chainlesschain 0.162.198 → 0.162.200

package/src/runtime/agent-core.js

@@ -1813,6 +1813,11 @@ export async function executeTool(name, args, context = {}) {
     typeof context.externalToolDescriptors === "object"
       ? context.externalToolDescriptors[name] || null
       : null;
+  const localToolExecutor =
+    context.externalToolExecutors &&
+    typeof context.externalToolExecutors === "object"
+      ? context.externalToolExecutors[name] || null
+      : null;
   const runtimeDescriptor =
     getRuntimeToolDescriptor(name) || localToolDescriptor;
   const admission = context.toolAdmission;
@@ -2086,6 +2091,69 @@ export async function executeTool(name, args, context = {}) {
     ruleAllowed = true;
   }
 
+  // MCP annotations are peer-provided hints, never execution authority. A
+  // server that claims readOnlyHint=true therefore still needs a request-level
+  // approval unless the host independently authorized this exact tool as a
+  // trusted read. An explicit settings allow can suppress the default prompt,
+  // but it cannot suppress a host-owned `ask`/requiresConfirmation decision.
+  // Plan mode has already applied its stricter hard ceiling above, so this gate
+  // covers normal interactive/Auto execution without creating a Plan escape.
+  if (localToolExecutor?.kind === "mcp") {
+    const mcpEffectContract = mcpLedgerEffectContract(
+      localToolDescriptor,
+      hostToolPolicy,
+    );
+    const trustedHostRead =
+      mcpEffectContract.effect === McpEffect.READ &&
+      mcpEffectContract.trusted === true;
+    const settingsAskWasConfirmed =
+      settingsVerdict.decision === "ask" && ruleAllowed;
+    const hostRequiresConfirmation =
+      !settingsAskWasConfirmed &&
+      (hostToolPolicy?.requiresConfirmation === true ||
+        hostToolPolicy?.decision === "ask");
+    const defaultRequiresConfirmation = !trustedHostRead && !ruleAllowed;
+
+    if (hostRequiresConfirmation || defaultRequiresConfirmation) {
+      const approved = await requestInteractivePermission(
+        name,
+        args,
+        context,
+        cwd,
+        {
+          tool: name,
+          args,
+          rule: null,
+          reason: hostRequiresConfirmation
+            ? "host policy requires confirmation for this MCP tool"
+            : `MCP effect is ${mcpEffectContract.effect} and lacks a trusted host read authorization`,
+          source: hostRequiresConfirmation
+            ? "host-managed MCP policy"
+            : "MCP effect contract",
+          mcpEffect: mcpEffectContract.effect,
+          mcpTrusted: mcpEffectContract.trusted === true,
+        },
+      );
+      if (!approved) {
+        return {
+          error: `[MCP Permission] Tool "${name}" requires confirmation because its effect is ${mcpEffectContract.effect} and it does not have an applicable trusted host read authorization — denied.`,
+          policy: {
+            decision: "ask",
+            via: hostRequiresConfirmation
+              ? "host-mcp-policy"
+              : "mcp-effect-contract",
+            code: "CC_MCP_EFFECT_CONFIRMATION_REQUIRED",
+            effect: mcpEffectContract.effect,
+            trusted: mcpEffectContract.trusted === true,
+          },
+        };
+      }
+      // The approval is scoped to this request and also satisfies the later
+      // generic external-tool/ApprovalGate prompt for the same invocation.
+      ruleAllowed = true;
+    }
+  }
+
   // Sensitive-file write guard (Claude-Code 2.1.160 parity): shell startup
   // files / PowerShell profiles / git+husky hooks execute code on the user's
   // next shell or commit — even otherwise-permitted edit flows confirm first.
@@ -3319,11 +3387,18 @@ function mcpLedgerEffectContract(descriptor, hostPolicy) {
   )
     ? descriptorContract.declaredEffect
     : "unknown";
+  // Host authority may raise an unknown/read declaration to a stricter effect,
+  // but it may never downgrade the conservative peer risk floor. In
+  // particular, an accidentally stale host `read` policy cannot turn a newly
+  // declared write/destructive tool into a trusted read.
   const effect =
-    authorizedEffect ||
-    (declaredEffect === "destructive" || declaredEffect === "write"
-      ? declaredEffect
-      : "unknown");
+    declaredEffect === "destructive" || authorizedEffect === "destructive"
+      ? "destructive"
+      : declaredEffect === "write" || authorizedEffect === "write"
+        ? "write"
+        : declaredEffect === "unknown"
+          ? "unknown"
+          : authorizedEffect || "unknown";
   const annotations = descriptorContract.annotations || {};
 
   return {
@@ -3341,7 +3416,15 @@ function mcpLedgerEffectContract(descriptor, hostPolicy) {
         : null,
     trusted:
       authorizedEffect != null &&
-      (hostContract.trusted === true || hostPolicy?.sourceTrusted === true),
+      (hostContract.trusted === true || hostPolicy?.sourceTrusted === true) &&
+      // Trust is valid only when the host authorization is at least as strict
+      // as the merged effect. A stale host `read` classification cannot lend
+      // trust to a server that now declares write/destructive behavior.
+      authorizedEffect === effect &&
+      // Trusted-read execution/parallelism requires the intersection promised
+      // by the roadmap: a server read declaration plus host authorization.
+      // An unmarked tool stays untrusted even when a host policy predicts read.
+      (effect !== "read" || declaredEffect === "read"),
     source:
       hostContract.provenance ||
       descriptorContract.provenance ||

package/src/runtime/cleanup-deadline.js

@@ -0,0 +1,143 @@
+import { performance } from "node:perf_hooks";
+
+const HOST_CLEANUP_DEADLINE_MS = 10_000;
+const SAFE_ERROR_CODE = /^[A-Z][A-Z0-9_]{0,63}$/;
+
+function projectedErrorCode(error) {
+  if (!error) return null;
+  return typeof error.code === "string" && SAFE_ERROR_CODE.test(error.code)
+    ? error.code
+    : "CC_CLEANUP_STEP_FAILED";
+}
+
+export function normalizeCleanupDeadlineMs(value) {
+  return Number.isFinite(value) &&
+    value > 0 &&
+    value <= HOST_CLEANUP_DEADLINE_MS
+    ? Math.max(1, Math.floor(value))
+    : HOST_CLEANUP_DEADLINE_MS;
+}
+
+export function cleanupDeadlineError(report) {
+  const error = new Error(
+    `CLI cleanup exceeded the host deadline of ${report.timeoutMs} ms`,
+  );
+  error.code = "CC_CLEANUP_DEADLINE_EXCEEDED";
+  error.isCleanupDeadlineFailure = true;
+  error.timeoutMs = report.timeoutMs;
+  error.timedOutSteps = report.steps
+    .filter((step) => step.status === "timeout")
+    .map((step) => step.name);
+  error.cleanupReport = report;
+  return error;
+}
+
+/**
+ * One host-owned absolute deadline shared by a cleanup sequence. Operations
+ * are invoked in order. If an operation consumes the remaining budget, later
+ * disposers are still invoked (and observed) but are not awaited, so one
+ * uncooperative adapter cannot prevent exhaustive teardown from starting.
+ */
+export function createCleanupDeadline(
+  { timeoutMs, label = "cli-cleanup" } = {},
+  deps = {},
+) {
+  // A wall-clock adjustment must never extend teardown past the host ceiling.
+  const now = deps.now || (() => performance.now());
+  const setTimer = deps.setTimeout || setTimeout;
+  const clearTimer = deps.clearTimeout || clearTimeout;
+  const normalizedTimeoutMs = normalizeCleanupDeadlineMs(timeoutMs);
+  let startedAt = null;
+  let deadlineAt = null;
+  let exhausted = false;
+  const steps = [];
+
+  const ensureStarted = () => {
+    if (startedAt !== null) return;
+    startedAt = now();
+    deadlineAt = startedAt + normalizedTimeoutMs;
+  };
+
+  const record = (name, status, stepStartedAt, error = null) => {
+    steps.push(
+      Object.freeze({
+        name,
+        status,
+        durationMs: Math.max(0, now() - stepStartedAt),
+        errorCode: projectedErrorCode(error),
+      }),
+    );
+  };
+
+  return {
+    async run(name, operation) {
+      if (typeof name !== "string" || name.length === 0) {
+        throw new TypeError("cleanup step name is required");
+      }
+      if (typeof operation !== "function") {
+        record(name, "skipped", now());
+        return { status: "skipped" };
+      }
+      ensureStarted();
+      const stepStartedAt = now();
+      let promise;
+      try {
+        promise = Promise.resolve(operation());
+      } catch (error) {
+        record(name, "error", stepStartedAt, error);
+        return { status: "error", error };
+      }
+      // Always observe a late rejection after a timeout.
+      promise.catch(() => {});
+      const remainingMs = Math.max(0, deadlineAt - now());
+      if (exhausted || remainingMs === 0) {
+        exhausted = true;
+        record(name, "timeout", stepStartedAt);
+        return { status: "timeout" };
+      }
+
+      let timer = null;
+      const timeout = new Promise((resolve) => {
+        timer = setTimer(() => resolve({ timeout: true }), remainingMs);
+      });
+      const settled = await Promise.race([
+        promise.then(
+          (value) => ({ value }),
+          (error) => ({ error }),
+        ),
+        timeout,
+      ]);
+      if (timer !== null) clearTimer(timer);
+      if (settled?.timeout) {
+        // A platform timer can fire fractionally before performance.now()
+        // reaches deadlineAt. Latch exhaustion so later disposers are still
+        // invoked but never regain a sliver of cleanup budget.
+        exhausted = true;
+        record(name, "timeout", stepStartedAt);
+        return { status: "timeout" };
+      }
+      if (settled?.error) {
+        record(name, "error", stepStartedAt, settled.error);
+        return { status: "error", error: settled.error };
+      }
+      record(name, "completed", stepStartedAt);
+      return { status: "completed", value: settled.value };
+    },
+    report() {
+      const finishedAt = now();
+      const timedOut = steps.some((step) => step.status === "timeout");
+      return Object.freeze({
+        label,
+        timeoutMs: normalizedTimeoutMs,
+        startedAt,
+        finishedAt,
+        elapsedMs: startedAt === null ? 0 : Math.max(0, finishedAt - startedAt),
+        timedOut,
+        completed: !timedOut,
+        steps: Object.freeze([...steps]),
+      });
+    },
+  };
+}
+
+export const MAX_CLI_CLEANUP_DEADLINE_MS = HOST_CLEANUP_DEADLINE_MS;