chainlesschain 0.162.188 → 0.162.193

package/src/commands/setup.js

@@ -8,7 +8,10 @@ import {
   VERSION,
 } from "../constants.js";
 import { ensureHomeDir, getConfigPath } from "../lib/paths.js";
-import { loadConfig, saveConfig } from "../lib/config-manager.js";
+import {
+  setSecretConfigValue,
+  updateConfigAtomically,
+} from "../lib/config-manager.js";
 import {
   isDockerAvailable,
   isDockerComposeAvailable,
@@ -44,6 +47,14 @@ export function registerSetupCommand(program) {
     });
 }
 
+export function assertRequiredProviderCredential(providerInfo, apiKey) {
+  if (providerInfo?.requiresApiKey && (apiKey === null || apiKey === "")) {
+    const error = new Error("An API key is required for the selected provider");
+    error.code = "SETUP_API_KEY_REQUIRED";
+    throw error;
+  }
+}
+
 async function runSetup(options) {
   logger.log(chalk.bold("\n  ChainlessChain Setup Wizard\n"));
   logger.log(`  Version: ${VERSION}`);
@@ -102,6 +113,9 @@ async function runSetup(options) {
 
   if (providerInfo.requiresApiKey) {
     apiKey = await askPassword(`Enter ${providerInfo.name} API key:`);
+    // Abort before changing provider/baseUrl so an old provider's credential
+    // can never be paired with and sent to a newly selected endpoint.
+    assertRequiredProviderCredential(providerInfo, apiKey);
   }
 
   if (provider === "custom" || providerInfo.isProxy) {
@@ -143,15 +157,27 @@ async function runSetup(options) {
   }
 
   // Step 7: Save config
-  const config = loadConfig();
-  config.setupCompleted = true;
-  config.completedAt = new Date().toISOString();
-  config.edition = edition;
-  config.llm.provider = provider;
-  config.llm.apiKey = apiKey;
-  config.llm.baseUrl = baseUrl;
-  config.llm.model = model;
-  saveConfig(config);
+  const applySetupValues = (config) => {
+    config.setupCompleted = true;
+    config.completedAt = new Date().toISOString();
+    config.edition = edition;
+    config.llm.provider = provider;
+    config.llm.baseUrl = baseUrl;
+    config.llm.model = model;
+  };
+  if (apiKey) {
+    // The provider settings, keychain write and config pointer switch form one
+    // locked transaction. A failed key write/save leaves the prior config and
+    // prior secret reference active.
+    setSecretConfigValue("llm.apiKey", apiKey, {
+      storage: "auto",
+      configMutator: applySetupValues,
+    });
+  } else {
+    // Preserve any existing secret reference when the selected provider needs
+    // no new key; never clear a usable credential before another write.
+    updateConfigAtomically(applySetupValues);
+  }
   logger.success("Configuration saved");
 
   // Step 8: Docker services

package/src/commands/skill.js

@@ -10,7 +10,6 @@ import chalk from "chalk";
 import ora from "ora";
 import fs from "fs";
 import path from "path";
-import { createSkillProcessBroker } from "../lib/skill-process-broker.js";
 import { logger } from "../lib/logger.js";
 import {
   CLISkillLoader,
@@ -49,6 +48,9 @@ import {
 } from "../lib/skill-loader.js";
 import { getElectronUserDataDir } from "../lib/paths.js";
 import { findProjectRoot } from "../lib/project-detector.js";
+import { loadConfig } from "../lib/config-manager.js";
+import { applyConfigLlmDefaults } from "../lib/llm-config-defaults.js";
+import { BUILT_IN_PROVIDERS } from "../lib/llm-providers.js";
 import {
   generateCliPacks,
   checkForUpdates,
@@ -71,7 +73,7 @@ function canRunOnPlatform(skill) {
   return skill.os.includes(process.platform);
 }
 
-const SKILL_TEMPLATE_MD = (name) => `---
+export const SKILL_TEMPLATE_MD = (name) => `---
 name: ${name}
 display-name: ${name}
 description: Custom skill — edit this description
@@ -80,11 +82,15 @@ category: custom
 tags: [custom]
 user-invocable: true
 handler: handler.js
+isolation: true
 ---
 
 # ${name}
 
-Describe what this skill does and how to use it.
+Describe the task this skill performs. These instructions are authoritative;
+the CLI executes them in an isolated child agent with a host-owned tool
+allow-list. The handler file is an identity marker and is never imported into
+the CLI process.
 
 ## Usage
 
@@ -93,29 +99,151 @@ chainlesschain skill run ${name} "your input"
 \`\`\`
 `;
 
-const SKILL_TEMPLATE_HANDLER = (name) => `/**
- * Handler for ${name} skill
+export const SKILL_TEMPLATE_HANDLER = (name) => `/**
+ * Execution identity marker for ${name}.
+ *
+ * ChainlessChain CLI deliberately never imports this module. Put executable
+ * behavior in SKILL.md instructions and use approved agent tools; a future
+ * restricted worker may consume this metadata without granting process-local
+ * authority.
  */
+export default Object.freeze({
+  skill: "${name}",
+  executionMode: "controlled-agent-tools",
+});
+`;
+
+export function createControlledSkillScaffold(name, targetDir, io = fs) {
+  io.mkdirSync(targetDir, { recursive: true });
+  io.writeFileSync(
+    path.join(targetDir, "SKILL.md"),
+    SKILL_TEMPLATE_MD(name),
+    "utf-8",
+  );
+  io.writeFileSync(
+    path.join(targetDir, "handler.js"),
+    SKILL_TEMPLATE_HANDLER(name),
+    "utf-8",
+  );
+  return { name, targetDir, isolation: true };
+}
 
-const handler = {
-  async init(skill) {
-    // Optional initialization
-  },
+export function createCliSkillReauthorizer(options = {}) {
+  return async (request) => {
+    if (options.assumeYes === true) return { authorized: true };
+    const stdin = options.stdin || process.stdin;
+    const stdout = options.stdout || process.stdout;
+    if (stdin?.isTTY !== true || stdout?.isTTY !== true) return false;
+
+    const confirm =
+      options.confirm || (await import("@inquirer/prompts")).confirm;
+    const skillId = request?.skill?.id || "unknown";
+    const source = request?.skill?.source || "unknown";
+    const digest = String(request?.currentDigest || "").slice(0, 24);
+    const authorized = await confirm({
+      message:
+        `Authorize isolated skill "${skillId}" from ${source} ` +
+        `for this process (${digest || "digest unavailable"})?`,
+      default: false,
+    });
+    return { authorized: authorized === true };
+  };
+}
 
-  async execute(task, context, skill) {
-    const input = task.input || task.params?.input || "";
+export function resolveControlledSkillLlmOptions({
+  config = loadConfig(),
+  env = process.env,
+} = {}) {
+  const resolved = {};
+  // Match the existing command/cowork precedence: an explicit provider from
+  // the environment wins as a complete provider selection; otherwise the
+  // configured llm block supplies provider/model/baseUrl/apiKey.
+  if (!env.LLM_PROVIDER) {
+    applyConfigLlmDefaults(resolved, config?.llm || {});
+  }
+  const provider = resolved.provider || env.LLM_PROVIDER || "ollama";
+  const providerDefinition = BUILT_IN_PROVIDERS[provider];
+  return {
+    ...resolved,
+    provider,
+    model: resolved.model || env.LLM_MODEL || providerDefinition?.models?.[0],
+    baseUrl: resolved.baseUrl || providerDefinition?.baseUrl,
+  };
+}
 
-    // TODO: Implement skill logic
+export async function runControlledSkill(options = {}) {
+  const {
+    name,
+    input = "",
+    cwd = process.cwd(),
+    loader,
+    executeTool = null,
+    llmOptions = null,
+  } = options;
+  if (
+    !loader ||
+    (typeof loader.getResolvedSkills !== "function" &&
+      typeof loader.loadAll !== "function")
+  ) {
+    throw new TypeError("runControlledSkill requires a CLISkillLoader");
+  }
+  const skills =
+    typeof loader.getResolvedSkills === "function"
+      ? loader.getResolvedSkills()
+      : loader.loadAll();
+  let skill = skills.find(
+    (candidate) => candidate.id === name || candidate.dirName === name,
+  );
+  if (!skill) {
+    return { error: `Skill not found: ${name}`, code: "CC_SKILL_NOT_FOUND" };
+  }
+  const executionContext = {
+    loadedBecause: "run_skill",
+    bodyIncluded: false,
+  };
+  if (typeof loader.materializeSkillForExecution === "function") {
+    skill = await loader.materializeSkillForExecution(skill, executionContext);
+  } else if (typeof loader.materializeSkill === "function") {
+    skill = loader.materializeSkill(skill, executionContext);
+  }
+  if (skill.isolation !== true) {
     return {
-      success: true,
-      message: \`${name} executed successfully\`,
-      result: { input },
+      error:
+        `Skill "${skill.id}" is not configured for controlled execution. ` +
+        "Add isolation: true before running it.",
+      code: "CC_SKILL_DIRECT_HANDLER_BLOCKED",
     };
-  },
-};
-
-export default handler;
-`;
+  }
+  if (!canRunOnPlatform(skill)) {
+    return {
+      error: `Skill "${skill.id}" is not supported on ${process.platform}`,
+      code: "CC_SKILL_PLATFORM_UNSUPPORTED",
+    };
+  }
+  const dispatch =
+    executeTool || (await import("../runtime/agent-core.js")).executeTool;
+  const result = await dispatch(
+    "run_skill",
+    { skill_name: skill.id, input: String(input) },
+    {
+      cwd,
+      skillLoader: loader,
+      ...(llmOptions ? { llmOptions: { ...llmOptions } } : {}),
+    },
+  );
+  const nestedFailure = /^\s*Sub-agent failed:/i.test(
+    String(result?.summary || ""),
+  );
+  if (result?.error || nestedFailure) {
+    return {
+      ...result,
+      success: false,
+      code: result?.code || "CC_SKILL_CONTROLLED_RUN_FAILED",
+      error: result?.error || result.summary,
+    };
+  }
+  return result;
+}
 
 export function registerSkillCommand(program) {
   const skill = program
@@ -321,95 +449,46 @@ export function registerSkillCommand(program) {
   // skill run
   skill
     .command("run")
-    .description("Execute a skill")
+    .description("Execute a skill through a controlled agent/tool route")
     .argument("<name>", "Skill name")
     .argument("[input...]", "Input for the skill")
     .option("--json", "Output as JSON")
+    .option("-y, --yes", "Authorize the current isolated skill digest")
     .action(async (name, inputParts, options) => {
-      const skills = loader.loadAll();
-      let s = skills.find((sk) => sk.id === name || sk.dirName === name);
-
-      if (!s) {
-        logger.error(`Skill not found: ${name}`);
-        process.exit(1);
-      }
-
-      if (!s.hasHandler) {
-        logger.error(
-          `Skill "${s.id}" has no handler (documentation only). Cannot execute.`,
-        );
-        process.exit(1);
-      }
-
-      if (!canRunOnPlatform(s)) {
-        logger.error(`Skill "${s.id}" is not supported on ${process.platform}`);
-        process.exit(1);
-      }
-
+      const runLoader = new CLISkillLoader({
+        reauthorizeSkill: createCliSkillReauthorizer({
+          assumeYes: options.yes === true,
+        }),
+      });
+      const llmOptions = resolveControlledSkillLlmOptions();
+      let result;
       try {
-        s = loader.materializeSkill(s, {
-          loadedBecause: "cli_skill_run",
-          bodyIncluded: false,
+        result = await runControlledSkill({
+          name,
+          input: inputParts.join(" "),
+          cwd: process.cwd(),
+          loader: runLoader,
+          llmOptions,
         });
       } catch (error) {
-        logger.error(`Skill "${s.id}" body could not be loaded: ${error.message}`);
-        process.exit(1);
-      }
-
-      const spinner = ora(`Running ${s.displayName}...`).start();
-      const input = inputParts.join(" ");
-
-      try {
-        const handlerPath = path.join(s.skillDir, "handler.js");
-        const imported = await import(
-          `file://${handlerPath.replace(/\\/g, "/")}`
-        );
-        const handler = imported.default || imported;
-
-        if (handler.init) {
-          await handler.init(s);
-        }
-
-        const task = {
-          params: { input },
-          input,
-          action: input,
-        };
-        const context = {
-          projectRoot: process.cwd(),
-          workspacePath: process.cwd(),
-          workspaceRoot: process.cwd(),
-          processBroker: createSkillProcessBroker(s),
+        result = {
+          success: false,
+          code: error.code || "CC_SKILL_CONTROLLED_RUN_FAILED",
+          error: error.message,
         };
+      }
 
-        const result = await handler.execute(task, context, s);
-        spinner.stop();
-
-        if (options.json) {
-          console.log(JSON.stringify(result, null, 2));
-        } else if (result.success) {
-          logger.success(result.message || "Done");
-          if (result.result && typeof result.result === "object") {
-            for (const [key, val] of Object.entries(result.result)) {
-              if (typeof val === "string" && val.length > 200) {
-                logger.log(`  ${chalk.cyan(key)}: ${val.substring(0, 200)}...`);
-              } else {
-                logger.log(`  ${chalk.cyan(key)}: ${JSON.stringify(val)}`);
-              }
-            }
-          }
-        } else {
-          logger.error(
-            result.message || result.error || "Skill execution failed",
-          );
-        }
-      } catch (err) {
-        spinner.fail(`Skill execution failed: ${err.message}`);
-        if (program.opts().verbose) {
-          console.error(err.stack);
+      if (options.json) {
+        console.log(JSON.stringify(result, null, 2));
+      } else if (result?.error) {
+        logger.error(result.error);
+      } else {
+        logger.success(result?.summary || "Skill completed");
+        if (Array.isArray(result?.toolsUsed) && result.toolsUsed.length > 0) {
+          logger.log(chalk.gray(`  tools: ${result.toolsUsed.join(", ")}`));
         }
-        process.exit(1);
       }
+      if (result?.error) process.exitCode = 1;
     });
 
   // skill add — create a custom skill scaffold
@@ -444,17 +523,7 @@ export function registerSkillCommand(program) {
       }
 
       try {
-        fs.mkdirSync(targetDir, { recursive: true });
-        fs.writeFileSync(
-          path.join(targetDir, "SKILL.md"),
-          SKILL_TEMPLATE_MD(name),
-          "utf-8",
-        );
-        fs.writeFileSync(
-          path.join(targetDir, "handler.js"),
-          SKILL_TEMPLATE_HANDLER(name),
-          "utf-8",
-        );
+        createControlledSkillScaffold(name, targetDir);
 
         const scope = options.global ? "global" : "project";
         logger.success(`Created ${scope} skill: ${chalk.cyan(name)}`);
@@ -464,7 +533,9 @@ export function registerSkillCommand(program) {
         logger.log(
           `  ${chalk.gray("SKILL.md")}    — Skill metadata and documentation`,
         );
-        logger.log(`  ${chalk.gray("handler.js")}  — Skill execution logic`);
+        logger.log(
+          `  ${chalk.gray("handler.js")}  — controlled execution identity marker`,
+        );
         logger.log("");
         logger.log(
           `Edit these files, then run: ${chalk.cyan(`chainlesschain skill run ${name} "test input"`)}`,

package/src/commands/status.js

@@ -1,9 +1,7 @@
 import chalk from "chalk";
 import logger from "../lib/logger.js";
-import { collectStatusReport } from "../runtime/diagnostics.js";
-import { getObservabilityRuntime } from "../lib/observability/index.js";
 
-export function collectOtlpStatus(runtime = getObservabilityRuntime()) {
+export function collectOtlpStatus(runtime = null) {
   return (
     runtime?.getStats?.() || {
       enabled: false,
@@ -31,11 +29,29 @@ export function registerStatusCommand(program) {
     .command("status")
     .description("Show status of ChainlessChain app and services")
     .option("--json", "Output as machine-readable JSON")
+    .option("--deep", "Include Docker Compose service inspection")
     .action(async (options) => {
       try {
-        const report = await collectStatusReport();
+        const report = options.deep
+          ? await (
+              await import("../runtime/diagnostics.js")
+            ).collectStatusReport({ deep: true })
+          : await (
+              await import("../runtime/status-diagnostics-lite.js")
+            ).collectQuickStatusReport();
+        let observabilityRuntime = null;
+        if (
+          program.opts().otlpEndpoint ||
+          process.env.OTEL_EXPORTER_OTLP_ENDPOINT ||
+          process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ||
+          process.env.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT
+        ) {
+          observabilityRuntime = (
+            await import("../lib/observability/index.js")
+          ).getObservabilityRuntime();
+        }
         report.observability = {
-          otlp: collectOtlpStatus(),
+          otlp: collectOtlpStatus(observabilityRuntime),
         };
 
         if (options.json) {