chainlesschain 0.162.95 → 0.162.97

package/src/lib/evomap-governance.js

@@ -305,8 +305,8 @@ export function createGovernanceProposalV2(db, options = {}) {
     throw new Error(`Unknown proposal type: ${proposalType}`);
   }
 
-  const quorumValue = typeof quorum === "number" ? quorum : 3;
-  const thresholdValue = typeof threshold === "number" ? threshold : 0.5;
+  const quorumValue = Number.isFinite(quorum) ? quorum : 3;
+  const thresholdValue = Number.isFinite(threshold) ? threshold : 0.5;
   if (quorumValue < 1) throw new Error("Quorum must be >= 1");
   if (thresholdValue <= 0 || thresholdValue > 1) {
     throw new Error("Threshold must be in (0, 1]");
@@ -370,7 +370,7 @@ export function castVoteV2(db, options = {}) {
   if (!Object.values(VOTE_DIRECTION).includes(direction)) {
     throw new Error(`Unknown vote direction: ${direction}`);
   }
-  const weightValue = typeof weight === "number" ? weight : 1;
+  const weightValue = Number.isFinite(weight) ? weight : 1;
   if (weightValue <= 0) throw new Error("Vote weight must be positive");
 
   if (direction === VOTE_DIRECTION.FOR) {
@@ -456,7 +456,7 @@ export function cancelProposal(db, proposalId) {
 }
 
 export function expireProposalsV2(db, now) {
-  const cutoff = typeof now === "number" ? now : Date.now();
+  const cutoff = Number.isFinite(now) ? now : Date.now();
   const expired = [];
   for (const p of _proposals.values()) {
     if (p.status === PROPOSAL_STATUS_V2.ACTIVE) {

package/src/lib/evomap-manager.js

@@ -14,6 +14,53 @@ export const _deps = {
   path,
 };
 
+/**
+ * Atomically write a UTF-8 file via _deps.fs. A gene's gene.json / content.md
+ * are persistent store state; a crash mid-write truncates them and getGene's
+ * JSON.parse then throws. Temp sibling + rename (atomic within a filesystem).
+ * Graceful-degrade to a direct write when the injected fs has no renameSync
+ * (partial test mocks); the real fs always has it, so production is atomic.
+ */
+function _atomicWriteFile(filePath, data) {
+  const fsx = _deps.fs;
+  if (typeof fsx.renameSync !== "function") {
+    fsx.writeFileSync(filePath, data, "utf-8");
+    return;
+  }
+  const tmp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    fsx.writeFileSync(tmp, data, "utf-8");
+    fsx.renameSync(tmp, filePath);
+  } catch (err) {
+    try {
+      if (fsx.existsSync(tmp) && fsx.unlinkSync) fsx.unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
+/**
+ * A gene id is interpolated into a filesystem path (genesDir/<id>/...). Gene ids
+ * arrive from downloaded/installed genes (an external hub / MCP response), so a
+ * malicious `id` like "../../.ssh/authorized_keys" or "C:\\Windows\\..." would
+ * escape genesDir and read/overwrite/delete arbitrary files. Restrict it to a
+ * single safe path segment (no separators, no traversal, no drive/NUL).
+ */
+function _isSafeGeneId(id) {
+  return (
+    typeof id === "string" &&
+    id.length > 0 &&
+    id !== "." &&
+    id !== ".." &&
+    !id.includes("/") &&
+    !id.includes("\\") &&
+    !id.includes(":") &&
+    !id.includes("\0")
+  );
+}
+
 export class EvoMapManager {
   /**
    * @param {object} options
@@ -71,6 +118,9 @@ export class EvoMapManager {
   saveGene(gene, content) {
     this.initialize();
     if (!gene || !gene.id) throw new Error("Gene ID required");
+    if (!_isSafeGeneId(gene.id)) {
+      throw new Error(`Unsafe gene id (path traversal): ${gene.id}`);
+    }
 
     const geneDir = _deps.path.join(this.genesDir, gene.id);
     if (!_deps.fs.existsSync(geneDir)) {
@@ -78,19 +128,14 @@ export class EvoMapManager {
     }
 
     // Save metadata
-    _deps.fs.writeFileSync(
+    _atomicWriteFile(
       _deps.path.join(geneDir, "gene.json"),
       JSON.stringify(gene, null, 2),
-      "utf-8",
     );
 
     // Save content
     if (content) {
-      _deps.fs.writeFileSync(
-        _deps.path.join(geneDir, "content.md"),
-        content,
-        "utf-8",
-      );
+      _atomicWriteFile(_deps.path.join(geneDir, "content.md"), content);
     }
 
     // Register in DB
@@ -170,6 +215,7 @@ export class EvoMapManager {
    */
   getGene(geneId) {
     this.initialize();
+    if (!_isSafeGeneId(geneId)) return null;
     const geneDir = _deps.path.join(this.genesDir, geneId);
 
     if (!_deps.fs.existsSync(geneDir)) return null;
@@ -192,6 +238,7 @@ export class EvoMapManager {
    */
   removeGene(geneId) {
     this.initialize();
+    if (!_isSafeGeneId(geneId)) return { removed: false };
     const geneDir = _deps.path.join(this.genesDir, geneId);
 
     if (_deps.fs.existsSync(geneDir)) {

package/src/lib/fatal-handler.js

@@ -0,0 +1,48 @@
+/**
+ * Centralized friendly-error boundary for the CLI entrypoint.
+ *
+ * An uncaught error thrown from a command action (malformed --json, a failed DB
+ * op) — or, crucially, one that escapes into an async event handler / detached
+ * task / third-party lib AFTER the top-level parse — otherwise surfaces as a raw
+ * stack trace via Node's default unhandledRejection/uncaughtException, which on
+ * modern Node terminates the process. Route all of those through one place that
+ * prints a clean `error: <message>` (full stack under --verbose or
+ * CC_DEBUG/DEBUG) and exits non-zero.
+ *
+ * Pure-ish: process bindings are injectable so this is unit-testable.
+ */
+
+export function reportFatal(
+  err,
+  {
+    stderr = process.stderr,
+    exit = process.exit,
+    argv = process.argv,
+    env = process.env,
+  } = {},
+) {
+  const verbose =
+    argv.includes("--verbose") || Boolean(env.CC_DEBUG) || Boolean(env.DEBUG);
+  if (verbose && err && err.stack) {
+    stderr.write(`${err.stack}\n`);
+  } else {
+    const msg = err && err.message ? err.message : String(err);
+    stderr.write(`error: ${msg}\n`);
+  }
+  exit(1);
+}
+
+/**
+ * Install process-level safety nets that funnel unhandled rejections and
+ * uncaught exceptions through `report`. Node terminates on these by default, so
+ * this only swaps the ugly default stack for the friendly boundary — it is not
+ * a behavior change (still exits non-zero).
+ */
+export function installGlobalErrorHandlers(proc = process, report = reportFatal) {
+  proc.on("unhandledRejection", (reason) =>
+    report(reason instanceof Error ? reason : new Error(String(reason))),
+  );
+  proc.on("uncaughtException", (err) =>
+    report(err instanceof Error ? err : new Error(String(err))),
+  );
+}

package/src/lib/file-checkpoint.js

@@ -80,6 +80,27 @@ function newId() {
   return `cp-${Date.now()}-${rand}`;
 }
 
+/**
+ * A checkpoint id is interpolated into filesystem paths (root/<id>.json and the
+ * blob dir root/<id>). The id comes from CLI args (`cc checkpoint show|delete
+ * <id>`), so an id like "../../etc/passwd" would read outside the checkpoint
+ * store, and "../../important" passed to delete would rmSync outside it. The git
+ * engine guards this via sanitizeSession(); mirror it for the copy fallback by
+ * restricting the id to a single safe path segment.
+ */
+function isSafeCheckpointId(id) {
+  return (
+    typeof id === "string" &&
+    id.length > 0 &&
+    id !== "." &&
+    id !== ".." &&
+    !id.includes("/") &&
+    !id.includes("\\") &&
+    !id.includes(":") &&
+    !id.includes("\0")
+  );
+}
+
 /**
  * Recursively collect regular files under an absolute path, honoring SKIP_DIRS
  * and a running maxFiles budget. Symlinks are not followed.
@@ -146,6 +167,9 @@ export function createCheckpoint(paths, opts = {}) {
   const uniqueAbs = [...new Set(absFiles)];
 
   const id = opts.id || newId();
+  if (!isSafeCheckpointId(id)) {
+    throw new Error(`Unsafe checkpoint id (path traversal): ${id}`);
+  }
   const blobDir = path.join(root, id);
   ensureDir(blobDir);
 
@@ -181,6 +205,7 @@ export function createCheckpoint(paths, opts = {}) {
 
 /** Load a checkpoint manifest by id, or null. */
 export function getCheckpoint(id, opts = {}) {
+  if (!isSafeCheckpointId(id)) return null;
   const root = opts.root || defaultRoot();
   const file = path.join(root, `${id}.json`);
   if (!fs.existsSync(file)) return null;
@@ -310,6 +335,7 @@ export function restoreCheckpoint(id, opts = {}) {
 
 /** Delete a checkpoint (manifest + blobs). Returns true if it existed. */
 export function deleteCheckpoint(id, opts = {}) {
+  if (!isSafeCheckpointId(id)) return false;
   const root = opts.root || defaultRoot();
   const file = path.join(root, `${id}.json`);
   const blobDir = path.join(root, id);

package/src/lib/git-integration.js

@@ -13,6 +13,34 @@ export function isGitRepo(dir) {
   return existsSync(join(dir, ".git"));
 }
 
+/**
+ * Reject a git ref (branch / base / tag) that could break out of a
+ * shell-interpolated `git` command. gitExec interpolates its args into a shell
+ * string, so a ref like `x$(rm -rf ~)`, a backtick, or `--upload-pack=evil`
+ * would otherwise execute or inject a flag (double-quoting does NOT stop `$()`
+ * / backticks). Legit refs are branch/tag names — alphanumerics plus `. _ / -`;
+ * `HEAD` and `origin/main` pass. Throws on anything else. Exported for reuse +
+ * tests; callers validate caller/agent-supplied refs before interpolation.
+ *
+ * @param {string} ref
+ * @param {string} [label="git ref"]
+ */
+export function assertSafeGitRef(ref, label = "git ref") {
+  if (typeof ref !== "string" || ref.length === 0) {
+    throw new Error(`Invalid ${label}: expected a non-empty string`);
+  }
+  if (
+    !/^[A-Za-z0-9._/-]+$/.test(ref) || // only ref-safe chars (no space/shell metachars)
+    ref.startsWith("-") || // block flag injection (e.g. --upload-pack=…)
+    ref.includes("..") || // forbidden in refnames; also blocks range tricks
+    ref.includes("//") ||
+    ref.endsWith("/") ||
+    ref.endsWith(".lock")
+  ) {
+    throw new Error(`Unsafe ${label}: ${JSON.stringify(ref)}`);
+  }
+}
+
 /**
  * Run a git command and return stdout.
  */

package/src/lib/goal-store.js

@@ -19,6 +19,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { getHomeDir } from "./paths.js";
+import { withFileLock } from "./with-file-lock.js";
 
 /** Valid goal lifecycle states. `active` goals are the ones injected. */
 export const GOAL_STATUS = Object.freeze({
@@ -38,6 +39,28 @@ function ensureDir(dir) {
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
 }
 
+/**
+ * Write a goal file atomically: a crash mid-write must not truncate/corrupt an
+ * existing goal (an unparseable goal file is silently dropped by getGoal's catch
+ * → the user loses that goal). Temp sibling + rename (atomic within a
+ * filesystem). Temp names end in `.tmp` (never `.json`), so a hard-crash
+ * leftover is ignored by listGoals.
+ */
+function atomicWriteFileSync(filePath, data) {
+  const tmp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    fs.writeFileSync(tmp, data, "utf-8");
+    fs.renameSync(tmp, filePath);
+  } catch (err) {
+    try {
+      if (fs.existsSync(tmp)) fs.unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
 function newId(prefix) {
   // Date.now/random are fine here (plain CLI lib, not a resumable workflow).
   const rand = Math.random().toString(36).slice(2, 8);
@@ -98,7 +121,7 @@ export function createGoal(input = {}, opts = {}) {
     updatedAt: nowIso(),
   };
   ensureDir(root);
-  fs.writeFileSync(goalFile(root, id), JSON.stringify(goal, null, 2), "utf-8");
+  atomicWriteFileSync(goalFile(root, id), JSON.stringify(goal, null, 2));
   return goal;
 }
 
@@ -137,11 +160,7 @@ function saveGoal(goal, opts = {}) {
   const root = opts.root || defaultRoot();
   ensureDir(root);
   goal.updatedAt = nowIso();
-  fs.writeFileSync(
-    goalFile(root, goal.id),
-    JSON.stringify(goal, null, 2),
-    "utf-8",
-  );
+  atomicWriteFileSync(goalFile(root, goal.id), JSON.stringify(goal, null, 2));
   return goal;
 }
 
@@ -162,10 +181,17 @@ export function listGoals(opts = {}) {
 
 /** Mutate a goal via `fn(goal)`; throws if not found. */
 function mutate(id, fn, opts = {}) {
-  const goal = getGoal(id, opts);
-  if (!goal) throw new Error(`no such goal: ${id}`);
-  fn(goal);
-  return saveGoal(goal, opts);
+  // Serialize the read-modify-write across processes (cc+cc, or cc+desktop
+  // sharing the goals dir) so concurrent goal edits don't lose an update.
+  // Best-effort lock (with-file-lock): on contention timeout it proceeds anyway,
+  // so the CLI never hangs.
+  const root = opts.root || defaultRoot();
+  return withFileLock(goalFile(root, id), () => {
+    const goal = getGoal(id, opts);
+    if (!goal) throw new Error(`no such goal: ${id}`);
+    fn(goal);
+    return saveGoal(goal, opts);
+  });
 }
 
 /** Add a key result to a goal. */

package/src/lib/hierarchical-memory.js

@@ -1006,6 +1006,12 @@ export function startConsolidationTimer({
       }
     }
   }, intervalMs);
+  // Background maintenance must not by itself keep the CLI process alive (the
+  // process should exit once foreground work is done); matches the unref
+  // discipline used by downloader / PtyManager / background-task-manager.
+  if (_consolidationTimer && typeof _consolidationTimer.unref === "function") {
+    _consolidationTimer.unref();
+  }
   return _consolidationTimer;
 }
 

package/src/lib/llm-pricing.js

@@ -30,7 +30,19 @@ export const FREE_PROVIDERS = Object.freeze([
  */
 export const PRICE_TABLE = Object.freeze({
   anthropic: [
-    { match: "opus", in: 15, out: 75 },
+    // Current Anthropic list prices (USD per 1M tokens), verified 2026-06-21
+    // against the claude-api reference. The Opus tier dropped to $5/$25 with
+    // Opus 4.5 (Nov 2025) — the old $15/$75 applies only to the retired
+    // Opus 4 / 4.1. Longest-pattern-first matching (see matchRate) resolves
+    // dated ids to the specific rate; bare "opus" defaults to the current price.
+    { match: "fable-5", in: 10, out: 50 },
+    { match: "mythos-5", in: 10, out: 50 },
+    { match: "opus-4-8", in: 5, out: 25 },
+    { match: "opus-4-7", in: 5, out: 25 },
+    { match: "opus-4-6", in: 5, out: 25 },
+    { match: "opus-4-5", in: 5, out: 25 },
+    { match: "opus-4-1", in: 15, out: 75 },
+    { match: "opus", in: 5, out: 25 },
     { match: "sonnet", in: 3, out: 15 },
     { match: "haiku", in: 1, out: 5 },
   ],
@@ -155,11 +167,33 @@ export function lookupRate(provider, model, table = PRICE_TABLE) {
  * @returns {{ inputCost:number, outputCost:number, totalCost:number,
  *             currency:string, matched:boolean, free:boolean, rate:object|null }}
  */
+// Prompt-cache price multipliers relative to the input rate. A cache WRITE
+// (Anthropic 5-minute ephemeral breakpoint) bills at ~125%; only Anthropic
+// reports cache creation. Cache READ pricing differs per provider — Anthropic
+// ~10%, OpenAI ~50%, DeepSeek ~25% of the input rate — so the default below is
+// overridden per provider. Applied only when cache token counts are present, so
+// non-caching usage is priced exactly as before. Public list-price estimates
+// that drift; override the table via config.llm.pricing for the base rates.
+export const CACHE_READ_MULTIPLIER = 0.1;
+export const CACHE_WRITE_MULTIPLIER = 1.25;
+export const CACHE_READ_MULTIPLIER_BY_PROVIDER = Object.freeze({
+  anthropic: 0.1,
+  openai: 0.5,
+  deepseek: 0.25,
+});
+
+function cacheReadMultiplier(provider) {
+  const p = String(provider || "").toLowerCase();
+  return CACHE_READ_MULTIPLIER_BY_PROVIDER[p] ?? CACHE_READ_MULTIPLIER;
+}
+
 export function estimateCost({
   provider,
   model,
   inputTokens = 0,
   outputTokens = 0,
+  cacheReadTokens = 0,
+  cacheCreationTokens = 0,
   table,
 } = {}) {
   const rate = lookupRate(provider, model, table);
@@ -167,6 +201,8 @@ export function estimateCost({
     return {
       inputCost: 0,
       outputCost: 0,
+      cacheReadCost: 0,
+      cacheCreationCost: 0,
       totalCost: 0,
       currency: "USD",
       matched: false,
@@ -176,10 +212,20 @@ export function estimateCost({
   }
   const inputCost = round((Number(inputTokens) / 1e6) * rate.in);
   const outputCost = round((Number(outputTokens) / 1e6) * rate.out);
+  const cacheReadCost = round(
+    (Number(cacheReadTokens) / 1e6) * rate.in * cacheReadMultiplier(provider),
+  );
+  const cacheCreationCost = round(
+    (Number(cacheCreationTokens) / 1e6) * rate.in * CACHE_WRITE_MULTIPLIER,
+  );
   return {
     inputCost,
     outputCost,
-    totalCost: round(inputCost + outputCost),
+    cacheReadCost,
+    cacheCreationCost,
+    totalCost: round(
+      inputCost + outputCost + cacheReadCost + cacheCreationCost,
+    ),
     currency: "USD",
     matched: true,
     free: rate.pattern === "free",
@@ -202,6 +248,8 @@ export function priceRollup(aggregate, { table } = {}) {
       model: row.model,
       inputTokens: row.inputTokens,
       outputTokens: row.outputTokens,
+      cacheReadTokens: row.cacheReadTokens,
+      cacheCreationTokens: row.cacheCreationTokens,
       table,
     });
     return {
@@ -209,6 +257,8 @@ export function priceRollup(aggregate, { table } = {}) {
       cost: est.totalCost,
       inputCost: est.inputCost,
       outputCost: est.outputCost,
+      cacheReadCost: est.cacheReadCost,
+      cacheCreationCost: est.cacheCreationCost,
       currency: est.currency,
       matched: est.matched,
       free: est.free,

package/src/lib/mcp-oauth.js

@@ -306,12 +306,46 @@ export function getStoredToken(serverUrl) {
   return loadTokenStore()[serverKey(serverUrl)] || null;
 }
 
+// The store holds OAuth access + refresh tokens, so it must not be world-
+// readable. writeFileSync's `mode` only applies when the file is created, so
+// also chmod (best-effort) to tighten a file an older version left at 0644.
+function _writeStoreSecure(file, store) {
+  _deps.fs.mkdirSync(pathDefault.dirname(file), { recursive: true, mode: 0o700 });
+  const data = JSON.stringify(store, null, 2) + "\n";
+  // Atomic temp+rename: the store holds live OAuth tokens, so a crash (or a
+  // concurrent `cc mcp login`) mid-write must not truncate it and lose auth for
+  // every server. The temp inherits the 0600 mode. Falls back to a direct write
+  // when the injected fs lacks renameSync (test mocks); the real fs always has
+  // it, so production is always atomic.
+  if (typeof _deps.fs.renameSync !== "function") {
+    _deps.fs.writeFileSync(file, data, { encoding: "utf-8", mode: 0o600 });
+  } else {
+    const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+    try {
+      _deps.fs.writeFileSync(tmp, data, { encoding: "utf-8", mode: 0o600 });
+      _deps.fs.renameSync(tmp, file);
+    } catch (err) {
+      try {
+        if (_deps.fs.existsSync && _deps.fs.existsSync(tmp) && _deps.fs.unlinkSync)
+          _deps.fs.unlinkSync(tmp);
+      } catch {
+        /* best-effort temp cleanup */
+      }
+      throw err;
+    }
+  }
+  try {
+    _deps.fs.chmodSync(file, 0o600);
+  } catch {
+    /* chmod unsupported on this platform/fs (e.g. Windows) — mode is advisory */
+  }
+}
+
 export function saveStoredToken(serverUrl, record) {
   const file = tokenStorePath();
   const store = loadTokenStore();
   store[serverKey(serverUrl)] = { server: serverKey(serverUrl), ...record };
-  _deps.fs.mkdirSync(pathDefault.dirname(file), { recursive: true });
-  _deps.fs.writeFileSync(file, JSON.stringify(store, null, 2) + "\n", "utf-8");
+  _writeStoreSecure(file, store);
   return store[serverKey(serverUrl)];
 }
 
@@ -322,11 +356,7 @@ export function deleteStoredToken(serverUrl) {
   if (!(key in store)) return false;
   delete store[key];
   try {
-    _deps.fs.writeFileSync(
-      file,
-      JSON.stringify(store, null, 2) + "\n",
-      "utf-8",
-    );
+    _writeStoreSecure(file, store);
   } catch {
     /* best-effort */
   }

package/src/lib/memory-manager.js

@@ -8,6 +8,27 @@
 import fs from "fs";
 import path from "path";
 
+/**
+ * Atomically write a UTF-8 file: a crash mid-write must not truncate MEMORY.md
+ * (the long-term knowledge file, re-read each session). Temp sibling + rename,
+ * which is atomic within a filesystem, so a reader/crash sees either the old
+ * file or the complete new one.
+ */
+function atomicWriteFileSync(filePath, data) {
+  const tmp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    fs.writeFileSync(tmp, data, "utf8");
+    fs.renameSync(tmp, filePath);
+  } catch (err) {
+    try {
+      if (fs.existsSync(tmp)) fs.unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
 /**
  * Ensure the memory directory structure exists
  */
@@ -146,7 +167,7 @@ export function appendDailyNote(memoryDir, content) {
     fs.appendFileSync(filePath, entry, "utf8");
   } else {
     const header = `# Daily Note: ${today}\n${entry}`;
-    fs.writeFileSync(filePath, header, "utf8");
+    atomicWriteFileSync(filePath, header);
   }
 
   return { date: today, path: filePath };
@@ -206,7 +227,7 @@ export function getMemoryFile(memoryDir) {
 export function updateMemoryFile(memoryDir, content) {
   ensureMemoryDirs(memoryDir);
   const filePath = path.join(memoryDir, "MEMORY.md");
-  fs.writeFileSync(filePath, content, "utf8");
+  atomicWriteFileSync(filePath, content);
   return { path: filePath };
 }