chainlesschain 0.163.1 → 0.163.3

package/src/lib/process-execution-broker/windows-sandbox.cs

@@ -3540,10 +3540,11 @@ namespace ChainlessChain.WindowsSandbox
                     ThrowLastError("AssignProcessToJobObject");
                 }
                 ReattestLaunchPaths(launchPathLocks);
-                // The suspended process has already created its image section.
-                // Release all remaining runtime stream guards before resume so
-                // target code can never deadlock waiting for a break owned by
-                // the helper. This is not a pathname-atomic runtime launch.
+                // The suspended process has already created its image section
+                // while the attested pathname remained protected by its Filter
+                // oplock. Reattestation above completes the pathname-to-image
+                // atomic handoff; release the stream guards before resume so
+                // target code cannot deadlock on a break owned by the helper.
                 ReleaseLaunchPathLocks(launchPathLocks);
                 if (ResumeThread(processInfo.hThread) == UInt32.MaxValue)
                 {

package/src/lib/process-tree-termination.js

@@ -23,6 +23,22 @@ function childHasClosed(child, observedClose) {
   );
 }
 
+/**
+ * Whether another PID/PGID based termination attempt is still identity-safe.
+ * Once the owned root is known closed, its numeric pid can be reused by an
+ * unrelated process tree. A caller may retain fail-closed uncertainty, but it
+ * must never send a later signal through that stale identity.
+ */
+export function shouldRetryOwnedProcessTreeTermination(child, result) {
+  if (result?.confirmed === true) return false;
+  if (result?.closed === true) return false;
+  if (child?.exitCode !== null && child?.exitCode !== undefined) return false;
+  if (child?.signalCode !== null && child?.signalCode !== undefined) {
+    return false;
+  }
+  return true;
+}
+
 function posixGroupIsGone(pid, kill) {
   try {
     kill(-pid, 0);
@@ -224,7 +240,7 @@ export async function terminateOwnedProcessTree(child, options = {}) {
       await waitForConfirmation(graceMs);
     }
 
-    if (!confirmed()) {
+    if (!confirmed() && !closed()) {
       escalated = true;
       const attempt = request(true);
       hardRequested = attempt.requested;

package/src/lib/skill-mcp.js

@@ -31,6 +31,48 @@ import {
   MCP_STDIO_LOCAL_CODE_TRUST_REQUIRED_CODE,
   issueMcpStdioExecutionAuthority,
 } from "./mcp-stdio-execution-authority.js";
+import { MCP_STDIO_RUNTIME_KINDS } from "./mcp-stdio-executable-identity.js";
+import { isProxy } from "node:util/types";
+import {
+  MCP_SANDBOX_POLICY_INVALID_CODE,
+  normalizeMcpSandboxPolicy,
+  readMcpStdioCwd,
+} from "./mcp-sandbox-policy.js";
+
+function invalidSandboxPolicy(message) {
+  const error = new TypeError(message);
+  error.code = MCP_SANDBOX_POLICY_INVALID_CODE;
+  return error;
+}
+
+function sandboxPolicyFromEntry(entry) {
+  if (!entry || typeof entry !== "object" || isProxy(entry)) {
+    throw invalidSandboxPolicy(
+      "skill MCP server config must be a non-Proxy object",
+    );
+  }
+  const descriptor = Object.getOwnPropertyDescriptor(entry, "sandboxPolicy");
+  if (!descriptor) return null;
+  if (!("value" in descriptor)) {
+    throw invalidSandboxPolicy(
+      "skill MCP server sandboxPolicy must be an own data property",
+    );
+  }
+  return normalizeMcpSandboxPolicy(descriptor.value, {
+    label: "skill MCP server sandboxPolicy",
+  });
+}
+
+function safeServerName(entry) {
+  if (!entry || typeof entry !== "object" || isProxy(entry)) return "(invalid)";
+  const descriptor = Object.getOwnPropertyDescriptor(entry, "name");
+  return descriptor &&
+    "value" in descriptor &&
+    typeof descriptor.value === "string" &&
+    descriptor.value.length > 0
+    ? descriptor.value
+    : "(invalid)";
+}
 
 /**
  * Parse MCP server declarations from a SKILL.md body.
@@ -76,6 +118,10 @@ export function parseSkillMcpServers(body) {
  */
 export function validateMcpServerConfig(entry) {
   if (!entry || typeof entry !== "object") return null;
+  const sandboxPolicy = sandboxPolicyFromEntry(entry);
+  const { cwd } = readMcpStdioCwd(entry, {
+    label: "skill MCP server config",
+  });
   if (typeof entry.name !== "string" || entry.name.trim().length === 0) {
     return null;
   }
@@ -93,9 +139,16 @@ export function validateMcpServerConfig(entry) {
   if (entry.env && typeof entry.env === "object" && !Array.isArray(entry.env)) {
     normalized.env = { ...entry.env };
   }
-  if (typeof entry.cwd === "string" && entry.cwd.length > 0) {
-    normalized.cwd = entry.cwd;
+  if (
+    typeof entry.runtimeKind === "string" &&
+    MCP_STDIO_RUNTIME_KINDS.includes(entry.runtimeKind)
+  ) {
+    normalized.runtimeKind = entry.runtimeKind;
+  } else if (entry.runtimeKind !== undefined) {
+    return null;
   }
+  if (cwd) normalized.cwd = cwd;
+  if (sandboxPolicy) normalized.sandboxPolicy = sandboxPolicy;
   return Object.freeze(normalized);
 }
 
@@ -122,7 +175,19 @@ export async function mountSkillMcpServers(mcpClient, skill, opts = {}) {
   }
 
   for (const server of declared) {
-    const normalized = validateMcpServerConfig(server);
+    let normalized;
+    try {
+      normalized = validateMcpServerConfig(server);
+    } catch (error) {
+      const name = safeServerName(server);
+      const message = error?.message || String(error);
+      skipped.push({ name, error: message });
+      opts.onWarn?.(
+        `[skill-mcp] Skipped "${name}" for skill "${skill?.id || skill?.name}": ${message}`,
+        error,
+      );
+      continue;
+    }
     if (!normalized) {
       const name = server?.name || "(invalid)";
       skipped.push({ name, error: "invalid config" });
@@ -145,8 +210,10 @@ export async function mountSkillMcpServers(mcpClient, skill, opts = {}) {
           serverName: normalized.name,
           command: normalized.command,
           args: [...normalized.args],
+          runtimeKind: normalized.runtimeKind || null,
           cwd: normalized.cwd || null,
           envKeys: Object.keys(normalized.env || {}).sort(),
+          sandboxPolicy: normalized.sandboxPolicy || null,
         })) === true;
     } catch (error) {
       const message = error?.message || String(error);
@@ -172,6 +239,10 @@ export async function mountSkillMcpServers(mcpClient, skill, opts = {}) {
         config,
         approvalKind: "explicit-config",
         approvalSource: `skill:${skill?.id || skill?.name || "unknown"}:${normalized.name}`,
+        workspaceBinding:
+          typeof mcpClient.executionWorkspaceBinding === "function"
+            ? mcpClient.executionWorkspaceBinding()
+            : null,
       });
       await mcpClient.connect(normalized.name, config);
       mounted.push(normalized.name);

package/src/lib/web-fetch.js

@@ -5,10 +5,10 @@
  * private/loopback hosts unless explicitly allowlisted.
  */
 
-import http from "http";
-import https from "https";
-import { lookup as dnsLookup } from "dns";
-import { URL } from "url";
+import http from "node:http";
+import https from "node:https";
+import { lookup as dnsLookup } from "node:dns";
+import { URL } from "node:url";
 
 const DEFAULT_MAX_BYTES = 2_000_000;
 const DEFAULT_TIMEOUT_MS = 15_000;

package/src/runtime/agent-runtime.js

@@ -29,6 +29,7 @@ import { findProjectRoot, loadProjectConfig } from "../lib/project-detector.js";
 import { loadConfig } from "../lib/config-manager.js";
 import { collectWorkspacePluginBinSandboxPolicy } from "../lib/plugin-runtime/bin.js";
 import { issueMcpStdioExecutionAuthority } from "../lib/mcp-stdio-execution-authority.js";
+import { registerHostHooksV2Workspace } from "../lib/hooks-v2-workspace-context.js";
 
 const {
   DEFAULT_ALLOWED_MCP_SERVER_NAMES,
@@ -71,7 +72,8 @@ export class AgentRuntime {
         ((options) => new WSSessionManager(options)),
       createPtyManager:
         deps.createPtyManager || ((options) => new PtyManager(options)),
-      createMcpClient: deps.createMcpClient || (() => new MCPClient()),
+      createMcpClient:
+        deps.createMcpClient || ((options) => new MCPClient(options)),
       createMcpServerConfig:
         deps.createMcpServerConfig || ((db) => new MCPServerConfig(db)),
       mcpServerRegistry:
@@ -81,6 +83,8 @@ export class AgentRuntime {
       findProjectRoot: deps.findProjectRoot || findProjectRoot,
       loadProjectConfig: deps.loadProjectConfig || loadProjectConfig,
       loadConfig: deps.loadConfig || loadConfig,
+      loadAgentBundle: deps.loadAgentBundle || null,
+      resolveAgentBundle: deps.resolveAgentBundle || null,
       openBrowser: deps.openBrowser || openBrowser,
       runTurn: deps.runTurn || null,
       logger: deps.logger || logger,
@@ -226,6 +230,8 @@ export class AgentRuntime {
       host = "0.0.0.0";
     }
 
+    const mcpWorkspaceRoot = path.resolve(project || process.cwd());
+
     let db = null;
     let rawDb = null;
     try {
@@ -243,6 +249,7 @@ export class AgentRuntime {
     const appConfig = this.deps.loadConfig();
     const mcpClient = await this._initializeCodingAgentMcpClient(rawDb, {
       logger: runtimeLogger,
+      workspaceRoot: mcpWorkspaceRoot,
     });
 
     // Deep Agents Deploy: load agent bundle if --bundle provided.
@@ -252,10 +259,17 @@ export class AgentRuntime {
     let bundleMcpClient = mcpClient;
     if (this.policy.bundlePath) {
       try {
-        const { loadBundle } =
-          await import("@chainlesschain/session-core/agent-bundle-loader");
-        const { resolveBundle } =
-          await import("@chainlesschain/session-core/agent-bundle-resolver");
+        let loadBundle = this.deps.loadAgentBundle;
+        let resolveBundle = this.deps.resolveAgentBundle;
+        if (
+          typeof loadBundle !== "function" ||
+          typeof resolveBundle !== "function"
+        ) {
+          ({ loadBundle } =
+            await import("@chainlesschain/session-core/agent-bundle-loader"));
+          ({ resolveBundle } =
+            await import("@chainlesschain/session-core/agent-bundle-resolver"));
+        }
         const bundle = loadBundle(this.policy.bundlePath);
         bundleResolved = resolveBundle(bundle);
 
@@ -266,8 +280,10 @@ export class AgentRuntime {
             ([, cfg]) => cfg && cfg.command,
           );
           if (entries.length > 0) {
+            const mcpWorkspace =
+              this._resolveCodingAgentMcpWorkspace(mcpWorkspaceRoot);
             if (!bundleMcpClient) {
-              bundleMcpClient = this.deps.createMcpClient();
+              bundleMcpClient = this._createCodingAgentMcpClient(mcpWorkspace);
             }
             for (const [name, cfg] of entries) {
               try {
@@ -278,6 +294,7 @@ export class AgentRuntime {
                     config: authorizedConfig,
                     approvalKind: "explicit-config",
                     approvalSource: `agent-bundle:${path.resolve(this.policy.bundlePath)}`,
+                    workspaceRoot: mcpWorkspace.workspaceRoot,
                   });
                 await bundleMcpClient.connect(name, authorizedConfig);
               } catch (mcpErr) {
@@ -484,6 +501,7 @@ export class AgentRuntime {
     const appConfig = this.deps.loadConfig();
     const mcpClient = await this._initializeCodingAgentMcpClient(rawDb, {
       logger: runtimeLogger,
+      workspaceRoot: workspacePolicyCwd,
     });
     const sessionManager = this.deps.createSessionManager({
       db,
@@ -766,10 +784,27 @@ export class AgentRuntime {
     const trustedMcpServers = createTrustedMcpServerMap(
       this.deps.mcpServerRegistry,
     );
+    const mcpWorkspace = this._resolveCodingAgentMcpWorkspace(
+      options.workspaceRoot || this.policy?.project || process.cwd(),
+    );
     const configStore = this.deps.createMcpServerConfig(db);
     const autoConnectServers =
       typeof configStore?.getAutoConnect === "function"
-        ? configStore.getAutoConnect()
+        ? configStore.getAutoConnect({
+            cwd: mcpWorkspace.workspaceRoot,
+            onInvalidRow: (error, row) => {
+              const rawName = row?.display_name || row?.name || "unknown";
+              const safeName = String(rawName).replace(/[\r\n]/g, " ");
+              const reason = String(
+                error?.code || error?.message || "invalid configuration",
+              ).replace(/[\r\n]/g, " ");
+              options.logger?.log?.(
+                chalk.yellow(
+                  `  Warning: MCP server "${safeName}" was skipped: ${reason}`,
+                ),
+              );
+            },
+          })
         : [];
     const eligibleServers = autoConnectServers.filter(
       (server) =>
@@ -787,7 +822,7 @@ export class AgentRuntime {
       return null;
     }
 
-    const mcpClient = this.deps.createMcpClient();
+    const mcpClient = this._createCodingAgentMcpClient(mcpWorkspace);
     let connectedCount = 0;
 
     for (const server of eligibleServers) {
@@ -800,6 +835,7 @@ export class AgentRuntime {
               config: authorizedServer,
               approvalKind: "registered-config",
               approvalSource: `${server.configScope || "user"}:${server.configSource || "database"}:${server.name}`,
+              workspaceRoot: mcpWorkspace.workspaceRoot,
             });
         }
         await mcpClient.connect(server.name, authorizedServer);
@@ -822,4 +858,21 @@ export class AgentRuntime {
 
     return mcpClient;
   }
+
+  _resolveCodingAgentMcpWorkspace(workspaceRoot) {
+    const workspaceBinding = registerHostHooksV2Workspace(
+      path.resolve(workspaceRoot || process.cwd()),
+    );
+    return Object.freeze({
+      workspaceBinding,
+      workspaceRoot: workspaceBinding.workspaceRoot,
+    });
+  }
+
+  _createCodingAgentMcpClient(workspace) {
+    return this.deps.createMcpClient({
+      workspaceBinding: workspace.workspaceBinding,
+      roots: [workspace.workspaceRoot],
+    });
+  }
 }