chainlesschain 0.163.2 → 0.163.4

package/src/lib/mcp-call-ledger-store.js

@@ -34,13 +34,16 @@ export const MCP_CALL_LEDGER_EVENT = "mcp_call_ledger";
 export const MCP_CALL_LEDGER_EVENT_SCHEMA_VERSION = 1;
 export const MCP_CALL_RECOVERY_ADJUDICATION_EVENT =
   "mcp_call_recovery_adjudication";
-export const MCP_CALL_RECOVERY_ADJUDICATION_SCHEMA_VERSION = 1;
+export const MCP_CALL_RECOVERY_ADJUDICATION_SCHEMA_VERSION = 2;
 export const McpCallRecoveryDecision = Object.freeze({
   CONFIRMED_APPLIED: "confirmed_applied",
   CONFIRMED_NOT_APPLIED: "confirmed_not_applied",
 });
 export const MCP_CALL_RECOVERY_AUTHORITY = "local-cli-tty";
-export const MCP_CALL_RECOVERY_CONFIRMATION = "typed-digest-host-stopped";
+export const MCP_CALL_RECOVERY_CONFIRMATION =
+  "typed-digest-host-authority-revoke";
+export const MCP_CALL_RECOVERY_LEGACY_CONFIRMATION =
+  "typed-digest-host-stopped";
 
 const TERMINAL = new Set([
   McpCallStatus.COMPLETED,
@@ -86,7 +89,7 @@ const EFFECT_CONTRACT_FIELDS = new Set([
 ]);
 const OUTPUT_SUMMARY_FIELDS = new Set(["sha256", "bytes", "kind"]);
 const ERROR_SUMMARY_FIELDS = new Set(["name", "code", "messageDigest"]);
-const ADJUDICATION_FIELDS = new Set([
+const LEGACY_ADJUDICATION_FIELDS = new Set([
   "schemaVersion",
   "requestId",
   "sessionId",
@@ -98,6 +101,18 @@ const ADJUDICATION_FIELDS = new Set([
   "confirmation",
   "reasonDigest",
 ]);
+const ADJUDICATION_FIELDS = new Set([
+  ...LEGACY_ADJUDICATION_FIELDS,
+  "hostRevocation",
+]);
+const HOST_REVOCATION_FIELDS = new Set([
+  "requestId",
+  "revocationEpoch",
+  "targetLeaseId",
+  "targetFencingToken",
+  "targetOwnerPid",
+]);
+const HOST_LEASE_ID = /^lease-[0-9a-f-]{36}$/;
 const RECOVERY_PROJECTION_FIELDS = new Set([
   "sessionId",
   "records",
@@ -414,9 +429,32 @@ function stableSorted(values) {
 }
 
 function canonicalAdjudication(value) {
+  const legacy = value?.schemaVersion === 1;
+  const validConfirmation =
+    (legacy && value?.confirmation === MCP_CALL_RECOVERY_LEGACY_CONFIRMATION) ||
+    (value?.schemaVersion === MCP_CALL_RECOVERY_ADJUDICATION_SCHEMA_VERSION &&
+      value?.confirmation === MCP_CALL_RECOVERY_CONFIRMATION);
+  const fields = legacy ? LEGACY_ADJUDICATION_FIELDS : ADJUDICATION_FIELDS;
+  const revocation = value?.hostRevocation;
+  const targetIsNull = revocation?.targetLeaseId === null;
+  const validRevocation =
+    legacy ||
+    (hasExactFields(revocation, HOST_REVOCATION_FIELDS) &&
+      revocation.requestId === value?.requestId &&
+      Number.isSafeInteger(revocation.revocationEpoch) &&
+      revocation.revocationEpoch >= 1 &&
+      (targetIsNull
+        ? revocation.targetFencingToken === null &&
+          revocation.targetOwnerPid === null
+        : HOST_LEASE_ID.test(String(revocation.targetLeaseId || "")) &&
+          Number.isSafeInteger(revocation.targetFencingToken) &&
+          revocation.targetFencingToken >= 1 &&
+          Number.isSafeInteger(revocation.targetOwnerPid) &&
+          revocation.targetOwnerPid >= 1));
   if (
-    !hasExactFields(value, ADJUDICATION_FIELDS) ||
-    value.schemaVersion !== MCP_CALL_RECOVERY_ADJUDICATION_SCHEMA_VERSION ||
+    !hasExactFields(value, fields) ||
+    !validConfirmation ||
+    !validRevocation ||
     !isCanonicalProtocolText(
       value.requestId,
       MCP_CALL_LEDGER_PROTOCOL_LIMITS.identifier,
@@ -433,7 +471,6 @@ function canonicalAdjudication(value) {
     !RAW_AUTHORITY_HASH.test(String(value.expectedHeadHash || "")) ||
     !PAYLOAD_DIGEST.test(String(value.expectedRecoveryDigest || "")) ||
     value.authority !== MCP_CALL_RECOVERY_AUTHORITY ||
-    value.confirmation !== MCP_CALL_RECOVERY_CONFIRMATION ||
     !PAYLOAD_DIGEST.test(String(value.reasonDigest || ""))
   ) {
     return null;
@@ -449,6 +486,17 @@ function canonicalAdjudication(value) {
     authority: value.authority,
     confirmation: value.confirmation,
     reasonDigest: value.reasonDigest,
+    ...(legacy
+      ? {}
+      : {
+          hostRevocation: Object.freeze({
+            requestId: revocation.requestId,
+            revocationEpoch: revocation.revocationEpoch,
+            targetLeaseId: revocation.targetLeaseId,
+            targetFencingToken: revocation.targetFencingToken,
+            targetOwnerPid: revocation.targetOwnerPid,
+          }),
+        }),
   });
 }
 
@@ -546,6 +594,10 @@ export function computeMcpRecoveryFenceDigest(recovery = {}) {
         authority: entry?.authority || null,
         confirmation: entry?.confirmation || null,
         reasonDigest: entry?.reasonDigest || null,
+        ...(entry?.schemaVersion ===
+        MCP_CALL_RECOVERY_ADJUDICATION_SCHEMA_VERSION
+          ? { hostRevocation: entry?.hostRevocation || null }
+          : {}),
       })),
     ),
     replayDenied: stableSorted(

package/src/lib/mcp-headers-helper.js

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { isProxy } from "node:util/types";
 import executionBroker from "./process-execution-broker/index.js";
 import hookShellCommand from "./hook-shell-command.cjs";
 import {
@@ -9,6 +10,7 @@ import {
 import { checkLocalMcpHeadersHelperTrust } from "./mcp-headers-helper-trust.js";
 import { resolvePluginWorkspaceAuthority } from "./plugin-runtime/sandbox-policy.js";
 import { resolveProjectMcpWorkspaceAuthority } from "./project-mcp-trust.js";
+import { normalizeMcpSandboxPolicy } from "./mcp-sandbox-policy.js";
 
 const { buildExplicitHookShellInvocation } = hookShellCommand;
 
@@ -42,6 +44,45 @@ function helperError(code, message) {
   return error;
 }
 
+function declaredSandboxPolicy(config) {
+  if (!config || typeof config !== "object" || isProxy(config)) {
+    throw helperError(
+      "CC_MCP_SANDBOX_POLICY_INVALID",
+      "MCP headersHelper sandbox policy owner must be a non-Proxy object",
+    );
+  }
+  const descriptor = Object.getOwnPropertyDescriptor(config, "sandboxPolicy");
+  if (!descriptor) return null;
+  if (!("value" in descriptor)) {
+    throw helperError(
+      "CC_MCP_SANDBOX_POLICY_INVALID",
+      "MCP headersHelper sandboxPolicy must be an own data property",
+    );
+  }
+  return normalizeMcpSandboxPolicy(descriptor.value, {
+    label: "MCP headersHelper sandboxPolicy",
+  });
+}
+
+function sandboxExecution(config, sandboxPolicy, fallbackOrigin) {
+  if (!sandboxPolicy) return null;
+  return Object.freeze({
+    origin:
+      typeof config.origin === "string" && config.origin.length > 0
+        ? config.origin
+        : fallbackOrigin,
+    policy:
+      typeof config.policy === "string" && config.policy.length > 0
+        ? config.policy
+        : "allow",
+    scope:
+      typeof config.scope === "string" && config.scope.length > 0
+        ? config.scope
+        : "mcp",
+    sandboxPolicy,
+  });
+}
+
 function normalizeHelperCommand(value) {
   if (
     typeof value !== "string" ||
@@ -89,6 +130,16 @@ function canonicalHelperCwd(value, realpath = fs.realpathSync.native) {
   return canonical;
 }
 
+function hasInvalidHeaderValueCharacter(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 0x08 || (code >= 0x0a && code <= 0x1f) || code === 0x7f) {
+      return true;
+    }
+  }
+  return false;
+}
+
 function normalizeHeaderMap(value, source) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw helperError(
@@ -108,7 +159,7 @@ function normalizeHeaderMap(value, source) {
     if (
       !HEADER_NAME.test(name) ||
       typeof headerValue !== "string" ||
-      /[\0-\x08\x0a-\x1f\x7f]/.test(headerValue) ||
+      hasInvalidHeaderValueCharacter(headerValue) ||
       Buffer.byteLength(headerValue, "utf8") > MAX_HEADER_VALUE_BYTES ||
       (source === "dynamic" && TRANSPORT_OWNED_HEADERS.has(name.toLowerCase()))
     ) {
@@ -138,6 +189,7 @@ function isPathInside(root, candidate) {
  * plugin configs must carry the collector-issued opaque plugin authority.
  */
 export function resolveMcpHeadersHelperContext(config = {}, deps = {}) {
+  const sandboxPolicy = declaredSandboxPolicy(config);
   if (config.origin === "plugin:mcp") {
     const resolvePlugin =
       deps.resolvePluginWorkspaceAuthority || resolvePluginWorkspaceAuthority;
@@ -156,17 +208,15 @@ export function resolveMcpHeadersHelperContext(config = {}, deps = {}) {
     return {
       cwd: pluginRoot,
       pluginRoot,
-      execution: {
+      execution: Object.freeze({
         origin: config.origin,
         policy: config.policy || "allow",
         scope: config.scope || "mcp",
         pluginId: config.pluginId,
         pluginVersion: config.pluginVersion,
         pluginSource: config.pluginSource,
-        ...(config.sandboxPolicy
-          ? { sandboxPolicy: config.sandboxPolicy }
-          : {}),
-      },
+        ...(sandboxPolicy ? { sandboxPolicy } : {}),
+      }),
     };
   }
 
@@ -253,12 +303,30 @@ export function resolveMcpHeadersHelperContext(config = {}, deps = {}) {
         );
       }
     }
-    return { cwd: binding.workspaceRoot, pluginRoot: null, execution: null };
+    return {
+      cwd: binding.workspaceRoot,
+      pluginRoot: null,
+      execution: sandboxExecution(
+        config,
+        sandboxPolicy,
+        `mcp:headers-helper:${scope}`,
+      ),
+    };
+  }
+  if (sandboxPolicy && !binding?.workspaceRoot) {
+    throw helperError(
+      "CC_MCP_HEADERS_HELPER_UNTRUSTED_WORKSPACE",
+      "Policy-bearing MCP headersHelper requires a trusted host workspace",
+    );
   }
   return {
     cwd: binding?.workspaceRoot || path.resolve(deps.cwd || process.cwd()),
     pluginRoot: null,
-    execution: null,
+    execution: sandboxExecution(
+      config,
+      sandboxPolicy,
+      `mcp:headers-helper:${scope}`,
+    ),
   };
 }
 

package/src/lib/mcp-host-recovery-runtime.js

@@ -98,6 +98,7 @@ export function createMcpHostRecoveryRuntime({
   recovery = null,
   recoveryError = null,
   controller = null,
+  dispatchAdmission = null,
 } = {}) {
   const admissionController = tightenRecoveryController(
     controller,
@@ -120,6 +121,7 @@ export function createMcpHostRecoveryRuntime({
           resolveEffect: (serverName, toolName) =>
             resolveHostMcpEffect(bundle, serverName, toolName),
           sessionId,
+          dispatchAdmission,
         })
       : rawClient;
   return Object.freeze({

package/src/lib/mcp-ledger-recovery-admission.js

@@ -813,6 +813,7 @@ export function createRecoveryGuardedMcpClient({
   controller,
   resolveEffect = null,
   sessionId = null,
+  dispatchAdmission = null,
 } = {}) {
   if (!client || typeof client.callTool !== "function") {
     throw new TypeError("MCP client wrapper requires client.callTool()");
@@ -826,6 +827,9 @@ export function createRecoveryGuardedMcpClient({
   if (resolveEffect != null && typeof resolveEffect !== "function") {
     throw new TypeError("MCP client effect resolver must be a function");
   }
+  if (dispatchAdmission != null && typeof dispatchAdmission !== "function") {
+    throw new TypeError("MCP client dispatch admission must be a function");
+  }
 
   const existingGuard = GUARDED_MCP_CLIENTS.get(client);
   if (existingGuard) {
@@ -833,7 +837,8 @@ export function createRecoveryGuardedMcpClient({
       existingGuard.ledger === ledger &&
       existingGuard.controller === controller &&
       existingGuard.resolveEffect === resolveEffect &&
-      existingGuard.sessionId === sessionId
+      existingGuard.sessionId === sessionId &&
+      existingGuard.dispatchAdmission === dispatchAdmission
     ) {
       return client;
     }
@@ -850,6 +855,33 @@ export function createRecoveryGuardedMcpClient({
     // Snapshot before the first await. Admission, durable identity and the raw
     // transport all receive this exact deeply-frozen JSON value.
     const inputSnapshot = snapshotMcpJsonRpcInput(input);
+    let callOptions = rest;
+    if (dispatchAdmission) {
+      const supplied = rest[0];
+      if (
+        supplied != null &&
+        (typeof supplied !== "object" ||
+          Array.isArray(supplied) ||
+          isProxy(supplied))
+      ) {
+        throw new TypeError("MCP call options must be a plain object");
+      }
+      const merged = {};
+      if (supplied) {
+        for (const key of Reflect.ownKeys(supplied)) {
+          if (typeof key !== "string") {
+            throw new TypeError("MCP call options cannot contain symbols");
+          }
+          const descriptor = Object.getOwnPropertyDescriptor(supplied, key);
+          if (!descriptor || !("value" in descriptor)) {
+            throw new TypeError("MCP call options cannot contain accessors");
+          }
+          merged[key] = descriptor.value;
+        }
+      }
+      merged.dispatchAdmission = dispatchAdmission;
+      callOptions = [merged, ...rest.slice(1)];
+    }
     const effect = await resolveHostEffectContract(
       resolveEffect,
       client,
@@ -871,10 +903,13 @@ export function createRecoveryGuardedMcpClient({
         serverName,
         toolName,
         inputSnapshot,
-        ...rest,
+        ...callOptions,
       ]);
     } catch (callError) {
-      if (effect.effectContract.effect !== McpEffect.READ) {
+      if (
+        effect.effectContract.effect !== McpEffect.READ &&
+        safeProperty(callError, "dispatched") !== false
+      ) {
         throw outcomeUnknown(
           controller,
           ticket,
@@ -1060,6 +1095,7 @@ export function createRecoveryGuardedMcpClient({
     controller,
     resolveEffect,
     sessionId,
+    dispatchAdmission,
   });
   return wrappedClient;
 }