chainlesschain 0.162.183 → 0.162.185

package/src/runtime/agent-core.js

@@ -201,6 +201,76 @@ function createPythonInterpreterProbeSandboxFailure(sandboxPolicy) {
   return error;
 }
 
+function createBackgroundShellSandboxFailure(
+  reason,
+  message,
+  sandboxPolicy,
+  cause = null,
+) {
+  const requiredBoundaries = [...(sandboxPolicy?.requiredBoundaries || [])];
+  const error = new Error(message);
+  error.code = "ERR_PROCESS_SANDBOX_BOUNDARY_UNSATISFIED";
+  error.sandboxReason = reason;
+  error.sandboxFailClosed = true;
+  error.requiredBoundaries = requiredBoundaries;
+  error.actualGuarantees = [];
+  error.missingBoundaries = [...requiredBoundaries];
+  error.sandboxBackend = null;
+  error.sandboxCandidateBackend = "linux-bwrap-workspace";
+  if (cause) error.cause = cause;
+  return error;
+}
+
+function resolveBackgroundShellWorkspacePaths(
+  trustedWorkspaceRoot,
+  requestedCwd,
+  sandboxPolicy,
+) {
+  if (
+    typeof trustedWorkspaceRoot !== "string" ||
+    !trustedWorkspaceRoot ||
+    trustedWorkspaceRoot.includes("\0") ||
+    !path.isAbsolute(trustedWorkspaceRoot)
+  ) {
+    throw createBackgroundShellSandboxFailure(
+      "background_workspace_root_untrusted",
+      "Background shell strong sandbox requires an absolute trusted host workspace root",
+      sandboxPolicy,
+    );
+  }
+  const workspaceRoot = path.resolve(trustedWorkspaceRoot);
+  let workingDirectory = workspaceRoot;
+  if (
+    requestedCwd !== undefined &&
+    requestedCwd !== null &&
+    requestedCwd !== ""
+  ) {
+    if (typeof requestedCwd !== "string" || requestedCwd.includes("\0")) {
+      throw createBackgroundShellSandboxFailure(
+        "background_working_directory_untrusted",
+        "Background shell strong sandbox cwd must be a trusted path string",
+        sandboxPolicy,
+      );
+    }
+    workingDirectory = path.isAbsolute(requestedCwd)
+      ? path.resolve(requestedCwd)
+      : path.resolve(workspaceRoot, requestedCwd);
+  }
+  const relative = path.relative(workspaceRoot, workingDirectory);
+  if (
+    relative === ".." ||
+    relative.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relative)
+  ) {
+    throw createBackgroundShellSandboxFailure(
+      "background_working_directory_escape",
+      "Background shell strong sandbox cwd escapes the trusted host workspace root",
+      sandboxPolicy,
+    );
+  }
+  return { workspaceRoot, workingDirectory };
+}
+
 // ─── Background shell tasks ────────────────────────────────────────────────
 //
 // run_shell is synchronous (execSync) and capped at a foreground timeout, which
@@ -321,10 +391,16 @@ function _releaseBgChildHandles(task) {
 
 const backgroundTaskRunner = broker.spawn.bind(broker);
 const backgroundTaskSyncRunner = broker.spawnSync.bind(broker);
+const backgroundTaskContractIssuer =
+  typeof broker.issueLinuxWorkspaceSandboxExecutionContract === "function"
+    ? broker.issueLinuxWorkspaceSandboxExecutionContract.bind(broker)
+    : null;
 
 export const _backgroundProcessDeps = {
   run: backgroundTaskRunner,
   runSync: backgroundTaskSyncRunner,
+  issueLinuxWorkspaceSandboxExecutionContract: backgroundTaskContractIssuer,
+  platform: () => process.platform,
 };
 
 export function _runBackgroundTaskkill(pid, { sync = false } = {}) {
@@ -350,7 +426,12 @@ function _killTask(task) {
   const child = task?.child;
   if (!child || child.killed || task?.status !== "running") return false;
   try {
-    if (process.platform === "win32") {
+    if (task.sandboxManagedTree === true) {
+      // Linux generic launches are never detached. Bubblewrap owns the private
+      // PID namespace and runs with --die-with-parent/--new-session, so killing
+      // the Broker child reaps the complete sandbox tree.
+      child.kill("SIGTERM");
+    } else if (process.platform === "win32") {
       if (child.pid) {
         const tk = _runBackgroundTaskkill(child.pid);
         const fallbackDirectKill = () => {
@@ -425,7 +506,9 @@ function _killTaskSync(task) {
   const child = task?.child;
   if (!child || child.killed || task?.status !== "running") return false;
   try {
-    if (process.platform === "win32") {
+    if (task.sandboxManagedTree === true) {
+      child.kill("SIGKILL");
+    } else if (process.platform === "win32") {
       if (child.pid) {
         const killed = _runBackgroundTaskkill(child.pid, { sync: true });
         if (killed.error || killed.status !== 0) {
@@ -3562,6 +3645,7 @@ async function executeToolInner(
               pluginBinSandboxExecutionContract =
                 pluginBin.createPluginSandboxExecutionContract(
                   pluginBinInvocation,
+                  { sync: args.run_in_background !== true },
                 );
             } catch (error) {
               if (error?.pluginBinFailClosed) throw error;
@@ -3644,9 +3728,33 @@ async function executeToolInner(
             policy: { decision: "deny", via: "sandbox" },
           });
         }
+        const backgroundPlatform =
+          typeof _backgroundProcessDeps.platform === "function"
+            ? _backgroundProcessDeps.platform()
+            : process.platform;
+        const pinnedBackgroundBoundaries = [
+          ...(pluginBinSandboxPolicy?.requiredBoundaries || []),
+        ];
+        const hasPinnedBackgroundPolicy = pinnedBackgroundBoundaries.length > 0;
+        const linuxGenericStrongBackground =
+          backgroundPlatform === "linux" &&
+          !pluginBinInvocation &&
+          pinnedBackgroundBoundaries.some(
+            (boundary) => boundary === "filesystem" || boundary === "network",
+          );
+        const linuxDirectPluginStrongBackground =
+          backgroundPlatform === "linux" &&
+          pluginBinInvocation !== null &&
+          pluginBinSandboxExecutionContract !== null &&
+          pinnedBackgroundBoundaries.some(
+            (boundary) => boundary === "filesystem" || boundary === "network",
+          );
         if (
-          (process.platform === "linux" || process.platform === "win32") &&
-          pluginBinSandboxPolicy?.requiredBoundaries?.length > 0
+          hasPinnedBackgroundPolicy &&
+          (backgroundPlatform === "win32" ||
+            (backgroundPlatform === "linux" &&
+              !linuxGenericStrongBackground &&
+              !linuxDirectPluginStrongBackground))
         ) {
           return attachDescriptor({
             error:
@@ -3661,6 +3769,84 @@ async function executeToolInner(
             approval: approvalOutcome,
           });
         }
+        let linuxGenericBackgroundLaunch = null;
+        if (linuxGenericStrongBackground) {
+          const { workspaceRoot, workingDirectory } =
+            resolveBackgroundShellWorkspacePaths(
+              cwd,
+              args.cwd,
+              pluginBinSandboxPolicy,
+            );
+          const file = "/bin/sh";
+          const launchArgs = ["-c", args.command];
+          const options = {
+            cwd: workingDirectory,
+            shell: false,
+            windowsHide: true,
+            env: applyCredentialProxy({
+              ...process.env,
+              CLAUDECODE: "1",
+              ...(sessionId
+                ? {
+                    CC_SESSION_ID: String(sessionId),
+                    CLAUDE_CODE_SESSION_ID: String(sessionId),
+                  }
+                : {}),
+            }).env,
+            detached: false,
+            origin: "tool:run_shell",
+            policy: "allow",
+            scope: "agent",
+            sandboxPolicy: pluginBinSandboxPolicy,
+          };
+          const issuer =
+            _backgroundProcessDeps.issueLinuxWorkspaceSandboxExecutionContract;
+          if (typeof issuer !== "function") {
+            throw createBackgroundShellSandboxFailure(
+              "background_contract_issuer_unavailable",
+              "Linux background shell sandbox contract issuer is unavailable",
+              pluginBinSandboxPolicy,
+            );
+          }
+          let sandboxExecutionContract;
+          try {
+            sandboxExecutionContract = issuer(
+              file,
+              launchArgs,
+              options,
+              workspaceRoot,
+              { sync: false },
+            );
+          } catch (error) {
+            if (
+              error?.sandboxFailClosed === true ||
+              error?.code === "ERR_PROCESS_SANDBOX_BOUNDARY_UNSATISFIED"
+            ) {
+              throw error;
+            }
+            throw createBackgroundShellSandboxFailure(
+              "background_contract_issuance_failed",
+              `Linux background shell sandbox contract could not be issued: ${error?.message || String(error)}`,
+              pluginBinSandboxPolicy,
+              error,
+            );
+          }
+          if (!sandboxExecutionContract) {
+            throw createBackgroundShellSandboxFailure(
+              "background_contract_unavailable",
+              "Linux background shell sandbox contract issuer returned no authority",
+              pluginBinSandboxPolicy,
+            );
+          }
+          linuxGenericBackgroundLaunch = {
+            file,
+            args: launchArgs,
+            options: {
+              ...options,
+              sandboxExecutionContract,
+            },
+          };
+        }
         // Free memory from idle background tasks before adding another, so a
         // long agent run can't accumulate forgotten dev servers (no-op unless
         // the machine is actually under memory pressure).
@@ -3669,7 +3855,11 @@ async function executeToolInner(
         const task = {
           id,
           command: args.command,
-          cwd: args.cwd || cwd,
+          cwd:
+            linuxGenericBackgroundLaunch?.options.cwd ||
+            (linuxDirectPluginStrongBackground
+              ? pluginBinSandboxExecutionContract.workingDirectory
+              : args.cwd || cwd),
           status: "running",
           exitCode: null,
           signal: null,
@@ -3680,44 +3870,61 @@ async function executeToolInner(
           out: _newBgStream(),
           err: _newBgStream(),
           child: null,
+          sandboxManagedTree:
+            linuxGenericBackgroundLaunch !== null ||
+            linuxDirectPluginStrongBackground,
         };
         try {
-          const bgSpawnOpts = {
-            cwd: task.cwd,
-            shell: shellInv.useDefaultShell,
-            windowsHide: true,
-            // Same agent-identity env as the foreground path: CLAUDECODE marks
-            // "running under the agent"; the session id correlates work to the
-            // run (CC_SESSION_ID + CLAUDE_CODE_SESSION_ID for Claude-Code parity).
-            // Credential proxy (opt-in, CC_CREDENTIAL_PROXY): keeps the agent's
-            // real long-lived secrets out of the spawned command's env — a
-            // no-op (same object) when disabled. See credential-proxy.js.
-            env: applyCredentialProxy({
-              ...process.env,
-              CLAUDECODE: "1",
-              ...(sessionId
-                ? {
-                    CC_SESSION_ID: String(sessionId),
-                    CLAUDE_CODE_SESSION_ID: String(sessionId),
-                  }
-                : {}),
-            }).env,
-            // POSIX: own process group so check_shell{kill}/teardown can signal
-            // the whole tree (shell + its grandchild command). No-op on Windows
-            // where the tree is killed via taskkill /T instead.
-            detached: process.platform !== "win32",
-          };
+          // The strong route already has its exact contract-bound options.
+          // Construct legacy options only for legacy/direct-Plugin launches.
+          const bgSpawnOpts = linuxGenericBackgroundLaunch
+            ? null
+            : {
+                cwd: task.cwd,
+                shell: shellInv.useDefaultShell,
+                windowsHide: true,
+                // Same agent-identity env as the foreground path: CLAUDECODE marks
+                // "running under the agent"; the session id correlates work to the
+                // run (CC_SESSION_ID + CLAUDE_CODE_SESSION_ID for Claude-Code parity).
+                // Credential proxy (opt-in, CC_CREDENTIAL_PROXY): keeps the agent's
+                // real long-lived secrets out of the spawned command's env — a
+                // no-op (same object) when disabled. See credential-proxy.js.
+                env: applyCredentialProxy({
+                  ...process.env,
+                  CLAUDECODE: "1",
+                  ...(sessionId
+                    ? {
+                        CC_SESSION_ID: String(sessionId),
+                        CLAUDE_CODE_SESSION_ID: String(sessionId),
+                      }
+                    : {}),
+                }).env,
+                // POSIX: own process group so check_shell{kill}/teardown can signal
+                // the whole tree (shell + its grandchild command). No-op on Windows
+                // where the tree is killed via taskkill /T instead.
+                detached:
+                  process.platform !== "win32" &&
+                  !linuxDirectPluginStrongBackground,
+              };
           // PowerShell route: explicit argv (shell:false above); default route
           // is the historical spawn(command, {shell:true}) byte-for-byte.
-          const brokerOpts = {
-            ...bgSpawnOpts,
-            origin: processOrigin,
-            policy: "allow",
-            scope: "agent",
-            ...processProvenance,
-          };
+          const brokerOpts = bgSpawnOpts
+            ? {
+                ...bgSpawnOpts,
+                origin: processOrigin,
+                policy: "allow",
+                scope: "agent",
+                ...processProvenance,
+              }
+            : null;
           let child;
-          if (pluginBinInvocation) {
+          if (linuxGenericBackgroundLaunch) {
+            child = _backgroundProcessDeps.run(
+              linuxGenericBackgroundLaunch.file,
+              linuxGenericBackgroundLaunch.args,
+              linuxGenericBackgroundLaunch.options,
+            );
+          } else if (pluginBinInvocation) {
             reattestPluginBinInvocation(pluginBinInvocation);
             pluginBinResult.plugin_bin.launch_identity_reattested = true;
             child = broker.spawn(
@@ -3774,6 +3981,33 @@ async function executeToolInner(
             _releaseBgChildHandles(task);
           });
         } catch (err) {
+          if (
+            linuxGenericBackgroundLaunch ||
+            linuxDirectPluginStrongBackground
+          ) {
+            if (task.child && !task.child.killed) {
+              try {
+                task.child.kill("SIGKILL");
+              } catch {
+                // Preserve the setup failure; the bwrap supervisor also has
+                // --die-with-parent as a final process-lifetime backstop.
+              }
+              _releaseBgChildHandles(task);
+            }
+            if (
+              err?.sandboxFailClosed === true ||
+              (typeof err?.code === "string" &&
+                err.code.startsWith("ERR_PROCESS_SANDBOX"))
+            ) {
+              throw err;
+            }
+            throw createBackgroundShellSandboxFailure(
+              "background_sandbox_launch_failed",
+              `Linux background shell sandbox launch failed: ${err?.message || String(err)}`,
+              pluginBinSandboxPolicy,
+              err,
+            );
+          }
           task.status = "error";
           task.error = String(err?.message || err).substring(0, 2000);
           task.endedAt = new Date().toISOString();
@@ -6742,7 +6976,15 @@ export async function chatWithTools(rawMessages, options) {
             options.streamStallMs,
             options.streamStallTimeoutMs,
           ),
-        { signal, onRetry: options.onStreamRetry },
+        {
+          signal,
+          onRetry: (attempt, error, telemetry) =>
+            options.onStreamRetry?.(attempt, error, {
+              ...telemetry,
+              provider: "ollama",
+              model: model || null,
+            }),
+        },
       );
     }
     const response = await fetch(apiUrl, {
@@ -6868,7 +7110,15 @@ export async function chatWithTools(rawMessages, options) {
             options.streamStallMs,
             options.streamStallTimeoutMs,
           ),
-        { signal, onRetry: options.onStreamRetry },
+        {
+          signal,
+          onRetry: (attempt, error, telemetry) =>
+            options.onStreamRetry?.(attempt, error, {
+              ...telemetry,
+              provider: "anthropic",
+              model: effModel,
+            }),
+        },
       );
     }
 
@@ -6972,7 +7222,15 @@ export async function chatWithTools(rawMessages, options) {
           options.streamStallMs,
           options.streamStallTimeoutMs,
         ),
-      { signal, onRetry: options.onStreamRetry },
+      {
+        signal,
+        onRetry: (attempt, error, telemetry) =>
+          options.onStreamRetry?.(attempt, error, {
+            ...telemetry,
+            provider,
+            model: model || defaultModels[provider] || "gpt-4o-mini",
+          }),
+      },
     );
   }
 
@@ -7171,8 +7429,10 @@ export async function _retryStreamingChat(streamFn, opts = {}) {
   const base = opts.baseDelayMs ?? STREAM_RETRY_BASE_MS;
   const signal = opts.signal;
   const sleep = opts.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = typeof opts.now === "function" ? opts.now : Date.now;
   let attempt = 0;
   for (;;) {
+    const attemptStartedAt = now();
     try {
       return await streamFn();
     } catch (err) {
@@ -7181,7 +7441,9 @@ export async function _retryStreamingChat(streamFn, opts = {}) {
       attempt++;
       if (typeof opts.onRetry === "function") {
         try {
-          opts.onRetry(attempt, err);
+          opts.onRetry(attempt, err, {
+            durationMs: Math.max(0, now() - attemptStartedAt),
+          });
         } catch {
           /* the retry notice is best-effort; never let it mask the retry */
         }

package/src/runtime/headless-runner.js

@@ -43,6 +43,7 @@ import {
   appendAssistantMessage as jsonlAppendAssistantMessage,
   appendTokenUsage as jsonlAppendTokenUsage,
   appendToolCallCompact as jsonlAppendToolCallCompact,
+  appendLlmRetryCompact as jsonlAppendLlmRetryCompact,
   appendCompactEvent as jsonlAppendCompactEvent,
   appendEvent as jsonlAppendEvent,
   readEvents as jsonlReadEvents,
@@ -51,6 +52,7 @@ import {
   getLastSessionId as jsonlGetLastSessionId,
   verifySession as jsonlVerifySession,
 } from "../harness/jsonl-session-store.js";
+import { classifyStreamRetryReason } from "../lib/stream-retry.js";
 import {
   SideEffectLedger,
   reconcileSideEffects,
@@ -66,6 +68,7 @@ import {
   executeHooksV2Event,
   resolvePromptExpansion,
 } from "../lib/hooks-v2-producers.js";
+import { runWithHostHooksV2Workspace } from "../lib/hooks-v2-workspace-context.js";
 import { CLISkillLoader } from "../lib/skill-loader.js";
 import { expandFileRefsAsync } from "./file-ref-expander.js";
 import { composeSystemPrompt } from "./system-prompt.js";
@@ -323,7 +326,9 @@ export function applyForkSession(opts = {}, store = {}) {
  * @param {string[]} [options.allowedTools]
  * @param {string[]} [options.disallowedTools]
  * @param {number} [options.maxTurns]          Cap on agent loop iterations.
- * @param {string} [options.cwd]
+ * @param {string} [options.cwd]               Trusted CLI-host workspace
+ *                                             input. Never populate this from
+ *                                             model/plugin/hook/event payloads.
  * @param {string[]} [options.additionalDirectories] Extra workspace roots
  *                                             (--add-dir): absolute dirs the
  *                                             agent may read/search/edit.
@@ -339,6 +344,13 @@ export function applyForkSession(opts = {}, store = {}) {
  * @returns {Promise<{ exitCode:number, result:string, isError:boolean }>}
  */
 export async function runAgentHeadless(options = {}, deps = {}) {
+  const trustedWorkspaceRoot = options.cwd || process.cwd();
+  return runWithHostHooksV2Workspace(trustedWorkspaceRoot, () =>
+    runAgentHeadlessInWorkspace(options, deps),
+  );
+}
+
+async function runAgentHeadlessInWorkspace(options = {}, deps = {}) {
   const prompt = (options.prompt || "").trim();
   if (!prompt) {
     throw new Error(
@@ -503,6 +515,8 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     appendTokenUsage: deps.appendTokenUsage || jsonlAppendTokenUsage,
     appendToolCallCompact:
       deps.appendToolCallCompact || jsonlAppendToolCallCompact,
+    appendLlmRetryCompact:
+      deps.appendLlmRetryCompact || jsonlAppendLlmRetryCompact,
     appendCompactEvent: deps.appendCompactEvent || jsonlAppendCompactEvent,
     appendEvent: deps.appendEvent || jsonlAppendEvent,
     readEvents: deps.readEvents || jsonlReadEvents,
@@ -1626,6 +1640,22 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     // while a human watching a long `cc agent -p` run learns we're still waiting
     // and, when a hard inactivity timeout is set, when it will auto-retry. Plain
     // text (no chalk) since headless stderr is frequently piped/non-TTY.
+    onStreamRetry: (attempt, error, telemetry = {}) => {
+      writeErr(`  ⟳ connection dropped — retrying (attempt ${attempt})…\n`);
+      if (persist) {
+        try {
+          store.appendLlmRetryCompact(sessionId, {
+            attempt,
+            durationMs: telemetry.durationMs,
+            provider: telemetry.provider || provider,
+            model: telemetry.model || model,
+            reason: classifyStreamRetryReason(error),
+          });
+        } catch {
+          /* usage telemetry is best-effort */
+        }
+      }
+    },
     onStall: (ms, timeoutMs) => {
       const silent = Math.round(ms / 1000);
       const retryIn = timeoutMs > ms ? Math.round((timeoutMs - ms) / 1000) : 0;
@@ -1678,6 +1708,11 @@ export async function runAgentHeadless(options = {}, deps = {}) {
 
   const startedAt = deps.now ? deps.now() : Date.now();
   const toolCalls = [];
+  // The core normally attaches a precise toolTelemetryRecord on success.
+  // Keep an event-boundary fallback for denials/early throws that settle
+  // before that record is produced. Tools are serial in this loop, so one
+  // timestamp is sufficient and never leaks into the result envelope.
+  let currentToolStartedAt = null;
   // Policy denials (blocked tool calls) collected for an end-of-run summary,
   // so a non-interactive run surfaces what got blocked the way the REPL's
   // `/permissions denials` does (Claude-Code 2.1.193 denial reasons).
@@ -1970,6 +2005,7 @@ export async function runAgentHeadless(options = {}, deps = {}) {
             break;
           }
           case "tool-executing": {
+            currentToolStartedAt = deps.now ? deps.now() : Date.now();
             const line = `  [${event.tool}] ${formatToolArgs(event.tool, event.args)}`;
             if (isText) writeErr(line + "\n");
             emitStream({
@@ -2057,11 +2093,21 @@ export async function runAgentHeadless(options = {}, deps = {}) {
             if (toolCalls.length > 0) {
               const settledCall = toolCalls[toolCalls.length - 1];
               settledCall.is_error = Boolean(err);
+              settledCall.durationMs =
+                event.result?.toolTelemetryRecord?.durationMs ??
+                (currentToolStartedAt === null
+                  ? undefined
+                  : Math.max(
+                      0,
+                      (deps.now ? deps.now() : Date.now()) -
+                        currentToolStartedAt,
+                    ));
               Object.assign(
                 settledCall,
                 extractPluginUsageAttribution(event.result),
               );
             }
+            currentToolStartedAt = null;
             // Track policy denials (not plain tool failures) for the end-of-run
             // summary. The preceding tool-executing pushed the args.
             if (err) {
@@ -2540,6 +2586,7 @@ export async function runAgentHeadless(options = {}, deps = {}) {
             tc.tool === "run_skill" ? tc.args?.skill_name || null : undefined,
           plugin: tc.plugin || undefined,
           pluginVersion: tc.pluginVersion || undefined,
+          durationMs: tc.durationMs,
         });
       }
       // Attributed child-loop usage first (chronology: it happened during