chainlesschain 0.162.188 → 0.162.193

package/src/commands/pack.js

@@ -61,7 +61,6 @@ export function registerPackCommand(program) {
     .option(
       "-t, --targets <list>",
       "Comma-separated pkg targets (defaults to current host platform)",
-      defaultPkgTarget(),
     )
     .option("--ws-port <n>", "Default WS port baked into the artifact", "18800")
     .option(
@@ -154,9 +153,20 @@ export function registerPackCommand(program) {
       "--update-manifest-url <url>",
       "OTA manifest URL to bake into the artifact (enables `cc pack check-update`)",
     )
+    .option(
+      "--update-public-key <path>",
+      "Trusted Ed25519 public key PEM to bake in for signed update manifests",
+    )
     .action(async (opts) => {
       try {
-        const result = await runPack(opts, { logger });
+        // Resolve the host-aware default at execution time. Supplying it as
+        // Commander's option default makes generated help platform-dependent,
+        // which causes the committed help index to drift across CI hosts.
+        const runOptions = {
+          ...opts,
+          targets: opts.targets || defaultPkgTarget(),
+        };
+        const result = await runPack(runOptions, { logger });
         if (opts.dryRun) {
           logger.log(
             chalk.green(
@@ -420,7 +430,9 @@ export function registerPackCommand(program) {
           const plan = await scheduleReplace({
             newExePath: dl.outputPath,
             targetExePath: targetExe,
+            expectedSha256: dl.sha256,
             restart: Boolean(opts.restart),
+            verify: true,
           });
           if (opts.json) {
             logger.log(JSON.stringify({ applied: true, ...plan }, null, 2));
@@ -732,7 +744,9 @@ export async function runAutoUpdate({
     plan = await applyImpl({
       newExePath: dl.outputPath,
       targetExePath: targetExe,
+      expectedSha256: dl.sha256,
       restart,
+      verify: true,
     });
   } catch (err) {
     const code = err instanceof ApplyError ? err.code : "UNKNOWN";

package/src/commands/plugin.js

@@ -1369,10 +1369,10 @@ export function registerPluginCommand(program) {
       }
     });
 
-  // plugin options — view a plugin's resolved typed options, or set values at a
-  // scope. The security-critical rule: a SENSITIVE option can never be set from
-  // PROJECT scope (a checked-in file must not inject secrets) — such values are
-  // dropped + warned; use `--scope user`.
+  // plugin options — view a plugin's resolved typed options, or set
+  // non-sensitive values at a scope. Sensitive values are rejected on this
+  // argv-based surface because process arguments and shell history are not a
+  // credential transport.
   plugin
     .command("options <name>")
     .description(
@@ -1381,7 +1381,7 @@ export function registerPluginCommand(program) {
     .option("--scope <scope>", "Scope for --set (user|project)", "user")
     .option(
       "--set <pair>",
-      "Set an option value (key=value); repeatable",
+      "Set a non-sensitive option value (key=value); repeatable",
       (v, acc) => {
         acc.push(v);
         return acc;
@@ -1413,20 +1413,28 @@ export function registerPluginCommand(program) {
       // --set: persist values at the requested scope (then fall through to show).
       if (options.set && options.set.length) {
         const scope = options.scope === "project" ? "project" : "user";
-        const current = optsMod.loadPluginOptionValues(name, scope, {
-          cwd: process.cwd(),
-          schema,
-        });
+        const updates = Object.create(null);
         for (const pair of options.set) {
           const eq = pair.indexOf("=");
           if (eq <= 0) {
-            logger.error(`Invalid --set "${pair}" (expected key=value)`);
+            logger.error("Invalid --set value (expected key=value)");
+            process.exitCode = 1;
+            return;
+          }
+          const key = pair.slice(0, eq);
+          const descriptor = Object.prototype.hasOwnProperty.call(schema, key)
+            ? schema[key]
+            : null;
+          if (descriptor?.sensitive) {
+            logger.error(
+              `Sensitive option "${key}" cannot be supplied via --set because command-line arguments are observable`,
+            );
             process.exitCode = 1;
             return;
           }
-          current[pair.slice(0, eq)] = pair.slice(eq + 1);
+          updates[key] = pair.slice(eq + 1);
         }
-        optsMod.setPluginOptionValues(name, current, scope, {
+        optsMod.patchPluginOptionValues(name, updates, scope, {
           cwd: process.cwd(),
           schema,
         });

package/src/commands/session-mcp-recovery.js

@@ -0,0 +1,218 @@
+import chalk from "chalk";
+import { logger } from "../lib/logger.js";
+import { resolveSessionId as storeResolveSessionId } from "../harness/jsonl-session-store.js";
+import {
+  adjudicateMcpRecovery,
+  buildMcpRecoveryAdjudicationChallenge,
+  publicMcpRecoveryAuthority,
+  readMcpRecoveryAuthority,
+} from "../lib/mcp-recovery-adjudication.js";
+
+function commandError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function resolveJsonlSession(id, dependencies = {}) {
+  const resolveSessionId =
+    dependencies.resolveSessionId || storeResolveSessionId;
+  const sessionId = resolveSessionId(id);
+  if (!sessionId) {
+    throw commandError(
+      "CC_MCP_RECOVERY_SESSION_NOT_FOUND",
+      `JSONL session not found: ${id}`,
+    );
+  }
+  return sessionId;
+}
+
+export async function requireMcpRecoveryTypedChallenge(
+  request,
+  dependencies = {},
+) {
+  const stdin = dependencies.stdin || process.stdin;
+  const stdout = dependencies.stdout || process.stdout;
+  if (stdin?.isTTY !== true || stdout?.isTTY !== true) {
+    throw commandError(
+      "CC_MCP_RECOVERY_ADJUDICATION_NON_INTERACTIVE",
+      "MCP recovery adjudication requires an interactive TTY",
+    );
+  }
+  const challenge = buildMcpRecoveryAdjudicationChallenge(request);
+  const readChallenge =
+    dependencies.readChallenge ||
+    (async (expected) => {
+      const { input } = await import("@inquirer/prompts");
+      return input({
+        message:
+          "First stop every active host for this session. " +
+          `Then type this operator attestation exactly:\n${expected}`,
+      });
+    });
+  const answer = await readChallenge(challenge);
+  if (answer !== challenge) {
+    throw commandError(
+      "CC_MCP_RECOVERY_ADJUDICATION_CHALLENGE_FAILED",
+      "MCP recovery adjudication challenge did not match; no change was made",
+    );
+  }
+  return challenge;
+}
+
+export async function readMcpRecoveryReason(dependencies = {}) {
+  const stdin = dependencies.stdin || process.stdin;
+  const stdout = dependencies.stdout || process.stdout;
+  if (stdin?.isTTY !== true || stdout?.isTTY !== true) {
+    throw commandError(
+      "CC_MCP_RECOVERY_ADJUDICATION_NON_INTERACTIVE",
+      "MCP recovery adjudication requires an interactive TTY",
+    );
+  }
+  const readReason =
+    dependencies.readReason ||
+    (async () => {
+      const { input } = await import("@inquirer/prompts");
+      return input({
+        message: "Reason (its digest only is persisted; do not enter secrets)",
+      });
+    });
+  return readReason();
+}
+
+export function showMcpRecoveryCommand(id, dependencies = {}) {
+  const sessionId = resolveJsonlSession(id, dependencies);
+  const recovery = readMcpRecoveryAuthority(sessionId, dependencies);
+  return publicMcpRecoveryAuthority(sessionId, recovery);
+}
+
+export async function adjudicateMcpRecoveryCommand(
+  id,
+  options,
+  dependencies = {},
+) {
+  const sessionId = resolveJsonlSession(id, dependencies);
+  const challengeRequest = {
+    sessionId,
+    ledgerId: options.ledgerId,
+    decision: options.decision,
+    recoveryDigest: options.expectedRecoveryDigest,
+  };
+  const reason = await readMcpRecoveryReason(dependencies);
+  await requireMcpRecoveryTypedChallenge(challengeRequest, dependencies);
+  return adjudicateMcpRecovery(
+    {
+      sessionId,
+      ledgerId: options.ledgerId,
+      decision: options.decision,
+      expectedHeadHash: options.expectedHeadHash,
+      expectedRecoveryDigest: options.expectedRecoveryDigest,
+      reason,
+    },
+    dependencies,
+  );
+}
+
+function printRecoveryAuthority(authority, outputLogger = logger) {
+  outputLogger.log(chalk.bold(`MCP recovery: ${authority.sessionId}`));
+  outputLogger.log(`  verified: ${authority.verified ? "yes" : "no"}`);
+  outputLogger.log(`  headHash: ${authority.headHash || "(none)"}`);
+  outputLogger.log(`  recoveryDigest: ${authority.recoveryDigest || "(none)"}`);
+  outputLogger.log(`  blockMode: ${authority.blockMode || "none"}`);
+  outputLogger.log(`  remediation: ${authority.remediation || "none"}`);
+  for (const record of authority.unsettled) {
+    outputLogger.log(
+      `  outcome unknown: ${record.ledgerId} ${record.serverName}/${record.toolName} [${record.effect}]`,
+    );
+  }
+  for (const incident of authority.incidents) {
+    outputLogger.log(
+      `  incident: ${incident.code}${incident.ledgerId ? ` (${incident.ledgerId})` : ""}`,
+    );
+  }
+  for (const adjudication of authority.adjudications) {
+    outputLogger.log(
+      `  adjudication: ${adjudication.ledgerId} ${adjudication.decision} ` +
+        `${adjudication.requestId} ${adjudication.reasonDigest}`,
+    );
+  }
+  for (const deny of authority.replayDenied) {
+    outputLogger.log(
+      `  replay denied: ${deny.ledgerId} ${deny.serverName}/${deny.toolName} ${deny.replayDigest}`,
+    );
+  }
+}
+
+export function registerSessionMcpRecoveryCommands(session, dependencies = {}) {
+  const outputLogger = dependencies.logger || logger;
+  const recovery = session
+    .command("mcp-recovery")
+    .description("Inspect or adjudicate verified MCP outcome-unknown calls");
+
+  recovery
+    .command("show", { isDefault: true })
+    .description("Show verified MCP recovery authority (read-only)")
+    .argument("<id>", "JSONL session ID or prefix")
+    .option("--json", "Output as JSON")
+    .action(async (id, options) => {
+      try {
+        const authority = showMcpRecoveryCommand(id, dependencies);
+        if (options.json) {
+          console.log(JSON.stringify(authority, null, 2));
+        } else {
+          printRecoveryAuthority(authority, outputLogger);
+        }
+      } catch (error) {
+        outputLogger.error(`MCP recovery show failed: ${error.message}`);
+        process.exitCode = 1;
+      }
+    });
+
+  recovery
+    .command("adjudicate")
+    .description(
+      "Attest hosts are stopped, then append one TTY-confirmed recovery decision",
+    )
+    .argument("<id>", "JSONL session ID or prefix")
+    .requiredOption("--ledger-id <id>", "Started-only MCP ledger ID")
+    .requiredOption(
+      "--decision <decision>",
+      "confirmed_applied or confirmed_not_applied",
+    )
+    .requiredOption(
+      "--expected-head-hash <digest>",
+      "Exact headHash from the latest mcp-recovery show",
+    )
+    .requiredOption(
+      "--expected-recovery-digest <digest>",
+      "Exact recoveryDigest from the latest mcp-recovery show",
+    )
+    .option("--json", "Output as JSON after interactive confirmation")
+    .action(async (id, options) => {
+      try {
+        const result = await adjudicateMcpRecoveryCommand(
+          id,
+          options,
+          dependencies,
+        );
+        if (options.json) {
+          console.log(JSON.stringify(result, null, 2));
+        } else {
+          outputLogger.success(
+            `Recorded ${result.decision} for ${result.ledgerId} at ${result.headHash}`,
+          );
+        }
+        outputLogger.warn(
+          "Recorded authority is not adopted by any host until restart/resume. " +
+            "Keep every prior host stopped; if one remained active, stop it and inspect the transcript before any MCP call.",
+        );
+      } catch (error) {
+        outputLogger.error(
+          `MCP recovery adjudication failed: ${error.message}`,
+        );
+        process.exitCode = 1;
+      }
+    });
+
+  return recovery;
+}