chainlesschain 0.163.1 → 0.163.3

package/src/lib/mcp-stdio-execution-authority.js

@@ -11,7 +11,14 @@
  */
 
 import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
 import { isProxy } from "node:util/types";
+import {
+  currentHostHooksV2WorkspaceBinding,
+  resolveHostHooksV2WorkspaceBinding,
+} from "./hooks-v2-workspace-context.js";
+import { resolvePluginWorkspaceAuthority } from "./plugin-runtime/sandbox-policy.js";
 
 export const MCP_STDIO_LOCAL_CODE_TRUST_REQUIRED_CODE =
   "CC_MCP_STDIO_LOCAL_CODE_TRUST_REQUIRED";
@@ -155,6 +162,10 @@ function invocationSnapshot(serverName, config) {
     command,
     args: Object.freeze(args),
     env: Object.freeze(env.map((entry) => Object.freeze(entry))),
+    runtimeKind: scalar(
+      dataProperty(config, "runtimeKind", null),
+      "runtimeKind",
+    ),
     transport: scalar(dataProperty(config, "transport", null), "transport"),
     origin: scalar(dataProperty(config, "origin", null), "origin"),
     policy: scalar(dataProperty(config, "policy", null), "policy"),
@@ -171,6 +182,7 @@ function invocationSnapshot(serverName, config) {
       dataProperty(config, "projectPath", null),
       "projectPath",
     ),
+    cwd: scalar(dataProperty(config, "cwd", null), "cwd"),
     pluginId: scalar(dataProperty(config, "pluginId", null), "pluginId"),
     pluginVersion: scalar(
       dataProperty(config, "pluginVersion", null),
@@ -201,6 +213,8 @@ function comparableSnapshot(snapshot) {
     projectMcpWorkspaceAuthority: _projectAuthority,
     ...plain
   } = snapshot;
+  void _pluginAuthority;
+  void _projectAuthority;
   return plain;
 }
 
@@ -220,11 +234,122 @@ function sameSnapshot(expected, actual) {
   );
 }
 
+function directoryGeneration(stat) {
+  return stat.birthtimeNs > 0n
+    ? `birth:${stat.birthtimeNs.toString()}`
+    : `ctime:${stat.ctimeNs.toString()}`;
+}
+
+function captureDirectoryIdentity(value, base, label) {
+  if (typeof value !== "string" || value.length === 0 || value.includes("\0")) {
+    throw new TypeError(`${label} must be a non-empty directory path`);
+  }
+  const requestedPath = path.isAbsolute(value)
+    ? path.resolve(value)
+    : path.resolve(base, value);
+  let canonicalRoot;
+  let stat;
+  try {
+    const implementation = fs.realpathSync.native || fs.realpathSync;
+    canonicalRoot = implementation.call(fs.realpathSync, requestedPath);
+    stat = fs.statSync(canonicalRoot, { bigint: true });
+  } catch (cause) {
+    throw new TypeError(`${label} must resolve to an existing directory`, {
+      cause,
+    });
+  }
+  if (!stat.isDirectory()) {
+    throw new TypeError(`${label} must resolve to a directory`);
+  }
+  return Object.freeze({
+    requestedPath,
+    canonicalRoot,
+    device: stat.dev,
+    inode: stat.ino,
+    generation: directoryGeneration(stat),
+  });
+}
+
+function sameDirectoryIdentity(expected, actual) {
+  return (
+    expected.canonicalRoot === actual.canonicalRoot &&
+    expected.device === actual.device &&
+    expected.inode === actual.inode &&
+    expected.generation === actual.generation
+  );
+}
+
+function verifyDirectoryIdentity(binding) {
+  try {
+    return sameDirectoryIdentity(
+      binding,
+      captureDirectoryIdentity(
+        binding.requestedPath,
+        process.cwd(),
+        "approved MCP stdio cwd",
+      ),
+    );
+  } catch {
+    return false;
+  }
+}
+
+function approvedWorkspaceRoot(snapshot, workspaceRoot, workspaceBinding) {
+  if (snapshot.origin === "plugin:mcp") {
+    const pluginRoot = resolvePluginWorkspaceAuthority(
+      snapshot.pluginWorkspaceAuthority,
+      {
+        origin: snapshot.origin,
+        pluginId: snapshot.pluginId,
+        pluginVersion: snapshot.pluginVersion,
+        pluginSource: snapshot.pluginSource,
+      },
+    );
+    if (pluginRoot) return pluginRoot;
+  }
+  if (workspaceBinding != null) {
+    const resolvedBinding =
+      resolveHostHooksV2WorkspaceBinding(workspaceBinding);
+    if (!resolvedBinding?.workspaceRoot) {
+      throw new TypeError(
+        "approved MCP stdio workspace binding is invalid or stale",
+      );
+    }
+    return resolvedBinding.workspaceRoot;
+  }
+  if (typeof workspaceRoot === "string" && workspaceRoot.length > 0) {
+    return workspaceRoot;
+  }
+  const hostRoot = currentHostHooksV2WorkspaceBinding()?.workspaceRoot;
+  if (hostRoot) return hostRoot;
+  if (typeof snapshot.projectPath === "string" && snapshot.projectPath) {
+    return snapshot.projectPath;
+  }
+  return process.cwd();
+}
+
+function captureApprovedCwd(snapshot, workspaceRoot, workspaceBinding) {
+  if (snapshot.sandboxPolicy == null || snapshot.cwd == null) return null;
+  return captureDirectoryIdentity(
+    snapshot.cwd,
+    approvedWorkspaceRoot(snapshot, workspaceRoot, workspaceBinding),
+    "approved MCP stdio cwd",
+  );
+}
+
+function staleDirectoryError(serverName) {
+  return authorityError(
+    MCP_STDIO_EXECUTION_AUTHORITY_STALE_CODE,
+    `MCP stdio working directory for "${String(serverName)}" changed after approval`,
+  );
+}
+
 function materializeSnapshot(snapshot) {
   return {
     command: snapshot.command,
     args: [...snapshot.args],
     env: Object.fromEntries(snapshot.env),
+    runtimeKind: snapshot.runtimeKind,
     transport: snapshot.transport,
     origin: snapshot.origin,
     policy: snapshot.policy,
@@ -232,6 +357,7 @@ function materializeSnapshot(snapshot) {
     configScope: snapshot.configScope,
     configSource: snapshot.configSource,
     projectPath: snapshot.projectPath,
+    cwd: snapshot.cwd,
     pluginId: snapshot.pluginId,
     pluginVersion: snapshot.pluginVersion,
     pluginSource: snapshot.pluginSource,
@@ -249,6 +375,8 @@ export function issueMcpStdioExecutionAuthority({
   config,
   approvalKind,
   approvalSource,
+  workspaceRoot,
+  workspaceBinding,
 }) {
   if (!APPROVAL_KINDS.has(approvalKind)) {
     throw new TypeError("MCP stdio approval kind is not recognized");
@@ -256,6 +384,11 @@ export function issueMcpStdioExecutionAuthority({
   const source = scalar(approvalSource, "approvalSource", { nullable: false });
   if (!source.trim()) throw new TypeError("approvalSource must not be empty");
   const snapshot = invocationSnapshot(serverName, config);
+  const cwdIdentity = captureApprovedCwd(
+    snapshot,
+    workspaceRoot,
+    workspaceBinding,
+  );
   const token = Object.freeze({});
   issuedAuthorities.set(
     token,
@@ -264,6 +397,7 @@ export function issueMcpStdioExecutionAuthority({
       approvalSource: source,
       fingerprint: snapshotDigest(snapshot),
       snapshot,
+      cwdIdentity,
     }),
   );
   return token;
@@ -304,6 +438,9 @@ export function consumeMcpStdioExecutionAuthority(
       `MCP stdio invocation for "${String(serverName)}" changed after approval`,
     );
   }
+  if (issued.cwdIdentity && !verifyDirectoryIdentity(issued.cwdIdentity)) {
+    throw staleDirectoryError(serverName);
+  }
   const approval = Object.freeze({
     approvalKind: issued.approvalKind,
     approvalSource: issued.approvalSource,
@@ -331,6 +468,9 @@ export function renewMcpStdioExecutionAuthority(
       `MCP stdio reconnect invocation for "${String(serverName)}" changed after approval`,
     );
   }
+  if (issued.cwdIdentity && !verifyDirectoryIdentity(issued.cwdIdentity)) {
+    throw staleDirectoryError(serverName);
+  }
   const token = Object.freeze({});
   issuedAuthorities.set(token, issued);
   return token;
@@ -347,6 +487,34 @@ export function materializeApprovedMcpStdioInvocation(approval) {
   return materializeSnapshot(issued.snapshot);
 }
 
+export function verifyMcpStdioApprovedWorkingDirectory(
+  approval,
+  workingDirectory,
+) {
+  const issued = renewableApprovals.get(approval);
+  if (!issued) {
+    throw authorityError(
+      MCP_STDIO_LOCAL_CODE_TRUST_REQUIRED_CODE,
+      "MCP stdio working directory requires a consumed execution approval",
+    );
+  }
+  if (!issued.cwdIdentity) return true;
+  let actual;
+  try {
+    actual = captureDirectoryIdentity(
+      workingDirectory,
+      process.cwd(),
+      "materialized MCP stdio cwd",
+    );
+  } catch {
+    throw staleDirectoryError(issued.snapshot.serverName);
+  }
+  if (!sameDirectoryIdentity(issued.cwdIdentity, actual)) {
+    throw staleDirectoryError(issued.snapshot.serverName);
+  }
+  return true;
+}
+
 /**
  * Return only the content-free provenance needed to key a durable executable
  * identity. The approval object itself remains an unforgeable WeakMap-backed

package/src/lib/mcp-stdio-workspace-authority.js

@@ -0,0 +1,252 @@
+import fs from "node:fs";
+import path from "node:path";
+import { isProxy } from "node:util/types";
+import { resolveHostHooksV2WorkspaceBinding } from "./hooks-v2-workspace-context.js";
+import { normalizeMcpSandboxPolicy } from "./mcp-sandbox-policy.js";
+import { resolvePluginWorkspaceAuthority } from "./plugin-runtime/sandbox-policy.js";
+import { resolveProjectMcpWorkspaceAuthority } from "./project-mcp-trust.js";
+
+export const MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE =
+  "CC_MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED";
+export const MCP_STDIO_SANDBOX_CWD_INVALID_CODE =
+  "CC_MCP_STDIO_SANDBOX_CWD_INVALID";
+
+function workspaceError(code, message, cause) {
+  const error = new Error(message, cause ? { cause } : undefined);
+  error.code = code;
+  return error;
+}
+
+function dataProperty(owner, key, fallback) {
+  if (!owner || typeof owner !== "object" || isProxy(owner)) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      "MCP stdio sandbox config must be a non-Proxy object",
+    );
+  }
+  const descriptor = Object.getOwnPropertyDescriptor(owner, key);
+  if (!descriptor) return fallback;
+  if (!("value" in descriptor)) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      `MCP stdio sandbox config.${key} must be an own data property`,
+    );
+  }
+  return descriptor.value;
+}
+
+function canonicalDirectory(value, label) {
+  if (typeof value !== "string" || value.length === 0 || value.includes("\0")) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_CWD_INVALID_CODE,
+      `${label} must be a non-empty directory path`,
+    );
+  }
+  try {
+    const canonical = fs.realpathSync.native(path.resolve(value));
+    if (!fs.statSync(canonical).isDirectory()) {
+      throw new Error("not a directory");
+    }
+    return canonical;
+  } catch (cause) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_CWD_INVALID_CODE,
+      `${label} must resolve to an existing directory`,
+      cause,
+    );
+  }
+}
+
+function isPathInside(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return (
+    relative === "" ||
+    (relative !== ".." &&
+      !relative.startsWith(`..${path.sep}`) &&
+      !path.isAbsolute(relative))
+  );
+}
+
+function sandboxPolicyFromConfig(config, serverName) {
+  const raw = dataProperty(config, "sandboxPolicy", null);
+  return normalizeMcpSandboxPolicy(raw, {
+    label: `MCP stdio server "${serverName}" sandboxPolicy`,
+  });
+}
+
+function pluginRootFromConfig(config, deps) {
+  if (dataProperty(config, "origin", null) !== "plugin:mcp") return null;
+  const resolvePlugin =
+    deps.resolvePluginWorkspaceAuthority || resolvePluginWorkspaceAuthority;
+  return resolvePlugin(dataProperty(config, "pluginWorkspaceAuthority", null), {
+    origin: "plugin:mcp",
+    pluginId: dataProperty(config, "pluginId", null),
+    pluginVersion: dataProperty(config, "pluginVersion", null),
+    pluginSource: dataProperty(config, "pluginSource", null),
+  });
+}
+
+function isProjectFileSource(configScope, configSource) {
+  return (
+    configScope === "project" &&
+    typeof configSource === "string" &&
+    path.basename(configSource).toLowerCase() === ".mcp.json"
+  );
+}
+
+function requirePublicWorkspaceRoot(
+  serverName,
+  config,
+  workspaceBinding,
+  deps,
+) {
+  const resolveHost =
+    deps.resolveHostWorkspaceBinding || resolveHostHooksV2WorkspaceBinding;
+  const binding = resolveHost(workspaceBinding);
+  if (!binding?.workspaceRoot) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      `Policy-bearing MCP stdio server "${serverName}" requires a trusted host workspace`,
+    );
+  }
+  const hostRoot = canonicalDirectory(
+    binding.workspaceRoot,
+    `MCP stdio server "${serverName}" host workspace`,
+  );
+  const configScope = dataProperty(config, "configScope", null);
+  const projectPath = dataProperty(config, "projectPath", null);
+  const configSource = dataProperty(config, "configSource", null);
+  const projectAuthority = dataProperty(
+    config,
+    "projectMcpWorkspaceAuthority",
+    null,
+  );
+  const projectFileSource = isProjectFileSource(configScope, configSource);
+
+  if (
+    configScope === "project" &&
+    (projectFileSource || projectAuthority) &&
+    !projectPath
+  ) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      `Project MCP stdio server "${serverName}" is missing its project workspace`,
+    );
+  }
+
+  if ((configScope === "local" || configScope === "project") && projectPath) {
+    const projectRoot = canonicalDirectory(
+      projectPath,
+      `MCP stdio server "${serverName}" project workspace`,
+    );
+    if (!isPathInside(projectRoot, hostRoot)) {
+      throw workspaceError(
+        MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+        `MCP stdio server "${serverName}" does not belong to the trusted host workspace`,
+      );
+    }
+
+    if (projectAuthority || projectFileSource) {
+      const resolveProject =
+        deps.resolveProjectMcpWorkspaceAuthority ||
+        resolveProjectMcpWorkspaceAuthority;
+      const authorityRoot = resolveProject(projectAuthority, {
+        configSource,
+        serverName,
+        url: dataProperty(config, "url", null),
+        transport: dataProperty(config, "transport", null),
+        headersHelper: dataProperty(config, "headersHelper", null),
+      });
+      let canonicalAuthorityRoot = null;
+      try {
+        canonicalAuthorityRoot = authorityRoot
+          ? canonicalDirectory(
+              authorityRoot,
+              `MCP stdio server "${serverName}" project authority`,
+            )
+          : null;
+      } catch {
+        canonicalAuthorityRoot = null;
+      }
+      if (canonicalAuthorityRoot !== projectRoot) {
+        throw workspaceError(
+          MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+          `Project MCP stdio server "${serverName}" is missing its trusted file authority`,
+        );
+      }
+    }
+  }
+
+  return hostRoot;
+}
+
+function requestedWorkingDirectory(config, trustedRoot, serverName) {
+  const requested = dataProperty(config, "cwd", null);
+  if (requested == null || requested === "") return trustedRoot;
+  if (typeof requested !== "string" || requested.includes("\0")) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_CWD_INVALID_CODE,
+      `MCP stdio server "${serverName}" cwd must be a path`,
+    );
+  }
+  const candidate = canonicalDirectory(
+    path.isAbsolute(requested)
+      ? requested
+      : path.resolve(trustedRoot, requested),
+    `MCP stdio server "${serverName}" cwd`,
+  );
+  if (!isPathInside(trustedRoot, candidate)) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_CWD_INVALID_CODE,
+      `MCP stdio server "${serverName}" cwd escapes its trusted workspace`,
+    );
+  }
+  return candidate;
+}
+
+/**
+ * Resolve source-declared MCP isolation against an opaque host/plugin
+ * workspace capability. A policy-bearing launch never derives authority from
+ * process.cwd(); the selected cwd is canonical, existing, and contained by the
+ * trusted root before executable identity or Broker contract issuance.
+ */
+export function resolveMcpStdioSandboxContext(
+  { serverName, config, workspaceBinding },
+  deps = {},
+) {
+  const name = String(serverName || "unknown");
+  const sandboxPolicy = sandboxPolicyFromConfig(config, name);
+  const pluginWorkspaceRoot = pluginRootFromConfig(config, deps);
+
+  if (!sandboxPolicy) {
+    return Object.freeze({
+      sandboxPolicy: null,
+      pluginWorkspaceRoot,
+      workingDirectory: pluginWorkspaceRoot,
+    });
+  }
+
+  if (
+    dataProperty(config, "origin", null) === "plugin:mcp" &&
+    !pluginWorkspaceRoot
+  ) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      `Plugin MCP stdio server "${name}" is missing its trusted workspace authority`,
+    );
+  }
+
+  const trustedRoot = pluginWorkspaceRoot
+    ? canonicalDirectory(
+        pluginWorkspaceRoot,
+        `Plugin MCP stdio server "${name}" workspace`,
+      )
+    : requirePublicWorkspaceRoot(name, config, workspaceBinding, deps);
+  const workingDirectory = requestedWorkingDirectory(config, trustedRoot, name);
+
+  return Object.freeze({
+    sandboxPolicy,
+    pluginWorkspaceRoot,
+    workingDirectory,
+  });
+}

package/src/lib/plugin-runtime/sandbox-policy.js

@@ -20,6 +20,28 @@ const SUPPORTED_BOUNDARIES = new Set(PLUGIN_SANDBOX_BOUNDARIES);
 const PLUGIN_WORKSPACE_AUTHORITY_KIND = "trusted-plugin-workspace";
 const pluginWorkspaceAuthorities = new WeakMap();
 
+function directoryGeneration(stat) {
+  return stat.birthtimeNs > 0n
+    ? `birth:${stat.birthtimeNs.toString()}`
+    : `ctime:${stat.ctimeNs.toString()}`;
+}
+
+function directoryIdentity(stat) {
+  return Object.freeze({
+    device: stat.dev,
+    inode: stat.ino,
+    generation: directoryGeneration(stat),
+  });
+}
+
+function sameDirectoryIdentity(left, right) {
+  return (
+    left.device === right.dev &&
+    left.inode === right.ino &&
+    left.generation === directoryGeneration(right)
+  );
+}
+
 function invalidPolicy(message) {
   const error = new Error(message);
   error.code = "ERR_PLUGIN_SANDBOX_POLICY_INVALID";
@@ -69,7 +91,7 @@ export function issuePluginWorkspaceAuthority(value = {}) {
   try {
     const implementation = fs.realpathSync.native || fs.realpathSync;
     canonicalRoot = implementation.call(fs.realpathSync, requestedRoot);
-    stat = fs.statSync(canonicalRoot);
+    stat = fs.statSync(canonicalRoot, { bigint: true });
   } catch {
     throw invalidPolicy("trusted plugin workspace root is unavailable");
   }
@@ -92,7 +114,11 @@ export function issuePluginWorkspaceAuthority(value = {}) {
   });
   pluginWorkspaceAuthorities.set(
     authority,
-    Object.freeze({ root: canonicalRoot, provenance }),
+    Object.freeze({
+      root: canonicalRoot,
+      identity: directoryIdentity(stat),
+      provenance,
+    }),
   );
   return authority;
 }
@@ -117,6 +143,20 @@ export function resolvePluginWorkspaceAuthority(authority, provenance = {}) {
   ) {
     return null;
   }
+  try {
+    const implementation = fs.realpathSync.native || fs.realpathSync;
+    const currentRoot = implementation.call(fs.realpathSync, binding.root);
+    const currentStat = fs.statSync(currentRoot, { bigint: true });
+    if (
+      currentRoot !== binding.root ||
+      !currentStat.isDirectory() ||
+      !sameDirectoryIdentity(binding.identity, currentStat)
+    ) {
+      return null;
+    }
+  } catch {
+    return null;
+  }
   return binding.root;
 }