chainlesschain 0.163.2 → 0.163.4

package/src/lib/mcp-stdio-workspace-authority.js

@@ -0,0 +1,252 @@
+import fs from "node:fs";
+import path from "node:path";
+import { isProxy } from "node:util/types";
+import { resolveHostHooksV2WorkspaceBinding } from "./hooks-v2-workspace-context.js";
+import { normalizeMcpSandboxPolicy } from "./mcp-sandbox-policy.js";
+import { resolvePluginWorkspaceAuthority } from "./plugin-runtime/sandbox-policy.js";
+import { resolveProjectMcpWorkspaceAuthority } from "./project-mcp-trust.js";
+
+export const MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE =
+  "CC_MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED";
+export const MCP_STDIO_SANDBOX_CWD_INVALID_CODE =
+  "CC_MCP_STDIO_SANDBOX_CWD_INVALID";
+
+function workspaceError(code, message, cause) {
+  const error = new Error(message, cause ? { cause } : undefined);
+  error.code = code;
+  return error;
+}
+
+function dataProperty(owner, key, fallback) {
+  if (!owner || typeof owner !== "object" || isProxy(owner)) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      "MCP stdio sandbox config must be a non-Proxy object",
+    );
+  }
+  const descriptor = Object.getOwnPropertyDescriptor(owner, key);
+  if (!descriptor) return fallback;
+  if (!("value" in descriptor)) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      `MCP stdio sandbox config.${key} must be an own data property`,
+    );
+  }
+  return descriptor.value;
+}
+
+function canonicalDirectory(value, label) {
+  if (typeof value !== "string" || value.length === 0 || value.includes("\0")) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_CWD_INVALID_CODE,
+      `${label} must be a non-empty directory path`,
+    );
+  }
+  try {
+    const canonical = fs.realpathSync.native(path.resolve(value));
+    if (!fs.statSync(canonical).isDirectory()) {
+      throw new Error("not a directory");
+    }
+    return canonical;
+  } catch (cause) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_CWD_INVALID_CODE,
+      `${label} must resolve to an existing directory`,
+      cause,
+    );
+  }
+}
+
+function isPathInside(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return (
+    relative === "" ||
+    (relative !== ".." &&
+      !relative.startsWith(`..${path.sep}`) &&
+      !path.isAbsolute(relative))
+  );
+}
+
+function sandboxPolicyFromConfig(config, serverName) {
+  const raw = dataProperty(config, "sandboxPolicy", null);
+  return normalizeMcpSandboxPolicy(raw, {
+    label: `MCP stdio server "${serverName}" sandboxPolicy`,
+  });
+}
+
+function pluginRootFromConfig(config, deps) {
+  if (dataProperty(config, "origin", null) !== "plugin:mcp") return null;
+  const resolvePlugin =
+    deps.resolvePluginWorkspaceAuthority || resolvePluginWorkspaceAuthority;
+  return resolvePlugin(dataProperty(config, "pluginWorkspaceAuthority", null), {
+    origin: "plugin:mcp",
+    pluginId: dataProperty(config, "pluginId", null),
+    pluginVersion: dataProperty(config, "pluginVersion", null),
+    pluginSource: dataProperty(config, "pluginSource", null),
+  });
+}
+
+function isProjectFileSource(configScope, configSource) {
+  return (
+    configScope === "project" &&
+    typeof configSource === "string" &&
+    path.basename(configSource).toLowerCase() === ".mcp.json"
+  );
+}
+
+function requirePublicWorkspaceRoot(
+  serverName,
+  config,
+  workspaceBinding,
+  deps,
+) {
+  const resolveHost =
+    deps.resolveHostWorkspaceBinding || resolveHostHooksV2WorkspaceBinding;
+  const binding = resolveHost(workspaceBinding);
+  if (!binding?.workspaceRoot) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      `Policy-bearing MCP stdio server "${serverName}" requires a trusted host workspace`,
+    );
+  }
+  const hostRoot = canonicalDirectory(
+    binding.workspaceRoot,
+    `MCP stdio server "${serverName}" host workspace`,
+  );
+  const configScope = dataProperty(config, "configScope", null);
+  const projectPath = dataProperty(config, "projectPath", null);
+  const configSource = dataProperty(config, "configSource", null);
+  const projectAuthority = dataProperty(
+    config,
+    "projectMcpWorkspaceAuthority",
+    null,
+  );
+  const projectFileSource = isProjectFileSource(configScope, configSource);
+
+  if (
+    configScope === "project" &&
+    (projectFileSource || projectAuthority) &&
+    !projectPath
+  ) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      `Project MCP stdio server "${serverName}" is missing its project workspace`,
+    );
+  }
+
+  if ((configScope === "local" || configScope === "project") && projectPath) {
+    const projectRoot = canonicalDirectory(
+      projectPath,
+      `MCP stdio server "${serverName}" project workspace`,
+    );
+    if (!isPathInside(projectRoot, hostRoot)) {
+      throw workspaceError(
+        MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+        `MCP stdio server "${serverName}" does not belong to the trusted host workspace`,
+      );
+    }
+
+    if (projectAuthority || projectFileSource) {
+      const resolveProject =
+        deps.resolveProjectMcpWorkspaceAuthority ||
+        resolveProjectMcpWorkspaceAuthority;
+      const authorityRoot = resolveProject(projectAuthority, {
+        configSource,
+        serverName,
+        url: dataProperty(config, "url", null),
+        transport: dataProperty(config, "transport", null),
+        headersHelper: dataProperty(config, "headersHelper", null),
+      });
+      let canonicalAuthorityRoot = null;
+      try {
+        canonicalAuthorityRoot = authorityRoot
+          ? canonicalDirectory(
+              authorityRoot,
+              `MCP stdio server "${serverName}" project authority`,
+            )
+          : null;
+      } catch {
+        canonicalAuthorityRoot = null;
+      }
+      if (canonicalAuthorityRoot !== projectRoot) {
+        throw workspaceError(
+          MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+          `Project MCP stdio server "${serverName}" is missing its trusted file authority`,
+        );
+      }
+    }
+  }
+
+  return hostRoot;
+}
+
+function requestedWorkingDirectory(config, trustedRoot, serverName) {
+  const requested = dataProperty(config, "cwd", null);
+  if (requested == null || requested === "") return trustedRoot;
+  if (typeof requested !== "string" || requested.includes("\0")) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_CWD_INVALID_CODE,
+      `MCP stdio server "${serverName}" cwd must be a path`,
+    );
+  }
+  const candidate = canonicalDirectory(
+    path.isAbsolute(requested)
+      ? requested
+      : path.resolve(trustedRoot, requested),
+    `MCP stdio server "${serverName}" cwd`,
+  );
+  if (!isPathInside(trustedRoot, candidate)) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_CWD_INVALID_CODE,
+      `MCP stdio server "${serverName}" cwd escapes its trusted workspace`,
+    );
+  }
+  return candidate;
+}
+
+/**
+ * Resolve source-declared MCP isolation against an opaque host/plugin
+ * workspace capability. A policy-bearing launch never derives authority from
+ * process.cwd(); the selected cwd is canonical, existing, and contained by the
+ * trusted root before executable identity or Broker contract issuance.
+ */
+export function resolveMcpStdioSandboxContext(
+  { serverName, config, workspaceBinding },
+  deps = {},
+) {
+  const name = String(serverName || "unknown");
+  const sandboxPolicy = sandboxPolicyFromConfig(config, name);
+  const pluginWorkspaceRoot = pluginRootFromConfig(config, deps);
+
+  if (!sandboxPolicy) {
+    return Object.freeze({
+      sandboxPolicy: null,
+      pluginWorkspaceRoot,
+      workingDirectory: pluginWorkspaceRoot,
+    });
+  }
+
+  if (
+    dataProperty(config, "origin", null) === "plugin:mcp" &&
+    !pluginWorkspaceRoot
+  ) {
+    throw workspaceError(
+      MCP_STDIO_SANDBOX_WORKSPACE_REQUIRED_CODE,
+      `Plugin MCP stdio server "${name}" is missing its trusted workspace authority`,
+    );
+  }
+
+  const trustedRoot = pluginWorkspaceRoot
+    ? canonicalDirectory(
+        pluginWorkspaceRoot,
+        `Plugin MCP stdio server "${name}" workspace`,
+      )
+    : requirePublicWorkspaceRoot(name, config, workspaceBinding, deps);
+  const workingDirectory = requestedWorkingDirectory(config, trustedRoot, name);
+
+  return Object.freeze({
+    sandboxPolicy,
+    pluginWorkspaceRoot,
+    workingDirectory,
+  });
+}

package/src/lib/observability/index.js

@@ -186,6 +186,7 @@ export class ObservabilityRuntime {
           unit: "{invocation}",
           value: 1,
           monotonic: true,
+          aggregationTemporality: 1,
           attributes,
         },
         {
@@ -194,6 +195,7 @@ export class ObservabilityRuntime {
           unit: "ms",
           count: 1,
           sum: durationMs,
+          aggregationTemporality: 1,
           attributes,
         },
       ]);

package/src/lib/observability/otlp-exporter.js

@@ -924,7 +924,7 @@ export class OtlpExporter {
         description: metric.description || "",
         unit: metric.unit || "1",
         histogram: {
-          aggregationTemporality: 2,
+          aggregationTemporality: metric.aggregationTemporality === 1 ? 1 : 2,
           dataPoints: [
             {
               ...point,
@@ -945,7 +945,7 @@ export class OtlpExporter {
           : { asDouble: Number(metric.value) || 0 };
     const data = { dataPoints: [{ ...point, ...number }] };
     if (metric.type === "sum" || metric.type === "counter") {
-      data.aggregationTemporality = 2;
+      data.aggregationTemporality = metric.aggregationTemporality === 1 ? 1 : 2;
       data.isMonotonic = metric.monotonic !== false;
       return {
         name: metric.name,

package/src/lib/packer/pack-update-applier.js

@@ -46,6 +46,13 @@ export const _deps = {
   tmpdir: () => os.tmpdir(),
 };
 
+// A real Windows sidecar performs path, lock-token and digest checks before it
+// publishes the readiness marker. Loaded hosted runners have exceeded the old
+// 10 second allowance while still completing successfully. Keep the parent in
+// charge of the lock until the marker is verified, but give the safety
+// preflight a bounded budget that also covers heavily contended machines.
+export const WINDOWS_SIDECAR_READY_TIMEOUT_MS = 30_000;
+
 export async function scheduleReplace(ctx = {}) {
   const {
     newExePath,
@@ -778,7 +785,7 @@ function scheduleWindowsTransaction(ctx) {
           waitForReadyImpl({
             readyPath,
             transactionId,
-            timeoutMs: 10_000,
+            timeoutMs: WINDOWS_SIDECAR_READY_TIMEOUT_MS,
             child,
           }),
         ) && !childError;

package/src/lib/packer/pkg-config-generator.js

@@ -18,8 +18,41 @@
  */
 
 import fs from "node:fs";
+import { createRequire } from "node:module";
 import path from "node:path";
 
+function capsuleBuilderAssets(cliRoot) {
+  const requireFromCli = createRequire(path.join(cliRoot, "package.json"));
+  const realpath = fs.realpathSync.native || fs.realpathSync;
+  let packageJsonPath;
+  try {
+    packageJsonPath = realpath(
+      requireFromCli.resolve("esbuild-wasm/package.json"),
+    );
+  } catch (cause) {
+    throw new Error(
+      `Cannot resolve the pinned esbuild-wasm package for pkg assets: ${cause.message}`,
+    );
+  }
+  const packageRoot = path.dirname(packageJsonPath);
+  const sourceAssets = [
+    packageJsonPath,
+    path.join(packageRoot, "lib", "browser.js"),
+    path.join(packageRoot, "esbuild.wasm"),
+    path.join(cliRoot, "src", "lib", "mcp-stdio-capsule-builder-worker.cjs"),
+    path.join(cliRoot, "src", "lib", "mcp-stdio-immutable-vfs-resolver.cjs"),
+  ];
+  for (const asset of sourceAssets) {
+    const stat = fs.lstatSync(asset);
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      throw new Error(
+        `Pinned capsule builder pkg asset is not a regular file: ${asset}`,
+      );
+    }
+  }
+  return sourceAssets.map((asset) => realpath(asset));
+}
+
 /**
  * @param {object} ctx
  * @param {string} ctx.cliRoot                packages/cli/
@@ -396,6 +429,7 @@ export function generatePkgConfig(ctx) {
     `${posixify(cliRoot)}/src/lib/process-execution-broker/windows-sandbox-helper.exe`,
     `${posixify(cliRoot)}/src/lib/process-execution-broker/windows-sandbox.cs`,
     `${posixify(cliRoot)}/install/install.ps1`,
+    ...capsuleBuilderAssets(cliRoot).map(posixify),
   ];
   if (prebuildsDir) assets.push(`${posixify(prebuildsDir)}/**/*`);
   // Project mode: bundle the collected .chainlesschain/ snapshot as an asset.

package/src/lib/plugin-runtime/sandbox-policy.js

@@ -20,6 +20,28 @@ const SUPPORTED_BOUNDARIES = new Set(PLUGIN_SANDBOX_BOUNDARIES);
 const PLUGIN_WORKSPACE_AUTHORITY_KIND = "trusted-plugin-workspace";
 const pluginWorkspaceAuthorities = new WeakMap();
 
+function directoryGeneration(stat) {
+  return stat.birthtimeNs > 0n
+    ? `birth:${stat.birthtimeNs.toString()}`
+    : `ctime:${stat.ctimeNs.toString()}`;
+}
+
+function directoryIdentity(stat) {
+  return Object.freeze({
+    device: stat.dev,
+    inode: stat.ino,
+    generation: directoryGeneration(stat),
+  });
+}
+
+function sameDirectoryIdentity(left, right) {
+  return (
+    left.device === right.dev &&
+    left.inode === right.ino &&
+    left.generation === directoryGeneration(right)
+  );
+}
+
 function invalidPolicy(message) {
   const error = new Error(message);
   error.code = "ERR_PLUGIN_SANDBOX_POLICY_INVALID";
@@ -69,7 +91,7 @@ export function issuePluginWorkspaceAuthority(value = {}) {
   try {
     const implementation = fs.realpathSync.native || fs.realpathSync;
     canonicalRoot = implementation.call(fs.realpathSync, requestedRoot);
-    stat = fs.statSync(canonicalRoot);
+    stat = fs.statSync(canonicalRoot, { bigint: true });
   } catch {
     throw invalidPolicy("trusted plugin workspace root is unavailable");
   }
@@ -92,7 +114,11 @@ export function issuePluginWorkspaceAuthority(value = {}) {
   });
   pluginWorkspaceAuthorities.set(
     authority,
-    Object.freeze({ root: canonicalRoot, provenance }),
+    Object.freeze({
+      root: canonicalRoot,
+      identity: directoryIdentity(stat),
+      provenance,
+    }),
   );
   return authority;
 }
@@ -117,6 +143,20 @@ export function resolvePluginWorkspaceAuthority(authority, provenance = {}) {
   ) {
     return null;
   }
+  try {
+    const implementation = fs.realpathSync.native || fs.realpathSync;
+    const currentRoot = implementation.call(fs.realpathSync, binding.root);
+    const currentStat = fs.statSync(currentRoot, { bigint: true });
+    if (
+      currentRoot !== binding.root ||
+      !currentStat.isDirectory() ||
+      !sameDirectoryIdentity(binding.identity, currentStat)
+    ) {
+      return null;
+    }
+  } catch {
+    return null;
+  }
   return binding.root;
 }