chainlesschain 0.162.197 → 0.162.200

package/src/lib/learning/skill-improver.js

@@ -14,6 +14,7 @@
 import fs from "fs";
 import { firstBalancedJson } from "../json-schema-output.js";
 import path from "path";
+import { assertSkillFileSize, resolveSkillLimits } from "../skill-budget.js";
 
 // ── _deps for test injection ────────────────────────────
 const _deps = { fs, path };
@@ -187,13 +188,14 @@ export class SkillImprover {
    * @param {import("better-sqlite3").Database} db
    * @param {function} llmChat — async (messages) => string
    * @param {import("./trajectory-store.js").TrajectoryStore} trajectoryStore
-   * @param {{skillsDir?:string}} [config]
+   * @param {{skillsDir?:string, limits?:object}} [config]
    */
   constructor(db, llmChat, trajectoryStore, config = {}) {
     this.db = db;
     this.llmChat = llmChat;
     this.trajectoryStore = trajectoryStore;
     this.skillsDir = config.skillsDir || null;
+    this.skillLimits = resolveSkillLimits(config.limits);
   }
 
   /**
@@ -392,7 +394,19 @@ export class SkillImprover {
     if (!this.skillsDir) return null;
     const skillFile = _deps.path.join(this.skillsDir, skillName, "SKILL.md");
     try {
-      return await _deps.fs.promises.readFile(skillFile, "utf-8");
+      if (typeof _deps.fs.promises.lstat === "function") {
+        const stat = await _deps.fs.promises.lstat(skillFile);
+        if (stat.isSymbolicLink() || !stat.isFile()) return null;
+        assertSkillFileSize("SKILL.md", stat.size, this.skillLimits);
+      }
+      const content = await _deps.fs.promises.readFile(skillFile, "utf-8");
+      if (typeof content !== "string") return null;
+      assertSkillFileSize(
+        "SKILL.md",
+        Buffer.byteLength(content, "utf8"),
+        this.skillLimits,
+      );
+      return content;
     } catch {
       return null;
     }
@@ -405,6 +419,11 @@ export class SkillImprover {
    */
   async _writeSkill(skillName, content) {
     if (!this.skillsDir) return;
+    assertSkillFileSize(
+      "SKILL.md",
+      Buffer.byteLength(String(content), "utf8"),
+      this.skillLimits,
+    );
     const skillDir = _deps.path.join(this.skillsDir, skillName);
     const skillFile = _deps.path.join(skillDir, "SKILL.md");
     await _deps.fs.promises.mkdir(skillDir, { recursive: true });

package/src/lib/mcp-call-ledger-store.js

@@ -10,6 +10,7 @@
 import { isProxy } from "node:util/types";
 import {
   appendAuthorityEvent as storeAppendAuthorityEvent,
+  appendAuthorityEventWithVerifiedProjection as storeAppendAuthorityEventWithVerifiedProjection,
   readVerifiedEvents as storeReadVerifiedEvents,
   readVerifiedProjection as storeReadVerifiedProjection,
 } from "../harness/jsonl-session-store.js";
@@ -514,6 +515,53 @@ export function computeMcpRecoveryDigest(recovery = {}) {
   });
 }
 
+/**
+ * Stable host generation fence. Ordinary transcript messages and this host's
+ * own started/settled records do not rotate it; adjudication, replay denies or
+ * integrity incidents do. A host must reload a newly verified projection to
+ * adopt a changed fence.
+ */
+export function computeMcpRecoveryFenceDigest(recovery = {}) {
+  const incidents = Array.isArray(recovery.incidents) ? recovery.incidents : [];
+  const adjudications = Array.isArray(recovery.adjudications)
+    ? recovery.adjudications
+    : [];
+  const replayDenied = Array.isArray(recovery.replayDenied)
+    ? recovery.replayDenied
+    : [];
+  return sha256PayloadDigest({
+    schemaVersion: 1,
+    sessionId: recovery.sessionId || null,
+    incidents: stableSorted(
+      incidents.map((entry) => ({
+        code: entry?.code || null,
+        ledgerId: entry?.ledgerId || null,
+      })),
+    ),
+    adjudications: stableSorted(
+      adjudications.map((entry) => ({
+        requestId: entry?.requestId || null,
+        ledgerId: entry?.ledgerId || null,
+        decision: entry?.decision || null,
+        authority: entry?.authority || null,
+        confirmation: entry?.confirmation || null,
+        reasonDigest: entry?.reasonDigest || null,
+      })),
+    ),
+    replayDenied: stableSorted(
+      replayDenied.map((entry) => ({
+        ledgerId: entry?.ledgerId || null,
+        serverName: entry?.serverName || null,
+        toolName: entry?.toolName || null,
+        inputBytes: Number.isSafeInteger(entry?.inputBytes)
+          ? entry.inputBytes
+          : null,
+        replayDigest: entry?.replayDigest || null,
+      })),
+    ),
+  });
+}
+
 function immutableRecordMatches(started, settled) {
   return IMMUTABLE_RECORD_FIELDS.every(
     (field) =>
@@ -634,6 +682,18 @@ export function snapshotMcpLedgerRecoveryProjection(sessionId, recovery) {
 /** Create the async sink accepted by `McpCallLedger`. */
 export function createSessionMcpLedgerSink(sessionId, options = {}) {
   const appendEvent = options.appendEvent || storeAppendAuthorityEvent;
+  const appendFencedEvent =
+    options.appendFencedEvent ||
+    storeAppendAuthorityEventWithVerifiedProjection;
+  let recoveryFenceDigest = Object.prototype.hasOwnProperty.call(
+    options,
+    "recovery",
+  )
+    ? computeMcpRecoveryFenceDigest({
+        ...(options.recovery || {}),
+        sessionId,
+      })
+    : null;
   if (
     !isCanonicalProtocolText(
       sessionId,
@@ -645,8 +705,11 @@ export function createSessionMcpLedgerSink(sessionId, options = {}) {
   if (typeof appendEvent !== "function") {
     throw new TypeError("MCP ledger session sink requires appendEvent");
   }
+  if (typeof appendFencedEvent !== "function") {
+    throw new TypeError("MCP ledger session sink requires appendFencedEvent");
+  }
 
-  return async (record, metadata = {}) => {
+  const sink = async (record, metadata = {}) => {
     const canonical = canonicalRecord(record);
     if (!canonical) {
       throw new McpCallLedgerStoreError(
@@ -678,16 +741,57 @@ export function createSessionMcpLedgerSink(sessionId, options = {}) {
       );
     }
     try {
-      const written = await appendEvent(sessionId, MCP_CALL_LEDGER_EVENT, {
+      const eventData = {
         schemaVersion: MCP_CALL_LEDGER_EVENT_SCHEMA_VERSION,
         phase,
         record: canonical,
-      });
+      };
+      const written = recoveryFenceDigest
+        ? await appendFencedEvent(sessionId, MCP_CALL_LEDGER_EVENT, eventData, {
+            createProjection: () => {
+              const reducer = createMcpLedgerEventReducer({
+                sessionId,
+                verified: true,
+              });
+              let acceptedCount = 0;
+              return Object.freeze({
+                accept: (event) => {
+                  acceptedCount += 1;
+                  return reducer.accept(event);
+                },
+                finish: (authority) => {
+                  const recovery = reducer.finish();
+                  assertMcpVerifiedProjectionAuthority(authority, {
+                    acceptedCount,
+                    headHash: recovery.headHash,
+                  });
+                  return recovery;
+                },
+              });
+            },
+            validateProjection: (recovery) => {
+              const currentFence = computeMcpRecoveryFenceDigest(recovery);
+              if (currentFence !== recoveryFenceDigest) {
+                throw new McpCallLedgerStoreError(
+                  "CC_MCP_LEDGER_HOST_FENCE_STALE",
+                  "MCP host recovery authority changed; restart or resume before executing MCP calls",
+                  { sessionId, ledgerId: canonical.ledgerId },
+                );
+              }
+            },
+          })
+        : await appendEvent(sessionId, MCP_CALL_LEDGER_EVENT, eventData);
       if (written === false) {
         throw new Error("canonical session store rejected the event");
       }
       return true;
     } catch (cause) {
+      if (
+        cause instanceof McpCallLedgerStoreError &&
+        cause.code === "CC_MCP_LEDGER_HOST_FENCE_STALE"
+      ) {
+        throw cause;
+      }
       throw new McpCallLedgerStoreError(
         "CC_MCP_LEDGER_EVENT_PERSIST_FAILED",
         `MCP ledger event persistence failed for ${sessionId}: ${cause.message}`,
@@ -695,6 +799,15 @@ export function createSessionMcpLedgerSink(sessionId, options = {}) {
       );
     }
   };
+  sink.replaceRecoveryFence = (recovery) => {
+    recoveryFenceDigest = computeMcpRecoveryFenceDigest({
+      ...(recovery || {}),
+      sessionId,
+    });
+    return recoveryFenceDigest;
+  };
+  sink.getRecoveryFenceDigest = () => recoveryFenceDigest;
+  return sink;
 }
 
 /**

package/src/lib/mcp-call-ledger.js

@@ -1,5 +1,9 @@
 import { createHash, randomUUID as nodeRandomUUID } from "node:crypto";
 import { isProxy } from "node:util/types";
+import {
+  admitMcpToolResult,
+  resolveMcpToolResultLimits,
+} from "./mcp-tool-result.js";
 
 export const MCP_CALL_LEDGER_SCHEMA_VERSION = 1;
 
@@ -413,16 +417,41 @@ function frozenSnapshot(record) {
   return Object.freeze(snapshot);
 }
 
+function safeOwnDataProperty(value, property) {
+  if (!value || (typeof value !== "object" && typeof value !== "function")) {
+    return undefined;
+  }
+  try {
+    if (isProxy(value)) return undefined;
+    const descriptor = Object.getOwnPropertyDescriptor(value, property);
+    return descriptor && Object.hasOwn(descriptor, "value")
+      ? descriptor.value
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 function summarizeError(error) {
-  const message = String(error?.message || error || "unknown error");
+  const errorMessage = safeOwnDataProperty(error, "message");
+  const message =
+    typeof error === "string" && error
+      ? error
+      : typeof errorMessage === "string" && errorMessage
+        ? errorMessage
+        : "unknown error";
+  const errorName = safeOwnDataProperty(error, "name");
+  const errorCode = safeOwnDataProperty(error, "code");
   return Object.freeze({
     name: safeIdentifier(
-      error?.name,
+      typeof errorName === "string" ? errorName : null,
       "Error",
       MCP_CALL_LEDGER_PROTOCOL_LIMITS.errorName,
     ),
     code: safeIdentifier(
-      error?.code,
+      typeof errorCode === "string" || Number.isSafeInteger(errorCode)
+        ? errorCode
+        : null,
       null,
       MCP_CALL_LEDGER_PROTOCOL_LIMITS.errorCode,
     ),
@@ -431,19 +460,22 @@ function summarizeError(error) {
 }
 
 function normalizeStatus(outcome = {}) {
-  if (outcome.status) {
-    const status = String(outcome.status).toLowerCase();
+  const explicitStatus = safeOwnDataProperty(outcome, "status");
+  if (typeof explicitStatus === "string" && explicitStatus) {
+    const status = explicitStatus.toLowerCase();
     if (!TERMINAL_STATUSES.has(status)) {
-      throw new TypeError(
-        `Invalid MCP ledger terminal status "${outcome.status}"`,
-      );
+      throw new TypeError(`Invalid MCP ledger terminal status "${status}"`);
     }
     return status;
   }
-  if (outcome.cancelled === true || outcome.error?.name === "AbortError") {
+  const error = safeOwnDataProperty(outcome, "error");
+  if (
+    safeOwnDataProperty(outcome, "cancelled") === true ||
+    safeOwnDataProperty(error, "name") === "AbortError"
+  ) {
     return McpCallStatus.CANCELLED;
   }
-  return outcome.error ? McpCallStatus.FAILED : McpCallStatus.COMPLETED;
+  return error ? McpCallStatus.FAILED : McpCallStatus.COMPLETED;
 }
 
 function resolveSinkWriter(sink) {
@@ -492,6 +524,14 @@ export class McpCallLedger {
     this._randomUUID = options.randomUUID || nodeRandomUUID;
     this._sequence = 0;
     this._records = new Map();
+    const toolResultLimits = resolveMcpToolResultLimits(
+      options.toolResultConfig,
+    );
+    this._toolResultConfig = Object.freeze({
+      maxToolResultBytes: toolResultLimits.maxBytes,
+      maxToolResultDepth: toolResultLimits.maxDepth,
+      maxToolResultNodes: toolResultLimits.maxNodes,
+    });
 
     const requested = options.prewriteFailurePolicy || {};
     for (const [effect, action] of Object.entries(requested)) {
@@ -670,12 +710,17 @@ export class McpCallLedger {
       Object.prototype.hasOwnProperty.call(outcome, "result");
     const output = hasOutput
       ? summarizeMcpPayload(
-          Object.prototype.hasOwnProperty.call(outcome, "output")
-            ? outcome.output
-            : outcome.result,
+          admitMcpToolResult(
+            null,
+            Object.prototype.hasOwnProperty.call(outcome, "output")
+              ? outcome.output
+              : outcome.result,
+            this._toolResultConfig,
+          ).result,
         )
       : null;
-    const errorSummary = outcome.error ? summarizeError(outcome.error) : null;
+    const outcomeError = safeOwnDataProperty(outcome, "error");
+    const errorSummary = outcomeError ? summarizeError(outcomeError) : null;
     const settlementPersistence =
       current.prewritePersistence === "failed-open"
         ? "skipped-no-prewrite"

package/src/lib/mcp-client.js

@@ -21,6 +21,7 @@ export {
   redactMcpUrl,
   isLikelyConnectionError,
   isMcpAuthenticationError,
+  isMcpRpcError,
   isTransientMcpError,
   _deps,
 } from "../harness/mcp-client.js";

package/src/lib/mcp-stdio-environment.js

@@ -0,0 +1,48 @@
+/**
+ * Environment policy shared by MCP stdio materialization and runtime launch.
+ * These variables can cause a language runtime or native loader to execute
+ * bytes that are outside the approved executable/package identity.
+ */
+
+const CODE_INJECTION_ENV_KEYS = new Set([
+  "CLASSPATH",
+  "DOTNET_ADDITIONAL_DEPS",
+  "DOTNET_ROOT",
+  "JAVA_TOOL_OPTIONS",
+  "LD_AUDIT",
+  "LD_LIBRARY_PATH",
+  "LD_PRELOAD",
+  "NODE_OPTIONS",
+  "NODE_PATH",
+  "NPM_CONFIG_NODE_OPTIONS",
+  "PERL5LIB",
+  "PERL5OPT",
+  "PYTHONHOME",
+  "PYTHONPATH",
+  "RUBYLIB",
+  "RUBYOPT",
+  "_JAVA_OPTIONS",
+]);
+
+export function isMcpStdioCodeInjectionEnvironmentKey(key) {
+  const normalized = String(key || "").toUpperCase();
+  return (
+    CODE_INJECTION_ENV_KEYS.has(normalized) ||
+    normalized.startsWith("DYLD_") ||
+    normalized.startsWith("COMPLUS_") ||
+    normalized.startsWith("CORECLR_")
+  );
+}
+
+export function sanitizeMcpStdioHostEnvironment(env) {
+  const safe = {};
+  for (const [key, value] of Object.entries(env || {})) {
+    if (
+      !isMcpStdioCodeInjectionEnvironmentKey(key) &&
+      typeof value === "string"
+    ) {
+      safe[key] = value;
+    }
+  }
+  return safe;
+}