL_NAMES,
   listCodingAgentToolNames,
 } from "../../runtime/coding-agent-contract.js";
+import {
+  registerHostHooksV2Workspace,
+  releaseRegisteredHostHooksV2Workspace,
+} from "../../lib/hooks-v2-workspace-context.js";
+
+function normalizeHostWorkspaceRoot(workspaceRoot) {
+  if (
+    typeof workspaceRoot !== "string" ||
+    workspaceRoot.length === 0 ||
+    workspaceRoot.includes("\0")
+  ) {
+    return null;
+  }
+  try {
+    return path.resolve(workspaceRoot);
+  } catch {
+    return null;
+  }
+}
+
+function bindSessionHooksV2Workspace(
+  session,
+  workspaceRoot,
+  { releaseOnClose = false, protectedBindingId = null } = {},
+) {
+  const binding = workspaceRoot
+    ? registerHostHooksV2Workspace(workspaceRoot)
+    : null;
+  Object.defineProperty(session, "hooksV2WorkspaceBindingId", {
+    value: binding?.bindingId || null,
+    enumerable: false,
+    writable: false,
+    configurable: false,
+  });
+  Object.defineProperty(session, "_releaseHooksV2WorkspaceBindingOnClose", {
+    value: Boolean(
+      binding &&
+      releaseOnClose === true &&
+      binding.bindingId !== protectedBindingId,
+    ),
+    enumerable: false,
+    writable: false,
+    configurable: false,
+  });
+  return session.hooksV2WorkspaceBindingId;
+}
 
 /**
  * @typedef {object} Session
@@ -85,6 +131,15 @@ export class WSSessionManager {
     this.db = options.db || null;
     this.config = options.config || {};
     this.defaultProjectRoot = options.defaultProjectRoot || process.cwd();
+    // Snapshot constructor authority once. Later request fields (and even a
+    // mutable compatibility assignment to defaultProjectRoot) cannot replace
+    // the root used for strong Hooks v2 execution.
+    this._hooksV2HostWorkspaceRoot = normalizeHostWorkspaceRoot(
+      this.defaultProjectRoot,
+    );
+    this._hooksV2HostWorkspaceBindingId = this._hooksV2HostWorkspaceRoot
+      ? registerHostHooksV2Workspace(this._hooksV2HostWorkspaceRoot).bindingId
+      : null;
     this.mcpClient = options.mcpClient || null;
     this.allowedMcpServerNames = Array.isArray(options.allowedMcpServerNames)
       ? options.allowedMcpServerNames
@@ -324,6 +379,11 @@ export class WSSessionManager {
     const sessionId = this._generateId();
     const type = options.type || "agent";
     const baseProjectRoot = options.projectRoot || this.defaultProjectRoot;
+    const hostAuthorizedBaseRoot =
+      normalizeHostWorkspaceRoot(baseProjectRoot) ===
+      this._hooksV2HostWorkspaceRoot
+        ? this._hooksV2HostWorkspaceRoot
+        : null;
     const cfgLlm = this.config?.llm || {};
     const provider = options.provider || cfgLlm.provider || "ollama";
     const model =
@@ -435,6 +495,18 @@ export class WSSessionManager {
       createdAt: new Date().toISOString(),
       lastActivity: new Date().toISOString(),
     };
+    bindSessionHooksV2Workspace(
+      session,
+      hostAuthorizedBaseRoot
+        ? worktree
+          ? normalizeHostWorkspaceRoot(projectRoot)
+          : hostAuthorizedBaseRoot
+        : null,
+      {
+        releaseOnClose: Boolean(hostAuthorizedBaseRoot && worktree),
+        protectedBindingId: this._hooksV2HostWorkspaceBindingId,
+      },
+    );
 
     if (this.db) {
       try {
@@ -546,6 +618,15 @@ export class WSSessionManager {
         createdAt: dbSession.created_at,
         lastActivity: new Date().toISOString(),
       };
+      const recoveredHooksWorkspaceRoot =
+        metadata.worktreeIsolation !== true &&
+        normalizeHostWorkspaceRoot(baseProjectRoot) ===
+          this._hooksV2HostWorkspaceRoot &&
+        normalizeHostWorkspaceRoot(workspace.projectRoot) ===
+          this._hooksV2HostWorkspaceRoot
+          ? this._hooksV2HostWorkspaceRoot
+          : null;
+      bindSessionHooksV2Workspace(session, recoveredHooksWorkspaceRoot);
 
       this._bindPlanManagerPersistence(session);
       this.sessions.set(session.id, session);
@@ -564,6 +645,13 @@ export class WSSessionManager {
     const session = this.sessions.get(sessionId);
     if (!session) return;
 
+    if (
+      session._releaseHooksV2WorkspaceBindingOnClose === true &&
+      session.hooksV2WorkspaceBindingId
+    ) {
+      releaseRegisteredHostHooksV2Workspace(session.hooksV2WorkspaceBindingId);
+    }
+
     session.status = "closed";
 
     // Persist messages to DB

package/src/harness/background-task-command-runner.js

@@ -0,0 +1,234 @@
+import fs from "node:fs";
+import path from "node:path";
+import executionBroker from "../lib/process-execution-broker/index.js";
+
+const SUPPORTED_BOUNDARIES = new Set(["filesystem", "network"]);
+
+export const _backgroundTaskCommandDeps = {
+  execSync: (...args) => executionBroker.execSync(...args),
+  execFile: (...args) => executionBroker.execFile(...args),
+  issueLinuxWorkspaceSandboxExecutionContract: (...args) =>
+    executionBroker.issueLinuxWorkspaceSandboxExecutionContract(...args),
+  platform: process.platform,
+};
+
+function sandboxError(code, reason, message, requiredBoundaries = []) {
+  const error = new Error(message);
+  error.code = code;
+  error.sandboxReason = reason;
+  error.sandboxFailClosed = true;
+  error.requiredBoundaries = [...requiredBoundaries];
+  error.actualGuarantees = [];
+  error.missingBoundaries = [...requiredBoundaries];
+  error.sandboxBackend = null;
+  error.sandboxCandidateBackend =
+    _backgroundTaskCommandDeps.platform === "linux"
+      ? "linux-bwrap-workspace"
+      : null;
+  return error;
+}
+
+function normalizeRequiredBoundaries(raw) {
+  if (raw === undefined || raw === null || raw === "") return [];
+  let parsed;
+  try {
+    parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
+  } catch (cause) {
+    const error = sandboxError(
+      "ERR_BACKGROUND_TASK_SANDBOX_ENVELOPE_INVALID",
+      "background_sandbox_envelope_invalid",
+      "Background task sandbox boundary envelope is invalid.",
+    );
+    error.cause = cause;
+    throw error;
+  }
+  if (!Array.isArray(parsed)) {
+    throw sandboxError(
+      "ERR_BACKGROUND_TASK_SANDBOX_ENVELOPE_INVALID",
+      "background_sandbox_envelope_invalid",
+      "Background task sandbox boundaries must use filesystem/network.",
+    );
+  }
+  if (parsed.length === 0) return [];
+  if (
+    parsed.some(
+      (boundary) =>
+        typeof boundary !== "string" || !SUPPORTED_BOUNDARIES.has(boundary),
+    )
+  ) {
+    throw sandboxError(
+      "ERR_BACKGROUND_TASK_SANDBOX_ENVELOPE_INVALID",
+      "background_sandbox_envelope_invalid",
+      "Background task sandbox boundaries must use filesystem/network.",
+    );
+  }
+  return [...new Set(parsed)].sort();
+}
+
+function canonicalBinding(workspaceCwd, executionCwd, boundaries) {
+  try {
+    if (
+      typeof workspaceCwd !== "string" ||
+      !path.isAbsolute(workspaceCwd) ||
+      typeof executionCwd !== "string" ||
+      !path.isAbsolute(executionCwd)
+    ) {
+      throw new Error("sandbox paths must be absolute");
+    }
+    const canonicalRoot = fs.realpathSync.native(workspaceCwd);
+    const canonicalCwd = fs.realpathSync.native(executionCwd);
+    if (
+      canonicalRoot !== workspaceCwd ||
+      canonicalCwd !== executionCwd ||
+      !fs.statSync(canonicalRoot).isDirectory() ||
+      !fs.statSync(canonicalCwd).isDirectory()
+    ) {
+      throw new Error("sandbox paths must be canonical directories");
+    }
+    const relative = path.relative(canonicalRoot, canonicalCwd);
+    if (
+      relative === ".." ||
+      relative.startsWith(`..${path.sep}`) ||
+      path.isAbsolute(relative)
+    ) {
+      throw new Error("execution cwd escapes workspace");
+    }
+    return { workspaceRoot: canonicalRoot, workingDirectory: canonicalCwd };
+  } catch (cause) {
+    const error = sandboxError(
+      "ERR_BACKGROUND_TASK_SANDBOX_BINDING_INVALID",
+      "background_sandbox_binding_invalid",
+      "Background task sandbox workspace/cwd binding is invalid.",
+      boundaries,
+    );
+    error.cause = cause;
+    throw error;
+  }
+}
+
+function explicitShellInvocation(command) {
+  if (_backgroundTaskCommandDeps.platform === "win32") {
+    return {
+      file: process.env.ComSpec || "cmd.exe",
+      args: ["/d", "/s", "/c", command],
+    };
+  }
+  return { file: "/bin/sh", args: ["-c", command] };
+}
+
+export function executeBackgroundTaskCommand({
+  command,
+  cwd,
+  type,
+  workspaceCwd = "",
+  requiredBoundaries = [],
+}) {
+  if (
+    typeof command !== "string" ||
+    command.length === 0 ||
+    command.includes("\0")
+  ) {
+    throw new TypeError("background task command must be non-empty");
+  }
+  const boundaries = normalizeRequiredBoundaries(requiredBoundaries);
+  const hasSandboxEnvelope =
+    typeof workspaceCwd === "string" && workspaceCwd.length > 0;
+  if (hasSandboxEnvelope !== boundaries.length > 0) {
+    throw sandboxError(
+      "ERR_BACKGROUND_TASK_SANDBOX_ENVELOPE_INVALID",
+      "background_sandbox_envelope_invalid",
+      "Background task sandbox root and boundaries must be supplied together.",
+      boundaries,
+    );
+  }
+  if (
+    boundaries.length > 0 &&
+    _backgroundTaskCommandDeps.platform !== "linux"
+  ) {
+    throw sandboxError(
+      "ERR_PROCESS_SANDBOX_BOUNDARY_UNSATISFIED",
+      "background_platform_backend_unavailable",
+      "Background task strong sandbox execution is only available on Linux.",
+      boundaries,
+    );
+  }
+
+  const commonOptions = {
+    cwd: cwd || process.cwd(),
+    encoding: "utf-8",
+    timeout: 300000,
+    maxBuffer: 10 * 1024 * 1024,
+    origin: `background-task:command:${type || "unknown"}`,
+    policy: "allow",
+    scope: "background-task",
+  };
+  if (boundaries.length === 0) {
+    return _backgroundTaskCommandDeps.execSync(command, {
+      ...commonOptions,
+      shell: true,
+    });
+  }
+
+  const binding = canonicalBinding(workspaceCwd, commonOptions.cwd, boundaries);
+  const sandboxPolicy = Object.freeze({
+    requiredBoundaries: Object.freeze(boundaries),
+  });
+  const invocation = explicitShellInvocation(command);
+  const spawnOptions = {
+    ...commonOptions,
+    cwd: binding.workingDirectory,
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: false,
+    sandboxPolicy,
+  };
+  let sandboxExecutionContract;
+  try {
+    sandboxExecutionContract =
+      _backgroundTaskCommandDeps.issueLinuxWorkspaceSandboxExecutionContract(
+        invocation.file,
+        invocation.args,
+        spawnOptions,
+        binding.workspaceRoot,
+        { sync: false },
+      );
+  } catch (cause) {
+    const error = sandboxError(
+      "ERR_PROCESS_SANDBOX_BOUNDARY_UNSATISFIED",
+      "background_linux_execution_contract_unavailable",
+      "Background task could not bind its Linux sandbox contract.",
+      boundaries,
+    );
+    error.cause = cause;
+    throw error;
+  }
+  if (
+    _backgroundTaskCommandDeps.platform === "linux" &&
+    !sandboxExecutionContract
+  ) {
+    throw sandboxError(
+      "ERR_PROCESS_SANDBOX_BOUNDARY_UNSATISFIED",
+      "background_linux_execution_contract_unavailable",
+      "Background task could not bind its Linux sandbox contract.",
+      boundaries,
+    );
+  }
+  return new Promise((resolve, reject) => {
+    const options = {
+      ...spawnOptions,
+      ...(sandboxExecutionContract ? { sandboxExecutionContract } : {}),
+    };
+    try {
+      _backgroundTaskCommandDeps.execFile(
+        invocation.file,
+        invocation.args,
+        options,
+        (error, stdout) => {
+          if (error) reject(error);
+          else resolve(stdout);
+        },
+      );
+    } catch (error) {
+      reject(error);
+    }
+  });
+}