chainlesschain 0.162.183 → 0.162.185

package/src/lib/hooks-v2-workspace-context.js

@@ -0,0 +1,258 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+const trustedWorkspaceStorage = new AsyncLocalStorage();
+const registeredHostWorkspaces = new Map();
+const registeredHostWorkspaceIdentities = new Map();
+const MAX_REGISTERED_HOST_WORKSPACES = 1024;
+
+function validateHostWorkspaceRoot(workspaceRoot) {
+  if (
+    typeof workspaceRoot !== "string" ||
+    workspaceRoot.length === 0 ||
+    workspaceRoot.includes("\0")
+  ) {
+    const error = new TypeError(
+      "Hooks v2 host workspace root must be a non-empty path",
+    );
+    error.code = "CC_HOOK_TRUSTED_WORKSPACE_INVALID";
+    throw error;
+  }
+  return path.resolve(workspaceRoot);
+}
+
+function invalidWorkspaceRoot(message, cause) {
+  const error = new Error(message, cause ? { cause } : undefined);
+  error.code = "CC_HOOK_TRUSTED_WORKSPACE_INVALID";
+  return error;
+}
+
+function workspaceGeneration(stats) {
+  // dev+ino alone is insufficient: filesystems may immediately reuse an inode
+  // after a same-path directory replacement. Prefer the stable creation
+  // timestamp and fail closed on metadata changes when a filesystem does not
+  // expose one.
+  return stats.birthtimeNs > 0n
+    ? `birth:${stats.birthtimeNs.toString()}`
+    : `ctime:${stats.ctimeNs.toString()}`;
+}
+
+function captureWorkspaceIdentity(workspaceRoot) {
+  const resolvedRoot = validateHostWorkspaceRoot(workspaceRoot);
+  let canonicalRoot;
+  let stats;
+  try {
+    canonicalRoot = fs.realpathSync.native(resolvedRoot);
+    stats = fs.statSync(canonicalRoot, { bigint: true });
+  } catch (error) {
+    throw invalidWorkspaceRoot(
+      "Hooks v2 host workspace root must resolve to an existing directory",
+      error,
+    );
+  }
+  if (!stats.isDirectory()) {
+    throw invalidWorkspaceRoot(
+      "Hooks v2 host workspace root must resolve to a directory",
+    );
+  }
+  return Object.freeze({
+    canonicalRoot,
+    device: stats.dev,
+    inode: stats.ino,
+    generation: workspaceGeneration(stats),
+  });
+}
+
+function workspaceIdentityKey(identity) {
+  return JSON.stringify([
+    identity.canonicalRoot,
+    identity.device.toString(),
+    identity.inode.toString(),
+    identity.generation,
+  ]);
+}
+
+function sameWorkspaceIdentity(left, right) {
+  return (
+    left.canonicalRoot === right.canonicalRoot &&
+    left.device === right.device &&
+    left.inode === right.inode &&
+    left.generation === right.generation
+  );
+}
+
+function invalidateWorkspaceRecord(record) {
+  if (registeredHostWorkspaces.get(record.binding.bindingId) === record) {
+    registeredHostWorkspaces.delete(record.binding.bindingId);
+  }
+  if (
+    registeredHostWorkspaceIdentities.get(record.identityKey) ===
+    record.binding.bindingId
+  ) {
+    registeredHostWorkspaceIdentities.delete(record.identityKey);
+  }
+}
+
+function verifyWorkspaceRecord(record) {
+  if (!record) return null;
+  if (registeredHostWorkspaces.get(record.binding.bindingId) !== record) {
+    return null;
+  }
+  let currentIdentity;
+  try {
+    currentIdentity = captureWorkspaceIdentity(record.binding.workspaceRoot);
+  } catch {
+    invalidateWorkspaceRecord(record);
+    return null;
+  }
+  if (!sameWorkspaceIdentity(record.identity, currentIdentity)) {
+    invalidateWorkspaceRecord(record);
+    return null;
+  }
+  return record.binding;
+}
+
+function pruneInvalidWorkspaceRecords() {
+  for (const record of Array.from(registeredHostWorkspaces.values())) {
+    verifyWorkspaceRecord(record);
+  }
+}
+
+function workspaceBindingId(identity) {
+  return createHash("sha256")
+    .update("chainlesschain.hooks-v2-host-workspace.v3\0")
+    .update(workspaceIdentityKey(identity), "utf8")
+    .digest("hex");
+}
+
+/**
+ * Register a root selected by trusted host bootstrap code. Durable records
+ * persist only the returned opaque stable digest; the plaintext canonical path
+ * and directory identity remain process-local.
+ */
+export function registerHostHooksV2Workspace(workspaceRoot) {
+  const identity = captureWorkspaceIdentity(workspaceRoot);
+  const identityKey = workspaceIdentityKey(identity);
+  const existingBindingId = registeredHostWorkspaceIdentities.get(identityKey);
+  if (existingBindingId) {
+    const existingRecord = registeredHostWorkspaces.get(existingBindingId);
+    const existingBinding = verifyWorkspaceRecord(existingRecord);
+    if (
+      existingBinding &&
+      sameWorkspaceIdentity(existingRecord.identity, identity)
+    ) {
+      return existingBinding;
+    }
+  }
+
+  // A long-running host may create and remove many isolated worktrees. Sweep
+  // stale filesystem identities before enforcing the bounded registry so
+  // deleted roots cannot exhaust future trusted registrations.
+  if (registeredHostWorkspaces.size >= MAX_REGISTERED_HOST_WORKSPACES) {
+    pruneInvalidWorkspaceRecords();
+  }
+  if (registeredHostWorkspaces.size >= MAX_REGISTERED_HOST_WORKSPACES) {
+    const error = new Error(
+      "Hooks v2 host workspace registry capacity exceeded",
+    );
+    error.code = "CC_HOOK_TRUSTED_WORKSPACE_LIMIT";
+    throw error;
+  }
+
+  const bindingId = workspaceBindingId(identity);
+  const collidingRecord = registeredHostWorkspaces.get(bindingId);
+  if (collidingRecord) {
+    const collidingBinding = verifyWorkspaceRecord(collidingRecord);
+    if (
+      collidingBinding &&
+      sameWorkspaceIdentity(collidingRecord.identity, identity)
+    ) {
+      registeredHostWorkspaceIdentities.set(identityKey, bindingId);
+      return collidingBinding;
+    }
+    if (
+      collidingBinding &&
+      collidingRecord.identity.canonicalRoot !== identity.canonicalRoot
+    ) {
+      const error = new Error("Hooks v2 workspace binding digest collision");
+      error.code = "CC_HOOK_TRUSTED_WORKSPACE_COLLISION";
+      throw error;
+    }
+    if (collidingBinding) {
+      throw invalidWorkspaceRoot(
+        "Hooks v2 host workspace identity changed during registration",
+      );
+    }
+  }
+
+  const binding = Object.freeze({
+    bindingId,
+    workspaceRoot: identity.canonicalRoot,
+  });
+  const record = Object.freeze({
+    binding,
+    identity,
+    identityKey,
+  });
+  registeredHostWorkspaces.set(bindingId, record);
+  registeredHostWorkspaceIdentities.set(identityKey, bindingId);
+  return binding;
+}
+
+/**
+ * Run a CLI-host operation with an immutable Hooks v2 workspace authority.
+ *
+ * Only host bootstrap code may call this with a root selected before hook,
+ * plugin, model, or event payload processing. The binding is async-scoped
+ * instead of global so concurrent CLI runs cannot replace one another's
+ * writable root.
+ */
+export function runWithHostHooksV2Workspace(workspaceRoot, callback) {
+  if (typeof callback !== "function") {
+    throw new TypeError("Hooks v2 workspace callback must be a function");
+  }
+  const binding = registerHostHooksV2Workspace(workspaceRoot);
+  return trustedWorkspaceStorage.run(
+    registeredHostWorkspaces.get(binding.bindingId),
+    callback,
+  );
+}
+
+/**
+ * Internal consumer seam for HooksV2Runtime. Event and hook payloads never
+ * participate in selecting this value.
+ */
+export function currentHostHooksV2WorkspaceRoot() {
+  return currentHostHooksV2WorkspaceBinding()?.workspaceRoot || null;
+}
+
+export function currentHostHooksV2WorkspaceBinding() {
+  return verifyWorkspaceRecord(trustedWorkspaceStorage.getStore());
+}
+
+/**
+ * Resolve an opaque durable binding only against roots registered by the
+ * current host process. No persisted or event-supplied path is accepted.
+ */
+export function resolveRegisteredHostHooksV2Workspace(bindingId) {
+  if (typeof bindingId !== "string" || !/^[a-f0-9]{64}$/.test(bindingId)) {
+    return null;
+  }
+  return verifyWorkspaceRecord(registeredHostWorkspaces.get(bindingId));
+}
+
+/**
+ * Revoke a process-local binding owned by trusted host lifecycle code.
+ * Payloads, hooks, and durable records must never call this release seam.
+ */
+export function releaseRegisteredHostHooksV2Workspace(bindingId) {
+  if (typeof bindingId !== "string" || !/^[a-f0-9]{64}$/.test(bindingId)) {
+    return false;
+  }
+  const record = registeredHostWorkspaces.get(bindingId);
+  if (!record) return false;
+  invalidateWorkspaceRecord(record);
+  return true;
+}

package/src/lib/jsonl-session-store.js

@@ -16,6 +16,8 @@ export {
   appendAssistantMessage,
   appendToolCall,
   appendToolCallCompact,
+  appendLlmRetryCompact,
+  MAX_COMPACT_DURATION_MS,
   appendToolResult,
   appendCompactEvent,
   readEvents,

package/src/lib/lsp/__tests__/lsp-client.test.js

@@ -100,6 +100,10 @@ describe("LSPClient handshake", () => {
 
   it("passes plugin sandbox requirements to ProcessExecutionBroker", async () => {
     const child = new FakeChild();
+    const contract = Object.freeze({ kind: "test-workspace-contract" });
+    const issueAuthority = vi
+      .spyOn(executionBroker, "issueLinuxWorkspaceSandboxExecutionContract")
+      .mockReturnValue(contract);
     const brokerSpawn = vi
       .spyOn(executionBroker, "spawn")
       .mockReturnValue(child);
@@ -123,8 +127,19 @@ describe("LSPClient handshake", () => {
         sandboxPolicy: {
           requiredBoundaries: ["filesystem", "network"],
         },
+        sandboxExecutionContract: contract,
       }),
     );
+    expect(issueAuthority).toHaveBeenCalledWith(
+      "fake-lsp",
+      ["--stdio"],
+      expect.objectContaining({
+        cwd: "/proj",
+        shell: false,
+        origin: "plugin:lsp",
+      }),
+      "/proj",
+    );
     expect(_deps.spawn).not.toHaveBeenCalled();
   });
 

package/src/lib/lsp/lsp-client.js

@@ -83,7 +83,7 @@ export class LSPClient extends EventEmitter {
     const spawnFn = String(this.origin || "").startsWith("plugin:")
       ? executionBroker.spawn.bind(executionBroker)
       : _deps.spawn;
-    this._child = spawnFn(spawnSpec.file, spawnSpec.args, {
+    const spawnOptions = {
       cwd: this.rootPath,
       env: { ...process.env, ...this.env },
       stdio: ["pipe", "pipe", "pipe"],
@@ -103,6 +103,17 @@ export class LSPClient extends EventEmitter {
               : {}),
           }
         : {}),
+    };
+    const sandboxExecutionContract =
+      executionBroker.issueLinuxWorkspaceSandboxExecutionContract(
+        spawnSpec.file,
+        spawnSpec.args,
+        spawnOptions,
+        this.rootPath,
+      );
+    this._child = spawnFn(spawnSpec.file, spawnSpec.args, {
+      ...spawnOptions,
+      ...(sandboxExecutionContract ? { sandboxExecutionContract } : {}),
     });
 
     this._child.on("error", (err) => {

package/src/lib/plugin-monitor-supervisor.js

@@ -25,6 +25,7 @@ import { executionBroker } from "./process-execution-broker/index.js";
 import { EventRuntimeProducer } from "./event-runtime-producer.js";
 import { EventRuntimeStore } from "./event-runtime-store.js";
 import { monitorEventId } from "./monitor-event.js";
+import { resolvePluginWorkspaceAuthority } from "./plugin-runtime/sandbox-policy.js";
 
 export const _deps = {
   spawn: (...args) => executionBroker.spawn(...args),
@@ -44,7 +45,9 @@ export class PluginMonitorSupervisor {
     this._pluginSpawn = opts.brokerSpawn || this._spawn;
     const eventRuntimeStore =
       opts.eventRuntimeStore ||
-      (process.env.CC_EVENT_RUNTIME_DURABLE === "1" ? new EventRuntimeStore() : null);
+      (process.env.CC_EVENT_RUNTIME_DURABLE === "1"
+        ? new EventRuntimeStore()
+        : null);
     this._runtimeProducer = eventRuntimeStore
       ? new EventRuntimeProducer({ store: eventRuntimeStore, emitter: this })
       : null;
@@ -118,7 +121,11 @@ export class PluginMonitorSupervisor {
           { origin: "monitor", id: monitorEventId(desc.id, { stream, line }) },
         );
       } catch (error) {
-        this._outputs.push({ ...output, stream: "error", line: `durable publish failed: ${error.message}` });
+        this._outputs.push({
+          ...output,
+          stream: "error",
+          line: `durable publish failed: ${error.message}`,
+        });
       }
       if (this._outputs.length > OUTPUT_RING) this._outputs.shift();
     }
@@ -211,24 +218,54 @@ export class PluginMonitorSupervisor {
 
   _spawnForDescriptor(desc, options) {
     const isPlugin = desc?.origin === "plugin:monitor";
+    const pluginWorkspaceRoot = isPlugin
+      ? resolvePluginWorkspaceAuthority(desc.pluginWorkspaceAuthority, {
+          origin: desc.origin,
+          pluginId: desc.pluginId,
+          pluginVersion: desc.pluginVersion,
+          pluginSource: desc.pluginSource,
+        })
+      : null;
+    if (
+      isPlugin &&
+      desc.sandboxPolicy?.requiredBoundaries?.length > 0 &&
+      !pluginWorkspaceRoot
+    ) {
+      throw new Error(
+        `plugin monitor "${desc.id || desc.name || "unknown"}" is missing its trusted workspace authority`,
+      );
+    }
+    const spawnOptions = {
+      ...options,
+      origin: isPlugin ? desc.origin : "plugin-monitor:process",
+      policy: "allow",
+      scope: "plugin-monitor",
+      ...(isPlugin
+        ? {
+            pluginId: desc.pluginId,
+            pluginVersion: desc.pluginVersion,
+            pluginSource: desc.pluginSource,
+            ...(desc.sandboxPolicy
+              ? { sandboxPolicy: desc.sandboxPolicy }
+              : {}),
+          }
+        : {}),
+    };
+    const sandboxExecutionContract =
+      isPlugin && pluginWorkspaceRoot
+        ? executionBroker.issueLinuxWorkspaceSandboxExecutionContract(
+            desc.command,
+            desc.args,
+            spawnOptions,
+            pluginWorkspaceRoot,
+          )
+        : null;
     return (isPlugin ? this._pluginSpawn : this._spawn)(
       desc.command,
       desc.args,
       {
-        ...options,
-        origin: isPlugin ? desc.origin : "plugin-monitor:process",
-        policy: "allow",
-        scope: "plugin-monitor",
-        ...(isPlugin
-          ? {
-              pluginId: desc.pluginId,
-              pluginVersion: desc.pluginVersion,
-              pluginSource: desc.pluginSource,
-              ...(desc.sandboxPolicy
-                ? { sandboxPolicy: desc.sandboxPolicy }
-                : {}),
-            }
-          : {}),
+        ...spawnOptions,
+        ...(sandboxExecutionContract ? { sandboxExecutionContract } : {}),
       },
     );
   }

package/src/lib/plugin-runtime/bin.js

@@ -990,7 +990,20 @@ export function reattestPluginBinInvocation(invocation) {
  * policy-bearing Plugin Node or native invocation. Object identity is the
  * capability: callers cannot mint a usable contract by copying public fields.
  */
-export function createPluginSandboxExecutionContract(invocation) {
+export function createPluginSandboxExecutionContract(invocation, options = {}) {
+  if (
+    options === null ||
+    typeof options !== "object" ||
+    Array.isArray(options) ||
+    Object.keys(options).some((key) => key !== "sync") ||
+    (options.sync !== undefined && typeof options.sync !== "boolean")
+  ) {
+    throw pluginBinError(
+      "ERR_PLUGIN_SANDBOX_CONTRACT_OPTIONS_INVALID",
+      "plugin sandbox execution contract options must contain an optional boolean sync field",
+    );
+  }
+  const sync = options.sync !== false;
   const issuedResolution =
     invocation && typeof invocation === "object"
       ? _issuedPluginBinInvocations.get(invocation)
@@ -1118,7 +1131,7 @@ export function createPluginSandboxExecutionContract(invocation) {
       contractVersion: 1,
       kind:
         runtime === "native"
-          ? "strict-plugin-native-static-elf-bin"
+          ? "strict-plugin-native-elf-bin"
           : "strict-plugin-node-bin",
       pluginRoot,
       workingDirectory: pluginRoot,
@@ -1140,7 +1153,7 @@ export function createPluginSandboxExecutionContract(invocation) {
         pluginSource: invocation.pluginSource,
         pluginExecutableIdentity: invocation.executableIdentity,
         requiredBoundaries: invocation.sandboxPolicy.requiredBoundaries,
-        sync: true,
+        sync,
       }),
     );
     return contract;
@@ -1156,14 +1169,17 @@ export function createPluginSandboxExecutionContract(invocation) {
 /**
  * Backward-compatible Node-only issuer retained for existing callers.
  */
-export function createPluginNodeSandboxExecutionContract(invocation) {
+export function createPluginNodeSandboxExecutionContract(
+  invocation,
+  options = {},
+) {
   if (invocation?.runtime !== "node") {
     throw pluginBinError(
       "ERR_PLUGIN_NODE_SANDBOX_CONTRACT_UNSUPPORTED",
       "plugin Node sandbox execution contract requires one direct policy-bearing Node bin",
     );
   }
-  return createPluginSandboxExecutionContract(invocation);
+  return createPluginSandboxExecutionContract(invocation, options);
 }
 
 /**