chainlesschain 0.162.95 → 0.162.96

package/src/gateways/telegram/telegram-formatter.js

@@ -47,17 +47,20 @@ export function toTelegramMarkdown(markdown) {
   // Escape special characters in text
   result = escapeMarkdownV2(result);
 
-  // Restore code blocks and inline code (unescaped)
+  // Restore code blocks and inline code (unescaped). Use a replacement FUNCTION
+  // so `$`-sequences inside the code (e.g. `$&`, `$1`, `$$` in sed/regex/shell)
+  // are inserted literally — a string replacement would interpret them as
+  // String.replace patterns and corrupt the code.
   for (let i = codeBlocks.length - 1; i >= 0; i--) {
     result = result.replace(
       `__CODE_BLOCK_${i}__`.replace(ESCAPE_CHARS, "\\$1"),
-      codeBlocks[i],
+      () => codeBlocks[i],
     );
   }
   for (let i = inlineCode.length - 1; i >= 0; i--) {
     result = result.replace(
       `__INLINE_CODE_${i}__`.replace(ESCAPE_CHARS, "\\$1"),
-      inlineCode[i],
+      () => inlineCode[i],
     );
   }
 

package/src/gateways/ws/ws-server.js

@@ -12,6 +12,7 @@
 
 import { EventEmitter } from "node:events";
 import { spawn } from "node:child_process";
+import { createHash, timingSafeEqual } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { WebSocketServer } from "ws";
@@ -525,10 +526,27 @@ export class ChainlessChainWSServer extends EventEmitter {
     return handleLlmChat(this, id, ws, message);
   }
 
+  /**
+   * Constant-time check of a client-supplied token against the configured one.
+   * A plain `===` leaks timing that a network client could use to recover the
+   * token byte-by-byte; hash both to a fixed length and compare in constant
+   * time. Preserves the original semantics: no configured token matches only an
+   * absent token (the auto-authenticated path).
+   * @private
+   */
+  _tokenMatches(provided) {
+    const expected = this.token;
+    if (expected == null) return provided == null;
+    if (typeof provided !== "string") return false;
+    const a = createHash("sha256").update(provided).digest();
+    const b = createHash("sha256").update(String(expected)).digest();
+    return timingSafeEqual(a, b);
+  }
+
   /** @private */
   _handleAuth(clientId, ws, message) {
     const { id, token } = message;
-    const success = token === this.token;
+    const success = this._tokenMatches(token);
     const client = this.clients.get(clientId);
 
     if (success && client) {

package/src/harness/plugin-manager.js

@@ -352,10 +352,20 @@ export function installPluginSkills(db, pluginName, pluginPath, skills) {
   const installed = [];
 
   for (const skill of skills) {
+    if (!skill || typeof skill.name !== "string" || typeof skill.path !== "string") {
+      continue;
+    }
     const srcDir = path.resolve(pluginPath, skill.path);
+    // Reject manifest entries that escape the plugin (read) or the marketplace
+    // (arbitrary file WRITE) via `../` — a malicious plugin could otherwise drop
+    // files anywhere (e.g. overwrite ~/.bashrc) during install.
+    if (!_isWithin(pluginPath, srcDir)) continue;
     if (!fs.existsSync(srcDir)) continue;
 
     const destDir = path.join(marketplaceDir, skill.name);
+    if (!_isWithin(marketplaceDir, destDir) || path.resolve(destDir) === path.resolve(marketplaceDir)) {
+      continue;
+    }
     fs.mkdirSync(destDir, { recursive: true });
 
     // Copy skill files
@@ -419,6 +429,16 @@ export function getPluginSkills(db, pluginName) {
 /**
  * Recursively copy a directory
  */
+/**
+ * True when `child` resolves to `parent` or a path inside it. Used to keep a
+ * (semi-trusted) plugin manifest from escaping its sandbox via `../` in
+ * skill.path / skill.name.
+ */
+function _isWithin(parent, child) {
+  const rel = path.relative(path.resolve(parent), path.resolve(child));
+  return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+
 function _copyDirSync(src, dest) {
   fs.mkdirSync(dest, { recursive: true });
   const entries = fs.readdirSync(src, { withFileTypes: true });

package/src/harness/worktree-isolator.js

@@ -10,11 +10,17 @@
 import { execSync } from "node:child_process";
 import { existsSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
-import { isGitRepo, gitExec } from "../lib/git-integration.js";
+import {
+  isGitRepo,
+  gitExec,
+  assertSafeGitRef,
+} from "../lib/git-integration.js";
 
 const WORKTREE_DIR = ".worktrees";
 
 export function createWorktree(repoDir, branchName, baseBranch) {
+  assertSafeGitRef(branchName, "branch name");
+  if (baseBranch) assertSafeGitRef(baseBranch, "base branch");
   if (!isGitRepo(repoDir)) {
     throw new Error("Not a git repository");
   }
@@ -157,6 +163,8 @@ export function cleanupAgentWorktrees(repoDir) {
 }
 
 export function diffWorktree(repoDir, branchName, options = {}) {
+  assertSafeGitRef(branchName, "branch name");
+  if (options.baseBranch) assertSafeGitRef(options.baseBranch, "base branch");
   const base = options.baseBranch || "HEAD";
   const filePath = options.filePath || null;
   const fileArg = filePath ? ` -- "${filePath}"` : "";
@@ -204,6 +212,8 @@ export function diffWorktree(repoDir, branchName, options = {}) {
 }
 
 export function mergeWorktree(repoDir, branchName, options = {}) {
+  assertSafeGitRef(branchName, "branch name");
+  if (options.baseBranch) assertSafeGitRef(options.baseBranch, "base branch");
   const strategy = options.strategy || "merge";
   const deleteBranch = options.deleteBranch !== false;
 
@@ -285,6 +295,8 @@ export function mergeWorktree(repoDir, branchName, options = {}) {
 }
 
 export function previewWorktreeMerge(repoDir, branchName, options = {}) {
+  assertSafeGitRef(branchName, "branch name");
+  if (options.baseBranch) assertSafeGitRef(options.baseBranch, "base branch");
   const strategy = options.strategy || "merge";
   const baseBranch = _resolveBaseBranchForMerge(repoDir, options.baseBranch);
   const worktree = _findWorktreeByBranch(repoDir, branchName);
@@ -374,6 +386,8 @@ export function applyWorktreeAutomationCandidate(
   branchName,
   options = {},
 ) {
+  assertSafeGitRef(branchName, "branch name");
+  if (options.baseBranch) assertSafeGitRef(options.baseBranch, "base branch");
   const filePath = options.filePath || null;
   const candidateId = options.candidateId || null;
   const conflictType = options.conflictType || null;
@@ -473,6 +487,8 @@ export function applyWorktreeAutomationCandidate(
 }
 
 export function worktreeLog(repoDir, branchName, baseBranch = "HEAD") {
+  assertSafeGitRef(branchName, "branch name");
+  assertSafeGitRef(baseBranch, "base branch");
   try {
     const output = gitExec(
       `log ${baseBranch}..${branchName} --pretty=format:"%h|%s|%ci"`,

package/src/lib/__tests__/model-deprecation.test.js

@@ -0,0 +1,194 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import {
+  DEPRECATED_MODELS,
+  checkModelDeprecation,
+  formatModelDeprecationWarning,
+  maybeWarnDeprecatedModel,
+  _warned,
+} from "../model-deprecation.js";
+
+describe("checkModelDeprecation", () => {
+  it("flags an exact retired snapshot", () => {
+    const info = checkModelDeprecation("claude-3-opus-20240229");
+    expect(info).toBeTruthy();
+    expect(info.id).toBe("claude-3-opus-20240229");
+    expect(info.state).toBe("retired");
+    expect(info.replacement).toMatch(/claude-opus-4-8/);
+  });
+
+  it("flags retired Claude 3.5 / 3.7 families by prefix (the common ones)", () => {
+    expect(checkModelDeprecation("claude-3-5-sonnet-20240620")).toBeTruthy();
+    expect(checkModelDeprecation("claude-3-5-sonnet-20241022")).toBeTruthy();
+    expect(checkModelDeprecation("claude-3-5-haiku-20241022")).toBeTruthy();
+    expect(checkModelDeprecation("claude-3-7-sonnet-20250219")).toBeTruthy();
+    expect(checkModelDeprecation("claude-3-haiku-20240307")).toBeTruthy();
+  });
+
+  it("flags the retired ORIGINAL Claude 4 snapshots (exact dated id)", () => {
+    expect(checkModelDeprecation("claude-opus-4-20250514").state).toBe(
+      "retired",
+    );
+    expect(checkModelDeprecation("claude-sonnet-4-20250514").state).toBe(
+      "retired",
+    );
+  });
+
+  it("flags deprecated-but-live Claude Opus 4.1 with state=deprecated", () => {
+    const info = checkModelDeprecation("claude-opus-4-1-20250805");
+    expect(info).toBeTruthy();
+    expect(info.state).toBe("deprecated");
+  });
+
+  it("prefix-matches a retired family (claude-2 → claude-2.1)", () => {
+    expect(checkModelDeprecation("claude-2.1")).toBeTruthy();
+    expect(checkModelDeprecation("claude-2.0")).toBeTruthy();
+    expect(checkModelDeprecation("claude-instant-1.2")).toBeTruthy();
+  });
+
+  it("flags retired OpenAI snapshots", () => {
+    expect(checkModelDeprecation("gpt-4-0314")).toBeTruthy();
+    expect(checkModelDeprecation("gpt-4-32k-0613")).toBeTruthy();
+    expect(checkModelDeprecation("gpt-3.5-turbo-0301")).toBeTruthy();
+    expect(checkModelDeprecation("text-davinci-003")).toBeTruthy();
+  });
+
+  it("is case-insensitive and trims", () => {
+    expect(checkModelDeprecation("  GPT-4-0314  ")).toBeTruthy();
+    expect(checkModelDeprecation("Claude-2.1")).toBeTruthy();
+  });
+
+  it("CRITICAL: does NOT flag ACTIVE Claude 4 models (prefix-collision guard)", () => {
+    // These share a prefix with the retired 4.x snapshots — the entries use
+    // exact dated ids precisely so these stay silent.
+    expect(checkModelDeprecation("claude-opus-4-8")).toBeNull();
+    expect(checkModelDeprecation("claude-opus-4-7")).toBeNull();
+    expect(checkModelDeprecation("claude-opus-4-6")).toBeNull();
+    expect(checkModelDeprecation("claude-opus-4-5-20251101")).toBeNull();
+    expect(checkModelDeprecation("claude-sonnet-4-6")).toBeNull();
+    expect(checkModelDeprecation("claude-sonnet-4-5-20250929")).toBeNull();
+    expect(checkModelDeprecation("claude-haiku-4-5-20251001")).toBeNull();
+    expect(checkModelDeprecation("claude-haiku-4-5")).toBeNull();
+  });
+
+  it("does NOT flag other current GA / provider models", () => {
+    expect(checkModelDeprecation("gpt-4o")).toBeNull();
+    expect(checkModelDeprecation("gpt-4o-mini")).toBeNull();
+    expect(checkModelDeprecation("gpt-5")).toBeNull();
+    expect(checkModelDeprecation("gpt-4-turbo")).toBeNull();
+    // provider-specific ids (volcengine/doubao/ollama) never match
+    expect(checkModelDeprecation("doubao-seed-2-0-lite-260215")).toBeNull();
+    expect(checkModelDeprecation("qwen2.5-coder:7b")).toBeNull();
+  });
+
+  it("handles empty / non-string input", () => {
+    expect(checkModelDeprecation("")).toBeNull();
+    expect(checkModelDeprecation(null)).toBeNull();
+    expect(checkModelDeprecation(undefined)).toBeNull();
+    expect(checkModelDeprecation(42)).toBeNull();
+  });
+
+  it("every list entry is internally consistent and self-matches", () => {
+    for (const e of DEPRECATED_MODELS) {
+      expect(typeof e.id).toBe("string");
+      expect(e.id.length).toBeGreaterThan(0);
+      expect(["retired", "deprecated"]).toContain(e.state);
+      expect(typeof e.reason).toBe("string");
+      expect(typeof e.replacement).toBe("string");
+      expect(checkModelDeprecation(e.id)).toBeTruthy();
+      // the recommended replacement must itself never be flagged as retired
+      const firstReplacement = e.replacement.split(/\s+or\s+|\s+/)[0];
+      expect(checkModelDeprecation(firstReplacement)).toBeNull();
+    }
+  });
+});
+
+describe("formatModelDeprecationWarning", () => {
+  it("uses 'has been retired' for retired models", () => {
+    const info = checkModelDeprecation("claude-3-5-sonnet-20241022");
+    const line = formatModelDeprecationWarning(info);
+    expect(line).toMatch(/claude-3-5-sonnet-20241022/);
+    expect(line).toMatch(/has been retired/);
+    expect(line).toMatch(/claude-sonnet-4-6/);
+    expect(line).toMatch(/CC_MODEL_NOTICE=0/);
+  });
+
+  it("uses 'is deprecated' for deprecated-but-live models", () => {
+    const info = checkModelDeprecation("claude-opus-4-1-20250805");
+    const line = formatModelDeprecationWarning(info);
+    expect(line).toMatch(/is deprecated/);
+    expect(line).not.toMatch(/has been retired/);
+  });
+});
+
+describe("maybeWarnDeprecatedModel", () => {
+  let lines;
+  let print;
+  beforeEach(() => {
+    _warned.clear();
+    lines = [];
+    print = (l) => lines.push(l);
+  });
+
+  it("warns once for a deprecated model", () => {
+    const r = maybeWarnDeprecatedModel({ model: "claude-2.1", env: {}, print });
+    expect(r.warned).toBe(true);
+    expect(r.info.id).toBe("claude-2.1");
+    expect(lines).toHaveLength(1);
+    expect(lines[0]).toMatch(/claude-2\.1/);
+  });
+
+  it("warns for a retired Claude 3.5 Sonnet (the common stale id)", () => {
+    const r = maybeWarnDeprecatedModel({
+      model: "claude-3-5-sonnet-20241022",
+      env: {},
+      print,
+    });
+    expect(r.warned).toBe(true);
+    expect(lines[0]).toMatch(/has been retired/);
+  });
+
+  it("does not repeat the same model within a process", () => {
+    maybeWarnDeprecatedModel({ model: "gpt-4-0314", env: {}, print });
+    const r = maybeWarnDeprecatedModel({ model: "gpt-4-0314", env: {}, print });
+    expect(r.warned).toBe(false);
+    expect(r.info).toBeTruthy(); // still reports the match, just doesn't re-print
+    expect(lines).toHaveLength(1);
+  });
+
+  it("stays silent for a current model", () => {
+    const r = maybeWarnDeprecatedModel({
+      model: "claude-opus-4-8",
+      env: {},
+      print,
+    });
+    expect(r.warned).toBe(false);
+    expect(r.info).toBeNull();
+    expect(lines).toHaveLength(0);
+  });
+
+  it("honors CC_MODEL_NOTICE=0", () => {
+    const r = maybeWarnDeprecatedModel({
+      model: "claude-2.1",
+      env: { CC_MODEL_NOTICE: "0" },
+      print,
+    });
+    expect(r.warned).toBe(false);
+    expect(lines).toHaveLength(0);
+  });
+
+  it("fail-open on a throwing print", () => {
+    const r = maybeWarnDeprecatedModel({
+      model: "claude-2.1",
+      env: {},
+      print: () => {
+        throw new Error("boom");
+      },
+    });
+    expect(r.warned).toBe(false); // swallowed, no throw
+  });
+
+  it("no-ops on missing model", () => {
+    expect(maybeWarnDeprecatedModel({ env: {}, print }).warned).toBe(false);
+    expect(lines).toHaveLength(0);
+  });
+});

package/src/lib/a2a-protocol.js

@@ -5,6 +5,20 @@
  * capability negotiation, and peer discovery.
  */
 
+// Safe JSON-array parse for values read back from the DB (capabilities / skills /
+// history / artifacts are stored as JSON strings). Written via JSON.stringify so
+// normally valid, but a corrupted or externally-edited DB must not crash agent
+// discovery / task lifecycle with an uncaught SyntaxError — fall back to [].
+function parseJsonArray(value) {
+  if (value == null || value === "") return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+
 // ─── Task statuses ───────────────────────────────────────────────
 export const TASK_STATUS = {
   SUBMITTED: "submitted",
@@ -165,8 +179,8 @@ export function discoverAgents(db, filter = {}) {
   // Parse JSON fields
   rows = rows.map((r) => ({
     ...r,
-    capabilities: JSON.parse(r.capabilities || "[]"),
-    skills: JSON.parse(r.skills || "[]"),
+    capabilities: parseJsonArray(r.capabilities),
+    skills: parseJsonArray(r.skills),
   }));
 
   if (filter.capability) {
@@ -220,7 +234,7 @@ export function completeTask(db, taskId, output, artifacts = []) {
 
   const now = nowISO();
   const task = _getTask(db, taskId);
-  const history = JSON.parse(task.history || "[]");
+  const history = parseJsonArray(task.history);
   history.push({ status: TASK_STATUS.COMPLETED, timestamp: now });
 
   db.prepare(
@@ -249,7 +263,7 @@ export function failTask(db, taskId, error) {
 
   const now = nowISO();
   const task = _getTask(db, taskId);
-  const history = JSON.parse(task.history || "[]");
+  const history = parseJsonArray(task.history);
   history.push({ status: TASK_STATUS.FAILED, timestamp: now });
 
   db.prepare(
@@ -276,8 +290,8 @@ export function getTaskStatus(db, taskId) {
   const task = _getTask(db, taskId);
   return {
     ...task,
-    history: JSON.parse(task.history || "[]"),
-    artifacts: JSON.parse(task.artifacts || "[]"),
+    history: parseJsonArray(task.history),
+    artifacts: parseJsonArray(task.artifacts),
   };
 }
 
@@ -305,7 +319,7 @@ export function negotiateCapability(db, agentId, requiredCapabilities) {
     .get(agentId);
   if (!card) throw new Error(`Agent not found: ${agentId}`);
 
-  const agentCaps = JSON.parse(card.capabilities || "[]");
+  const agentCaps = parseJsonArray(card.capabilities);
   const supported = requiredCapabilities.filter((c) => agentCaps.includes(c));
   const missing = requiredCapabilities.filter((c) => !agentCaps.includes(c));
 
@@ -329,8 +343,8 @@ export function listPeers(db) {
     .all();
   return rows.map((r) => ({
     ...r,
-    capabilities: JSON.parse(r.capabilities || "[]"),
-    skills: JSON.parse(r.skills || "[]"),
+    capabilities: parseJsonArray(r.capabilities),
+    skills: parseJsonArray(r.skills),
   }));
 }
 

package/src/lib/agent-core.js

@@ -1,8 +1,4 @@
-/**
- * @deprecated Re-export shim; canonical impl is `../runtime/agent-core.js`
- * (CLI Runtime Convergence, Phase 6b). Import from there in new code.
- */
-
+/** @deprecated Thin re-export shim; canonical impl is `../runtime/agent-core.js` (CLI Runtime Convergence, Phase 6b) — import from there in new code. */
 export {
   AGENT_TOOLS,
   AGENT_TOOL_REGISTRY,
@@ -33,6 +29,7 @@ export {
   _streamErrorDisposition,
   _isRetryableStreamError,
   _retryStreamingChat,
+  _iterateStreamWithStall,
   _toAnthropicMessages,
   _anthropicThinkingParams,
   _normalizeAnthropicResponse,

package/src/lib/audit-mtc.js

@@ -22,6 +22,7 @@ import path from "node:path";
 import crypto from "node:crypto";
 import { ed25519 as nobleEd25519 } from "@noble/curves/ed25519.js";
 import mtcLib from "@chainlesschain/core-mtc";
+import { withFileLock } from "./with-file-lock.js";
 
 const { sha256, jcs, encodeHashStr, ed25519, assembleBatch } = mtcLib;
 
@@ -70,6 +71,30 @@ function ensureDirs(dir) {
   }
 }
 
+/**
+ * Atomically write a UTF-8 file (temp sibling + rename). Used for the config
+ * and per-event staging records: a crash mid-write would truncate config.json
+ * or leave a partial event that closeBatch silently drops as malformed. Temp
+ * names end in `.tmp` (never `.json`), so a hard-crash leftover is ignored by
+ * listStagingEvents' `.json` filter. NOTE: the issuer key (flag "wx" exclusive
+ * create) and closeBatch (whole tmp-dir rename) have their own atomicity and
+ * are intentionally left untouched.
+ */
+function atomicWriteFileSync(filePath, data) {
+  const tmp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    fs.writeFileSync(tmp, data, "utf-8");
+    fs.renameSync(tmp, filePath);
+  } catch (err) {
+    try {
+      if (fs.existsSync(tmp)) fs.unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
 // ─────────────────────────────────────────────────────────────────────
 // Config
 // ─────────────────────────────────────────────────────────────────────
@@ -107,7 +132,7 @@ export function saveAuditMtcConfig(dir, patch) {
   if (typeof merged.issuer !== "string" || !merged.issuer) {
     throw new TypeError("config.issuer must be non-empty string");
   }
-  fs.writeFileSync(configPath(dir), JSON.stringify(merged, null, 2), "utf-8");
+  atomicWriteFileSync(configPath(dir), JSON.stringify(merged, null, 2));
   return merged;
 }
 
@@ -227,7 +252,7 @@ export function emitEvent(dir, body, opts = {}) {
   };
 
   const filePath = path.join(stagingDir(dir), `${eventId}.json`);
-  fs.writeFileSync(filePath, JSON.stringify(record, null, 2), "utf-8");
+  atomicWriteFileSync(filePath, JSON.stringify(record, null, 2));
   return { eventId, path: filePath, record };
 }
 
@@ -293,6 +318,19 @@ function listStagingEvents(dir) {
  * @param {string} [opts.issuer]    - override config.issuer
  */
 export function closeBatch(dir, opts = {}) {
+  // Serialize the whole staging-scan → batch-write → staging-cleanup section
+  // across processes. Without it, two concurrent closes (e.g. overlapping
+  // `cc audit mtc reconcile` runs) both scan the same staging events, allocate
+  // the same batch id, and the defensive rmSync(finalDir) lets the second
+  // silently overwrite the first's audit batch. Best-effort lock (never hangs);
+  // generous timeout since the section includes Merkle assembly + signing.
+  ensureDirs(dir);
+  return withFileLock(batchesDir(dir), () => _closeBatchImpl(dir, opts), {
+    timeoutMs: 15000,
+  });
+}
+
+function _closeBatchImpl(dir, opts = {}) {
   ensureDirs(dir);
   const cfg = loadAuditMtcConfig(dir);
   const events = listStagingEvents(dir);