chainlesschain 0.162.183 → 0.162.185

package/src/lib/plugin-runtime/install.js

@@ -50,6 +50,7 @@ export const _deps = {
   existsSync: fs.existsSync,
   mkdirSync: fs.mkdirSync,
   rmSync: fs.rmSync,
+  renameSync: fs.renameSync,
   readdirSync: fs.readdirSync,
   readFileSync: fs.readFileSync,
   copyFileSync: fs.copyFileSync,
@@ -59,6 +60,8 @@ export const _deps = {
   spawnSync: (...args) => executionBroker.spawnSync(...args),
 };
 
+const pendingPluginTransactions = new WeakMap();
+
 /**
  * Install a plugin from a local directory into a scope's immutable version dir.
  * @param {string} srcDir  directory containing the plugin (with its manifest)
@@ -111,66 +114,116 @@ export function installFromDirectory(srcDir, opts = {}) {
   }
 
   const dest = pluginVersionDir(scope, name, version, { cwd: opts.cwd });
-  if (_deps.existsSync(dest)) {
-    if (!opts.force) {
-      throw new Error(
-        `${name}@${version} is already installed at ${scope} scope (immutable). ` +
-          `Use --force to reinstall, or bump the version.`,
-      );
-    }
-    _deps.rmSync(dest, { recursive: true, force: true });
+  const destExists = _deps.existsSync(dest);
+  if (destExists && !opts.force) {
+    throw new Error(
+      `${name}@${version} is already installed at ${scope} scope (immutable). ` +
+        `Use --force to reinstall, or bump the version.`,
+    );
   }
 
-  _deps.mkdirSync(dest, { recursive: true });
-  copyDirGuarded(src, dest, dest);
+  const nameDir = pluginNameDir(scope, name, { cwd: opts.cwd });
+  _deps.mkdirSync(nameDir, { recursive: true });
+  const transactionRoot = _deps.mkdtempSync(path.join(nameDir, ".install-"));
+  const staged = path.join(transactionRoot, "staged");
+  const backup = destExists ? path.join(transactionRoot, "previous") : null;
+  const previousActive = getActiveVersion(name, { scope, cwd: opts.cwd });
+  let installedAtDest = false;
+  let transactionRetained = false;
 
-  // A lock may ONLY exist if THIS installer wrote it. The source is untrusted
-  // and may ship its own `.plugin-lock.json` (copied verbatim above) — on an
-  // unsigned install that forged lock would otherwise survive into the
-  // "immutable" version dir and defeat load-time requireSignedPlugins.
-  _deps.rmSync(path.join(dest, LOCK_FILENAME), { force: true });
-  _deps.rmSync(path.join(dest, SOURCE_METADATA_FILENAME), { force: true });
+  try {
+    _deps.mkdirSync(staged, { recursive: true });
+    copyDirGuarded(src, staged, staged);
+
+    // A lock may ONLY exist if THIS installer wrote it. The source is untrusted
+    // and may ship its own `.plugin-lock.json` or provenance metadata.
+    _deps.rmSync(path.join(staged, LOCK_FILENAME), { force: true });
+    _deps.rmSync(path.join(staged, SOURCE_METADATA_FILENAME), { force: true });
+
+    if (sourceMetadata) {
+      _deps.writeFileSync(
+        path.join(staged, SOURCE_METADATA_FILENAME),
+        JSON.stringify(sourceMetadata, null, 2),
+        "utf8",
+      );
+    }
 
-  if (sourceMetadata) {
-    _deps.writeFileSync(
-      path.join(dest, SOURCE_METADATA_FILENAME),
-      JSON.stringify(sourceMetadata, null, 2),
-      "utf8",
-    );
-  }
+    // Record the verified signature into the staged immutable version. The
+    // manifest and complete component SBOM are re-verified below before any
+    // active bytes or pointer can change.
+    if (verification) {
+      const stagedManifest = path.join(
+        staged,
+        path.relative(src, manifest.manifestPath),
+      );
+      writePluginLock(staged, {
+        manifestFile: stagedManifest,
+        sha256: verification.sha256,
+        publicKeySha256: verification.publicKeySha256,
+        signatureVerified: verification.signatureVerified === true,
+        signatureBase64: verification.signatureBase64,
+        publicKeyPem: verification.publicKeyPem,
+        sbom: buildPluginSbom(staged),
+      });
+    }
+    validateStagedInstall(staged, { name, version, verification });
 
-  // Record the verified signature into the installed (immutable) version dir so
-  // load-time enforcement can re-check it. The manifest was copied verbatim, so
-  // its bytes/sha in `dest` match what we verified in `src`.
-  if (verification) {
-    const destManifest = path.join(
-      dest,
-      path.relative(src, manifest.manifestPath),
-    );
-    writePluginLock(dest, {
-      manifestFile: destManifest,
-      sha256: verification.sha256,
-      publicKeySha256: verification.publicKeySha256,
-      signatureVerified: verification.signatureVerified === true,
-      signatureBase64: verification.signatureBase64,
-      publicKeyPem: verification.publicKeyPem,
-      sbom: buildPluginSbom(dest),
-    });
-  }
+    // Commit the fully validated directory with same-volume renames. A forced
+    // same-version reinstall retains the old bytes until the caller finalizes
+    // the upgrade transaction.
+    if (backup) _deps.renameSync(dest, backup);
+    try {
+      _deps.renameSync(staged, dest);
+      installedAtDest = true;
+    } catch (error) {
+      if (backup && _deps.existsSync(backup) && !_deps.existsSync(dest)) {
+        _deps.renameSync(backup, dest);
+      }
+      throw error;
+    }
 
-  // Make the freshly-installed version active.
-  setActiveVersion(name, version, { scope, cwd: opts.cwd });
+    try {
+      setActiveVersion(name, version, { scope, cwd: opts.cwd });
+    } catch (error) {
+      restoreInstalledBytes({ dest, backup });
+      restoreActivePointer(name, previousActive, { scope, cwd: opts.cwd });
+      installedAtDest = false;
+      throw error;
+    }
 
-  return {
-    name,
-    version,
-    scope,
-    dir: dest,
-    warnings: manifest.warnings,
-    signatureVerified: verification?.signatureVerified === true,
-    sourceMetadata,
-    enabled: isPluginEnabled(name, { scope, cwd: opts.cwd }),
-  };
+    const result = {
+      name,
+      version,
+      scope,
+      dir: dest,
+      warnings: manifest.warnings,
+      signatureVerified: verification?.signatureVerified === true,
+      sourceMetadata,
+      enabled: isPluginEnabled(name, { scope, cwd: opts.cwd }),
+      loadValidated: true,
+    };
+    if (opts.transactional === true) {
+      pendingPluginTransactions.set(result, {
+        name,
+        version,
+        scope,
+        cwd: opts.cwd,
+        dest,
+        backup,
+        transactionRoot,
+        previousActive,
+      });
+      transactionRetained = true;
+    }
+    return result;
+  } finally {
+    if (!transactionRetained) {
+      if (installedAtDest && backup && _deps.existsSync(backup)) {
+        _deps.rmSync(backup, { recursive: true, force: true });
+      }
+      _deps.rmSync(transactionRoot, { recursive: true, force: true });
+    }
+  }
 }
 
 /**
@@ -264,7 +317,7 @@ export function updatePlugin(source, opts = {}) {
       if (previousVersion !== version) {
         setActiveVersion(name, version, { scope, cwd: opts.cwd });
       }
-      return {
+      const result = {
         name,
         version,
         previousVersion,
@@ -273,6 +326,20 @@ export function updatePlugin(source, opts = {}) {
         source: sourceMetadata?.source || null,
         ref: sourceMetadata?.ref || null,
       };
+      if (opts.transactional === true && previousVersion !== version) {
+        pendingPluginTransactions.set(result, {
+          name,
+          version,
+          scope,
+          cwd: opts.cwd,
+          dest,
+          backup: null,
+          transactionRoot: null,
+          previousActive: previousVersion,
+          pointerOnly: true,
+        });
+      }
+      return result;
     }
 
     const res = installFromDirectory(dir, {
@@ -280,8 +347,9 @@ export function updatePlugin(source, opts = {}) {
       scope,
       force: true,
       sourceMetadata,
+      transactional: opts.transactional === true,
     });
-    return {
+    const result = {
       ...res,
       previousVersion,
       updated: previousVersion !== version,
@@ -289,9 +357,65 @@ export function updatePlugin(source, opts = {}) {
       source: sourceMetadata?.source || null,
       ref: sourceMetadata?.ref || null,
     };
+    transferPendingTransaction(res, result);
+    return result;
   });
 }
 
+/**
+ * Commit a transactional update after capability consent and command-layer
+ * validation have succeeded. Backup cleanup is best-effort: an active,
+ * validated install must not be reported as failed solely because antivirus or
+ * another reader briefly holds the hidden rollback directory open.
+ */
+export function finalizePluginUpdate(result) {
+  const transaction = pendingPluginTransactions.get(result);
+  if (!transaction) return { finalized: false };
+  pendingPluginTransactions.delete(result);
+  let cleanupPending = false;
+  if (transaction.transactionRoot) {
+    try {
+      _deps.rmSync(transaction.transactionRoot, {
+        recursive: true,
+        force: true,
+      });
+    } catch {
+      cleanupPending = true;
+    }
+  }
+  return { finalized: true, cleanupPending };
+}
+
+/**
+ * Restore the active version and, for a forced same-version reinstall, the
+ * exact prior bytes. New rejected versions are removed so `.active` fallback
+ * cannot silently select them later.
+ */
+export function rollbackPluginUpdate(result) {
+  const transaction = pendingPluginTransactions.get(result);
+  if (!transaction) return { rolledBack: false, version: null };
+
+  restoreActivePointer(
+    transaction.name,
+    transaction.previousActive,
+    transaction,
+  );
+  if (!transaction.pointerOnly) {
+    restoreInstalledBytes(transaction);
+  }
+  pendingPluginTransactions.delete(result);
+  if (transaction.transactionRoot) {
+    _deps.rmSync(transaction.transactionRoot, {
+      recursive: true,
+      force: true,
+    });
+  }
+  return {
+    rolledBack: true,
+    version: transaction.previousActive || null,
+  };
+}
+
 /**
  * Classify a source string into a git URL (+ optional ref), or null when it is
  * not remote-looking. `owner/repo` expands to a GitHub HTTPS URL.
@@ -530,8 +654,16 @@ export function setActiveVersion(name, version, opts = {}) {
   if (!_deps.existsSync(versionDir)) {
     throw new Error(`${name}@${version} is not installed at ${scope} scope`);
   }
-  const activeFile = path.join(pluginNameDir(scope, name, { cwd }), ".active");
-  _deps.writeFileSync(activeFile, String(version), "utf8");
+  const nameDir = pluginNameDir(scope, name, { cwd });
+  const activeFile = path.join(nameDir, ".active");
+  const tempDir = _deps.mkdtempSync(path.join(nameDir, ".active-"));
+  const tempFile = path.join(tempDir, "next");
+  try {
+    _deps.writeFileSync(tempFile, String(version), "utf8");
+    _deps.renameSync(tempFile, activeFile);
+  } finally {
+    _deps.rmSync(tempDir, { recursive: true, force: true });
+  }
   return { name, version, scope, active: version };
 }
 
@@ -656,3 +788,63 @@ function copyDirGuarded(src, dst, root) {
     }
   }
 }
+
+function validateStagedInstall(root, { name, version, verification }) {
+  const parsed = parsePluginManifest(root);
+  if (
+    !parsed.ok ||
+    parsed.metadata.name !== name ||
+    parsed.metadata.version !== version
+  ) {
+    const details = parsed.errors?.length
+      ? `: ${parsed.errors.join("; ")}`
+      : "";
+    throw new Error(`staged plugin failed load validation${details}`);
+  }
+  if (verification) {
+    const signature = verifyInstalledSignature({ root });
+    if (!signature.signed) {
+      throw new Error(
+        `staged plugin failed signature/SBOM validation: ${signature.reason || "unknown error"}`,
+      );
+    }
+  }
+}
+
+function transferPendingTransaction(from, to) {
+  const transaction = pendingPluginTransactions.get(from);
+  if (!transaction) return;
+  pendingPluginTransactions.delete(from);
+  pendingPluginTransactions.set(to, transaction);
+}
+
+function restoreActivePointer(name, version, opts = {}) {
+  if (version) {
+    setActiveVersion(name, version, opts);
+    return;
+  }
+  _deps.rmSync(
+    path.join(
+      pluginNameDir(opts.scope || "user", name, { cwd: opts.cwd }),
+      ".active",
+    ),
+    { force: true },
+  );
+}
+
+function restoreInstalledBytes({ dest, backup, transactionRoot }) {
+  if (!backup) {
+    _deps.rmSync(dest, { recursive: true, force: true });
+    return;
+  }
+  const rejected = path.join(transactionRoot, "rejected");
+  _deps.renameSync(dest, rejected);
+  try {
+    _deps.renameSync(backup, dest);
+  } catch (error) {
+    if (_deps.existsSync(rejected) && !_deps.existsSync(dest)) {
+      _deps.renameSync(rejected, dest);
+    }
+    throw error;
+  }
+}

package/src/lib/plugin-runtime/mcp.js

@@ -21,7 +21,10 @@ import {
   componentCapabilityDenial,
   networkTargetDenial,
 } from "./capabilities.js";
-import { mergePluginSandboxPolicies } from "./sandbox-policy.js";
+import {
+  issuePluginWorkspaceAuthority,
+  mergePluginSandboxPolicies,
+} from "./sandbox-policy.js";
 
 export const _deps = { readFileSync: fs.readFileSync };
 
@@ -89,6 +92,21 @@ export function collectPluginMcpServers(opts = {}) {
     if (!p.manifest || p.manifest.ok !== true) continue;
     const m = p.manifest.components?.mcp;
     if (!m) continue;
+    const pluginSource = m.absPath || p.manifest.manifestPath;
+    let pluginWorkspaceAuthority;
+    try {
+      pluginWorkspaceAuthority = issuePluginWorkspaceAuthority({
+        root: p.root,
+        origin: "plugin:mcp",
+        pluginId: p.name,
+        pluginVersion: p.version,
+        pluginSource,
+      });
+    } catch {
+      // The discovery root disappeared or stopped resolving safely. Refuse the
+      // component instead of copying an attacker-controlled path downstream.
+      continue;
+    }
     // Component-level capability gate: a plugin that declared a permissions
     // block but under-declared the `mcp` capability its server needs gets its
     // MCP component refused here (mirrors the hooks/monitors/bin/lsp denial).
@@ -150,7 +168,8 @@ export function collectPluginMcpServers(opts = {}) {
         policy: "allow",
         pluginId: p.name,
         pluginVersion: p.version,
-        pluginSource: m.absPath || p.manifest.manifestPath,
+        pluginSource,
+        pluginWorkspaceAuthority,
       };
       added++;
     }

package/src/lib/plugin-runtime/monitors.js

@@ -22,7 +22,10 @@ import fs from "fs";
 import { discoverPlugins } from "./scopes.js";
 import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
 import { componentCapabilityDenial } from "./capabilities.js";
-import { mergePluginSandboxPolicies } from "./sandbox-policy.js";
+import {
+  issuePluginWorkspaceAuthority,
+  mergePluginSandboxPolicies,
+} from "./sandbox-policy.js";
 
 export const _deps = { readFileSync: fs.readFileSync };
 
@@ -55,7 +58,7 @@ export function _resetMonitorWarnings() {
 }
 
 /** Normalize one raw monitor entry into a validated descriptor, or null. */
-function normalizeMonitor(plugin, raw) {
+function normalizeMonitor(plugin, raw, pluginWorkspaceAuthority) {
   if (!raw || typeof raw !== "object") return null;
   if (typeof raw.name !== "string" || raw.name === "") return null;
   if (typeof raw.command !== "string" || raw.command === "") return null;
@@ -91,6 +94,7 @@ function normalizeMonitor(plugin, raw) {
     intervalMs,
     env,
     cwd: plugin.root,
+    pluginWorkspaceAuthority,
     origin: "plugin:monitor",
     pluginId: plugin.name,
     pluginVersion: plugin.version,
@@ -131,6 +135,18 @@ export function collectPluginMonitors(opts = {}) {
       denied.push({ name: p.name, reason: denial.reason });
       continue;
     }
+    let pluginWorkspaceAuthority;
+    try {
+      pluginWorkspaceAuthority = issuePluginWorkspaceAuthority({
+        root: p.root,
+        origin: "plugin:monitor",
+        pluginId: p.name,
+        pluginVersion: p.version,
+        pluginSource: p.manifest?.manifestPath || "",
+      });
+    } catch {
+      continue;
+    }
     let parsed;
     if (m.absPath) {
       try {
@@ -159,7 +175,7 @@ export function collectPluginMonitors(opts = {}) {
         ? parsed
         : [];
     for (const raw of list) {
-      const desc = normalizeMonitor(p, raw);
+      const desc = normalizeMonitor(p, raw, pluginWorkspaceAuthority);
       if (desc) out.push(desc);
     }
   }

package/src/lib/plugin-runtime/sandbox-policy.js

@@ -1,3 +1,6 @@
+import fs from "node:fs";
+import path from "node:path";
+
 /**
  * Normalize the small, declarative sandbox contract exposed to plugins.
  *
@@ -14,6 +17,8 @@ export const PLUGIN_SANDBOX_BOUNDARIES = Object.freeze([
 ]);
 
 const SUPPORTED_BOUNDARIES = new Set(PLUGIN_SANDBOX_BOUNDARIES);
+const PLUGIN_WORKSPACE_AUTHORITY_KIND = "trusted-plugin-workspace";
+const pluginWorkspaceAuthorities = new WeakMap();
 
 function invalidPolicy(message) {
   const error = new Error(message);
@@ -21,6 +26,100 @@ function invalidPolicy(message) {
   return error;
 }
 
+function normalizedProvenance(value = {}) {
+  return Object.freeze({
+    origin: typeof value.origin === "string" ? value.origin : "",
+    pluginId: typeof value.pluginId === "string" ? value.pluginId : "",
+    pluginVersion:
+      typeof value.pluginVersion === "string" ? value.pluginVersion : "",
+    pluginSource:
+      typeof value.pluginSource === "string" ? value.pluginSource : "",
+  });
+}
+
+function sameProvenance(left, right) {
+  return (
+    left.origin === right.origin &&
+    left.pluginId === right.pluginId &&
+    left.pluginVersion === right.pluginVersion &&
+    left.pluginSource === right.pluginSource
+  );
+}
+
+/**
+ * Mint an opaque, reusable authority from a plugin root produced by trusted
+ * installed-plugin discovery. Manifest/server/monitor data receives only the
+ * token: the canonical writable root stays in this module's WeakMap.
+ *
+ * A token is reusable because MCP reconnects and interval monitors can launch
+ * more than once. The process broker still mints a separate one-shot execution
+ * contract for every child.
+ */
+export function issuePluginWorkspaceAuthority(value = {}) {
+  if (
+    typeof value.root !== "string" ||
+    value.root.length === 0 ||
+    value.root.includes("\0")
+  ) {
+    throw invalidPolicy("trusted plugin workspace root must be a path");
+  }
+  const requestedRoot = path.resolve(value.root);
+  let canonicalRoot;
+  let stat;
+  try {
+    const implementation = fs.realpathSync.native || fs.realpathSync;
+    canonicalRoot = implementation.call(fs.realpathSync, requestedRoot);
+    stat = fs.statSync(canonicalRoot);
+  } catch {
+    throw invalidPolicy("trusted plugin workspace root is unavailable");
+  }
+  if (!stat.isDirectory()) {
+    throw invalidPolicy("trusted plugin workspace root must be a directory");
+  }
+
+  const provenance = normalizedProvenance(value);
+  if (
+    !provenance.origin.startsWith("plugin:") ||
+    !provenance.pluginId ||
+    !provenance.pluginVersion
+  ) {
+    throw invalidPolicy("trusted plugin workspace provenance is incomplete");
+  }
+
+  const authority = Object.freeze({
+    contractVersion: 1,
+    kind: PLUGIN_WORKSPACE_AUTHORITY_KIND,
+  });
+  pluginWorkspaceAuthorities.set(
+    authority,
+    Object.freeze({ root: canonicalRoot, provenance }),
+  );
+  return authority;
+}
+
+/**
+ * Resolve an authority only for the exact plugin/component provenance to which
+ * the loader bound it. Structurally similar manifest objects are not accepted.
+ */
+export function resolvePluginWorkspaceAuthority(authority, provenance = {}) {
+  if (
+    !authority ||
+    typeof authority !== "object" ||
+    authority.contractVersion !== 1 ||
+    authority.kind !== PLUGIN_WORKSPACE_AUTHORITY_KIND
+  ) {
+    return null;
+  }
+  const binding = pluginWorkspaceAuthorities.get(authority);
+  if (
+    !binding ||
+    !sameProvenance(binding.provenance, normalizedProvenance(provenance))
+  ) {
+    return null;
+  }
+  return binding.root;
+}
+
 /**
  * @param {unknown} raw
  * @param {{ label?: string }} [opts]
@@ -49,10 +148,7 @@ export function normalizePluginSandboxPolicy(raw, opts = {}) {
 
   const requiredBoundaries = [];
   for (const boundary of boundaries) {
-    if (
-      typeof boundary !== "string" ||
-      !SUPPORTED_BOUNDARIES.has(boundary)
-    ) {
+    if (typeof boundary !== "string" || !SUPPORTED_BOUNDARIES.has(boundary)) {
       throw invalidPolicy(
         `${label}.requiredBoundaries contains unsupported boundary: ${String(boundary)}`,
       );