chainlesschain 0.162.197 → 0.162.198

package/src/commands/mcp.js

@@ -39,6 +39,13 @@ import {
   checkProjectMcpTrust,
   issueProjectMcpWorkspaceAuthority,
 } from "../lib/project-mcp-trust.js";
+import {
+  consumeMcpStdioExecutionAuthority,
+  MCP_STDIO_LOCAL_CODE_TRUST_REQUIRED_CODE,
+  issueMcpStdioExecutionAuthority,
+  materializeApprovedMcpStdioInvocation,
+} from "../lib/mcp-stdio-execution-authority.js";
+import { prepareMcpStdioExecutableIdentity } from "../lib/mcp-stdio-executable-identity.js";
 import {
   CATALOG as REGISTRY_CATALOG,
   CATEGORIES as REGISTRY_CATEGORIES,
@@ -77,6 +84,32 @@ export function isHeadlessEnv(env = process.env, platform = process.platform) {
 
 // Singleton MCP client for session reuse
 let mcpClient = null;
+const PROJECT_MCP_FILE_TRUST = Symbol("projectMcpFileTrust");
+
+export function authorizeMcpRowForConnect(row, overrides = {}) {
+  const config = { ...row, ...overrides };
+  if (inferTransport(config) !== "stdio") return config;
+  if (row?.[PROJECT_MCP_FILE_TRUST] === false) {
+    const error = new Error(
+      `Project MCP server "${String(row?.name)}" can execute local code; trust the current .mcp.json before connecting`,
+    );
+    error.code = MCP_STDIO_LOCAL_CODE_TRUST_REQUIRED_CODE;
+    throw error;
+  }
+  const approvalKind =
+    row?.configScope === "managed"
+      ? "managed-settings"
+      : row?.configScope === "project"
+        ? "project-config"
+        : "registered-config";
+  config.mcpStdioExecutionAuthority = issueMcpStdioExecutionAuthority({
+    serverName: row.name,
+    config,
+    approvalKind,
+    approvalSource: `${row?.configScope || "user"}:${row?.configSource || "database"}:${row.name}`,
+  });
+  return config;
+}
 
 function commandWorkspaceBinding() {
   return registerHostHooksV2Workspace(projectMcpLocation(process.cwd()).root);
@@ -150,7 +183,7 @@ async function connectForQuery(program, serverName) {
   for (const row of rows) {
     if (!row) continue;
     try {
-      await client.connect(row.name, row);
+      await client.connect(row.name, authorizeMcpRowForConnect(row));
       connected.push(row.name);
     } catch (err) {
       logger.log(
@@ -339,6 +372,7 @@ export function readProjectMcpRows(cwd = process.cwd()) {
         configSource: file,
         projectPath: root,
       };
+      Object.defineProperty(row, PROJECT_MCP_FILE_TRUST, { value: trusted });
       if (trusted && row.headersHelper) {
         row.projectMcpWorkspaceAuthority = issueProjectMcpWorkspaceAuthority({
           file,
@@ -773,6 +807,85 @@ export function registerMcpCommand(program) {
       }
     });
 
+  mcp
+    .command("trust-executable <name>")
+    .description(
+      "Review and trust the current executable and interpreter-entrypoint bytes for one stdio MCP server",
+    )
+    .option(
+      "--scope <scope>",
+      `Configuration scope: ${MCP_CONFIG_SCOPES.join(" | ")}`,
+    )
+    .option("--json", "Output the trusted paths and SHA-256 identities as JSON")
+    .action(async (name, options) => {
+      try {
+        const ctx = await bootstrap({ verbose: program.opts().verbose });
+        if (!ctx.db) throw new Error("Database not available");
+        const configStore = new MCPServerConfig(ctx.db.getDatabase());
+        const scope = options.scope
+          ? normalizeMcpConfigScope(options.scope)
+          : undefined;
+        const rows = await effectiveMcpRows(configStore, { scope });
+        const row = rows.find((entry) => entry.name === name);
+        if (!row) {
+          throw new Error(
+            `${notFoundWithSuggestion(
+              name,
+              rows.map((entry) => entry.name),
+              { noun: "Server" },
+            )}. Use 'mcp add' first.`,
+          );
+        }
+        if (inferTransport(row) !== "stdio") {
+          throw new Error(
+            `MCP server "${name}" does not use the stdio transport`,
+          );
+        }
+
+        const authorized = authorizeMcpRowForConnect(row);
+        const approval = consumeMcpStdioExecutionAuthority(
+          authorized.mcpStdioExecutionAuthority,
+          { serverName: name, config: authorized },
+        );
+        const invocation = materializeApprovedMcpStdioInvocation(approval);
+        const prepared = prepareMcpStdioExecutableIdentity({
+          serverName: name,
+          config: invocation,
+          approval,
+          cwd: process.cwd(),
+          env: process.env,
+          retrust: true,
+        });
+        const result = {
+          name,
+          status: prepared.trustStatus,
+          identityDigest: prepared.identityDigest,
+          command: prepared.identity.command,
+          entrypoints: prepared.identity.entrypoints,
+        };
+        if (options.json) {
+          console.log(JSON.stringify(result, null, 2));
+        } else {
+          logger.log(
+            chalk.green(`Trusted MCP stdio executable identity for "${name}".`),
+          );
+          logger.log(
+            `  ${chalk.gray("Command:")} ${result.command.realPath}  sha256:${result.command.sha256}`,
+          );
+          for (const entrypoint of result.entrypoints) {
+            logger.log(
+              `  ${chalk.gray(`${entrypoint.role}:`)} ${entrypoint.realPath}  sha256:${entrypoint.sha256}`,
+            );
+          }
+        }
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exitCode = 1;
+        await shutdown();
+      }
+    });
+
   // mcp add — add/update a server config
   mcp
     .command("add")
@@ -1207,11 +1320,13 @@ export function registerMcpCommand(program) {
             workspaceBinding: commandWorkspaceBinding(),
           });
           try {
-            const connected = await client.connect(row.name, {
-              ...row,
-              connectTimeoutMs: timeoutMs,
-              requestTimeoutMs: timeoutMs,
-            });
+            const connected = await client.connect(
+              row.name,
+              authorizeMcpRowForConnect(row, {
+                connectTimeoutMs: timeoutMs,
+                requestTimeoutMs: timeoutMs,
+              }),
+            );
             diagnostics.push({
               ...record,
               ok: true,
@@ -1301,7 +1416,10 @@ export function registerMcpCommand(program) {
         const spinner = ora(`Connecting to ${name}...`).start();
         const client = getClient();
 
-        const result = await client.connect(name, serverConfig);
+        const result = await client.connect(
+          name,
+          authorizeMcpRowForConnect(serverConfig),
+        );
         spinner.stop();
 
         if (options.json) {

package/src/commands/serve.js

@@ -41,7 +41,7 @@ export function registerServeCommand(program) {
     )
     .option(
       "--bundle <path>",
-      "Agent bundle directory — applies AGENTS.md, MCP, and approval policy to all sessions",
+      "Agent bundle directory; may execute local MCP commands from mcp.json",
     )
     .action(async (opts) => {
       try {

package/src/commands/session-show.js

@@ -0,0 +1,131 @@
+import chalk from "chalk";
+import { numericOption } from "../lib/cli-numeric.js";
+import { feature } from "../lib/feature-flags.js";
+import { logger } from "../lib/logger.js";
+import { getPrLinks } from "../lib/pr-link-store.js";
+import {
+  getJsonlSessionMetadata,
+  rebuildMessages,
+  resolveSessionId,
+  sessionHasPersistedEvidence,
+} from "../harness/jsonl-session-store.js";
+
+export function registerSessionShowSubcommand(session, program) {
+  session
+    .command("show")
+    .description("Show a session's messages")
+    .argument("<id>", "Session ID (or prefix)")
+    .option("-n, --limit <n>", "Max messages to show")
+    .option("--json", "Output as JSON")
+    .action(async (id, options) => {
+      let ctx = null;
+      let shutdown = null;
+      try {
+        let sess = null;
+
+        const jsonlId = feature("JSONL_SESSION") ? resolveSessionId(id) : null;
+        if (
+          !jsonlId &&
+          feature("JSONL_SESSION") &&
+          sessionHasPersistedEvidence(id)
+        ) {
+          logger.error(
+            `Session ${id} has canonical persistence evidence but no readable transcript.`,
+          );
+          process.exitCode = 1;
+          return;
+        }
+        if (jsonlId) {
+          const metadata = getJsonlSessionMetadata(jsonlId);
+          const messages = rebuildMessages(jsonlId);
+          sess = {
+            id: jsonlId,
+            title: metadata?.title || "Untitled",
+            provider: metadata?.provider || "",
+            model: metadata?.model || "",
+            message_count: messages.length,
+            messages,
+            _store: "jsonl",
+          };
+        }
+
+        // Keep SQLite and the application bootstrap outside the canonical
+        // JSONL read path. Legacy sessions still retain the original fallback.
+        if (!sess) {
+          const runtime = await import("../runtime/bootstrap.js");
+          const sessionManager = await import("../lib/session-manager.js");
+          shutdown = runtime.shutdown;
+          ctx = await runtime.bootstrap({ verbose: program.opts().verbose });
+          if (ctx?.db) {
+            sess = sessionManager.getSession(ctx.db.getDatabase(), id);
+          }
+        }
+
+        if (!sess) {
+          logger.error(`Session not found: ${id}`);
+          process.exitCode = 1;
+          return;
+        }
+
+        try {
+          const prLinks = getPrLinks(sess.id);
+          if (prLinks.length > 0) sess.prLinks = prLinks;
+        } catch {
+          // PR decoration is cosmetic.
+        }
+
+        if (options.json) {
+          console.log(JSON.stringify(sess, null, 2));
+          return;
+        }
+
+        logger.log(chalk.bold(sess.title));
+        logger.log(
+          chalk.gray(
+            `ID: ${sess.id}  Provider: ${sess.provider}  Model: ${sess.model}  Messages: ${sess.message_count}`,
+          ),
+        );
+        if (sess.prLinks) {
+          for (const pr of sess.prLinks) {
+            logger.log(
+              chalk.magenta(
+                `PR: #${pr.number}${pr.state ? ` ${pr.state}` : ""}${pr.url ? `  ${pr.url}` : ""}`,
+              ),
+            );
+          }
+        }
+        logger.log("");
+
+        let messages = sess.messages;
+        if (options.limit) {
+          messages = messages.slice(
+            -numericOption(options.limit, {
+              name: "--limit",
+              integer: true,
+              min: 1,
+            }),
+          );
+        }
+
+        for (const message of messages) {
+          if (message.role === "system") continue;
+          const label =
+            message.role === "user" ? chalk.green("you> ") : chalk.blue("ai> ");
+          logger.log(`${label}${(message.content || "").substring(0, 500)}`);
+          logger.log("");
+        }
+      } catch (error) {
+        logger.error(`Failed: ${error.message}`);
+        process.exitCode = 1;
+      } finally {
+        if (ctx && shutdown) await shutdown();
+      }
+    });
+}
+
+export function registerSessionShowCommand(program) {
+  const session = program
+    .command("session")
+    .description("Conversation session management");
+  registerSessionShowSubcommand(session, program);
+}

package/src/commands/session.js

@@ -4,7 +4,6 @@
  */
 
 import fs from "fs";
-import { numericOption } from "../lib/cli-numeric.js";
 import path from "path";
 import chalk from "chalk";
 import { logger } from "../lib/logger.js";
@@ -52,8 +51,8 @@ import {
   rebuildMessages,
   getJsonlSessionMetadata,
   resolveSessionId,
+  sessionHasPersistedEvidence,
   deleteJsonlSession,
-  readEvents,
   migrateLegacySessions,
   migrateLegacySessionsBatch,
   validateJsonlSession,
@@ -66,6 +65,7 @@ import {
 } from "../lib/workflow-state-reader.js";
 import { executionBroker } from "../lib/process-execution-broker/index.js";
 import { registerSessionMcpRecoveryCommands } from "./session-mcp-recovery.js";
+import { registerSessionShowSubcommand } from "./session-show.js";
 
 export const _deps = {
   execFileSync: (...args) => executionBroker.execFileSync(...args),
@@ -492,106 +492,7 @@ export function registerSessionCommand(program) {
       }
     });
 
-  // session show
-  session
-    .command("show")
-    .description("Show a session's messages")
-    .argument("<id>", "Session ID (or prefix)")
-    .option("-n, --limit <n>", "Max messages to show")
-    .option("--json", "Output as JSON")
-    .action(async (id, options) => {
-      let ctx = null;
-      try {
-        let sess = null;
-
-        // Try JSONL first if enabled
-        const jsonlId = feature("JSONL_SESSION") ? resolveSessionId(id) : null;
-        if (jsonlId) {
-          const metadata = getJsonlSessionMetadata(jsonlId);
-          const msgs = rebuildMessages(jsonlId);
-          sess = {
-            id: jsonlId,
-            title: metadata?.title || "Untitled",
-            provider: metadata?.provider || "",
-            model: metadata?.model || "",
-            message_count: msgs.length,
-            messages: msgs,
-            _store: "jsonl",
-          };
-        }
-
-        // Version-0 DB adapter is loaded only when the canonical transcript is
-        // absent, keeping the JSONL hot path independent from native SQLite.
-        if (!sess) {
-          ctx = await bootstrap({ verbose: program.opts().verbose });
-        }
-        if (!sess && ctx?.db) {
-          const db = ctx.db.getDatabase();
-          sess = getSession(db, id);
-        }
-
-        if (!sess) {
-          logger.error(`Session not found: ${id}`);
-          process.exitCode = 1;
-          return;
-        }
-
-        // PR/session linking: surface PRs this session created/touched.
-        try {
-          const { getPrLinks } = await import("../lib/pr-link-ledger.js");
-          const prLinks = getPrLinks(sess.id);
-          if (prLinks.length > 0) sess.prLinks = prLinks;
-        } catch {
-          // PR decoration is cosmetic
-        }
-
-        if (options.json) {
-          console.log(JSON.stringify(sess, null, 2));
-        } else {
-          logger.log(chalk.bold(sess.title));
-          logger.log(
-            chalk.gray(
-              `ID: ${sess.id}  Provider: ${sess.provider}  Model: ${sess.model}  Messages: ${sess.message_count}`,
-            ),
-          );
-          if (sess.prLinks) {
-            for (const pr of sess.prLinks) {
-              logger.log(
-                chalk.magenta(
-                  `PR: #${pr.number}${pr.state ? ` ${pr.state}` : ""}${pr.url ? `  ${pr.url}` : ""}`,
-                ),
-              );
-            }
-          }
-          logger.log("");
-
-          let messages = sess.messages;
-          if (options.limit) {
-            messages = messages.slice(
-              -numericOption(options.limit, {
-                name: "--limit",
-                integer: true,
-                min: 1,
-              }),
-            );
-          }
-
-          for (const msg of messages) {
-            if (msg.role === "system") continue;
-            const label =
-              msg.role === "user" ? chalk.green("you> ") : chalk.blue("ai> ");
-            const content = (msg.content || "").substring(0, 500);
-            logger.log(`${label}${content}`);
-            logger.log("");
-          }
-        }
-      } catch (err) {
-        logger.error(`Failed: ${err.message}`);
-        process.exitCode = 1;
-      } finally {
-        if (ctx) await shutdown();
-      }
-    });
+  registerSessionShowSubcommand(session, program);
 
   // session pr-status — PR/CI monitor + controlled auto-merge decision (P1-4)
   // for a session's linked PR. Offline-testable via --checks-file; otherwise a
@@ -714,12 +615,36 @@ export function registerSessionCommand(program) {
 
         // Try JSONL first
         const jsonlId = feature("JSONL_SESSION") ? resolveSessionId(id) : null;
+        if (
+          !jsonlId &&
+          feature("JSONL_SESSION") &&
+          sessionHasPersistedEvidence(id)
+        ) {
+          logger.error(
+            `Session ${id} has canonical persistence evidence but no readable transcript.`,
+          );
+          logger.error(
+            "Refusing legacy fallback. Inspect or explicitly delete the damaged JSONL session before reusing its id.",
+          );
+          process.exitCode = 1;
+          return;
+        }
         if (jsonlId) {
           // Tamper gate: a broken hash chain means the transcript was edited
           // outside the store — never silently rebuild it as trusted context.
           const { verifySession } =
             await import("../harness/jsonl-session-store.js");
           const trust = verifySession(jsonlId);
+          if (["missing", "conflict"].includes(trust.status)) {
+            logger.error(
+              `Session ${jsonlId} transcript is unavailable: ${trust.reason}`,
+            );
+            logger.error(
+              "Refusing to resume without canonical history. Inspect or explicitly delete the damaged session before reusing its id.",
+            );
+            process.exitCode = 1;
+            return;
+          }
           if (trust.status === "tampered") {
             if (!options.allowTampered) {
               logger.error(
@@ -812,6 +737,11 @@ export function registerSessionCommand(program) {
         const store = await import("../harness/jsonl-session-store.js");
         const sid =
           id === "last" ? store.getLastSessionId() : store.resolveSessionId(id);
+        if (!sid && id !== "last" && store.sessionHasPersistedEvidence(id)) {
+          throw new Error(
+            `Session ${id} has canonical persistence evidence but no readable transcript`,
+          );
+        }
         if (sid) {
           const { renderAgentSessionMarkdown } =
             await import("../lib/agent-session-export.js");
@@ -991,7 +921,8 @@ export function registerSessionCommand(program) {
     .action(async (id, options) => {
       let ctx = null;
       try {
-        const jsonlId = resolveSessionId(id);
+        const jsonlId =
+          resolveSessionId(id) || (sessionHasPersistedEvidence(id) ? id : null);
         let db = null;
         try {
           ctx = await bootstrap({ verbose: program.opts().verbose });
@@ -1055,6 +986,11 @@ export function registerSessionCommand(program) {
         ).trim();
         if (!normalized) throw new Error("A non-empty title is required");
         const jsonlId = resolveSessionId(id);
+        if (!jsonlId && sessionHasPersistedEvidence(id)) {
+          throw new Error(
+            `Session ${id} has canonical persistence evidence but no readable transcript`,
+          );
+        }
         let result;
         if (jsonlId) {
           const { renameSession } =
@@ -1273,10 +1209,18 @@ export function registerSessionCommand(program) {
           }
         }
 
-        const anyTampered = (Array.isArray(result) ? result : [result]).some(
-          (item) => item.status === "tampered",
+        const hasVerificationFailure = (
+          Array.isArray(result) ? result : [result]
+        ).some((item) =>
+          [
+            "tampered",
+            "missing",
+            "conflict",
+            "not-found",
+            "invalid-id",
+          ].includes(item.status),
         );
-        if (anyTampered) process.exit(1);
+        if (hasVerificationFailure) process.exit(1);
       } catch (err) {
         logger.error(`Failed: ${err.message}`);
         process.exit(1);