chainlesschain 0.163.7 → 0.164.0

package/src/lib/ide-context.js

@@ -72,6 +72,14 @@ export function hasIdeTerminalTool(mcp) {
   );
 }
 
+/** Does this MCP surface expose the fixed-budget Context Center projection? */
+export function hasIdeContextCenterTool(mcp) {
+  return !!(
+    mcp?.mcpClient?.callTool &&
+    mcp.externalToolExecutors?.mcp__ide__getContextCenter?.kind === "mcp"
+  );
+}
+
 /**
  * Read an MCP tools/call result's first text block as JSON. The IDE bridge
  * servers always wrap handler data as
@@ -756,15 +764,18 @@ const WORKSPACE_DIAG_CAP = 50;
 const TERMINAL_MENTION_LIMIT = 5;
 /** And a roomier per-command output cap, since the user asked for it. */
 const TERMINAL_MENTION_OUTPUT_CAP = 2000;
+/** Explicit @context uses the shared deterministic Context Center budget. */
+const CONTEXT_MENTION_TOKEN_BUDGET = 4096;
 
-// `@selection` / `@diagnostics` / `@terminal` preceded by start / whitespace /
-// opening bracket-quote (so `foo@selection` and email-like text never match),
-// each taken as a whole word.
-const IDE_MENTION_RE = /(^|[\s("'`[{])@(selection|diagnostics|terminal)\b/gi;
+// IDE pseudo-mentions preceded by start / whitespace / opening bracket-quote
+// (so `foo@selection` and email-like text never match), each taken as a whole
+// word.
+const IDE_MENTION_RE =
+  /(^|[\s("'`[{])@(selection|diagnostics|terminal|context)\b/gi;
 
 /**
  * Unique IDE pseudo-mentions in the text, in first-seen order. Returns a
- * subset of `["selection", "diagnostics", "terminal"]`.
+ * subset of `["selection", "diagnostics", "terminal", "context"]`.
  */
 export function findIdeMentions(text) {
   const src = typeof text === "string" ? text : "";
@@ -870,7 +881,64 @@ export function formatTerminalMention(data) {
 }
 
 /**
- * Expand `@selection` / `@diagnostics` / `@terminal` mentions found in `text`
+ * Render the versioned Context Center projection for an explicit `@context`.
+ * The bridge already applies the fixed content budget; this formatter keeps a
+ * strict field allowlist and redacts secret-shaped text before prompt injection.
+ */
+export function formatContextCenterMention(data, opts = {}) {
+  if (
+    data?.schema !== "cc-context-center/v1" ||
+    !Array.isArray(data.chips) ||
+    data.chips.length === 0
+  ) {
+    return null;
+  }
+  const env = opts.env || process.env;
+  const chips = data.chips
+    .slice(0, 64)
+    .filter((chip) => chip && typeof chip === "object")
+    .map((chip) => ({
+      id: String(chip.id || ""),
+      kind: String(chip.kind || ""),
+      label: String(chip.label || ""),
+      source: String(chip.source || ""),
+      scope: String(chip.scope || ""),
+      freshness:
+        chip.freshness && typeof chip.freshness === "object"
+          ? chip.freshness
+          : null,
+      range: chip.range && typeof chip.range === "object" ? chip.range : null,
+      estimatedTokens: Number(chip.estimatedTokens) || 0,
+      allocatedTokens: Number(chip.allocatedTokens) || 0,
+      status: String(chip.status || ""),
+      pinned: chip.pinned === true,
+      refreshable: chip.refreshable !== false,
+      reason: String(chip.reason || ""),
+      content: redactSecretsInText(String(chip.content || ""), { env }),
+      contentTruncated: chip.contentTruncated === true,
+    }));
+  if (chips.length === 0) return null;
+  const payload = {
+    schema: data.schema,
+    workspaceId: typeof data.workspaceId === "string" ? data.workspaceId : null,
+    selectionAlgorithm: String(data.selectionAlgorithm || ""),
+    budget: data.budget && typeof data.budget === "object" ? data.budget : null,
+    chips,
+  };
+  const json = JSON.stringify(payload, null, 2).replace(
+    /<\/ide-context-center/gi,
+    "<\\/ide-context-center",
+  );
+  return (
+    '<ide-context-center note="referenced via @context — deterministic live IDE context">\n' +
+    json +
+    "\n</ide-context-center>"
+  );
+}
+
+/**
+ * Expand `@selection` / `@diagnostics` / `@terminal` / `@context` mentions
+ * found in `text`
  * against the connected IDE. Returns
  *   { block: string|null, expanded: string[], warnings: string[] }
  * where `block` is the concatenated context block(s) to APPEND to the user
@@ -958,6 +1026,26 @@ export async function expandIdeMentions(text, mcp, opts = {}) {
         } else {
           out.warnings.push("@terminal — no recent commands (left as-is)");
         }
+      } else if (kind === "context") {
+        if (!hasIdeContextCenterTool(mcp)) {
+          out.warnings.push(
+            "@context — no IDE bridge / Context Center support (left as-is)",
+          );
+          continue;
+        }
+        const data = await callIdeToolJson(
+          mcp,
+          "mcp__ide__getContextCenter",
+          { budgetTokens: CONTEXT_MENTION_TOKEN_BUDGET },
+          Math.max(timeoutMs, 6000),
+        );
+        const b = formatContextCenterMention(data, { env });
+        if (b) {
+          blocks.push(b);
+          out.expanded.push("context");
+        } else {
+          out.warnings.push("@context — no live context chips (left as-is)");
+        }
       }
     } catch {
       // best-effort: a single failed mention never blocks the turn

package/src/lib/mcp-stdio-package-materialization.js

@@ -36,9 +36,9 @@ export const MCP_STDIO_PACKAGE_MATERIALIZATION_CHANGED_CODE =
   "CC_MCP_STDIO_PACKAGE_MATERIALIZATION_CHANGED";
 
 const MATERIALIZATION_SCHEMA =
-  "chainlesschain.mcp-stdio-package-materialization/v3";
-const MATERIALIZATION_VERSION = 3;
-const CAPSULE_SCHEMA = "chainlesschain.mcp-stdio-node-capsule/v2";
+  "chainlesschain.mcp-stdio-package-materialization/v5";
+const MATERIALIZATION_VERSION = 5;
+const CAPSULE_SCHEMA = "chainlesschain.mcp-stdio-node-capsule/v4";
 const CAPSULE_RELATIVE_PATH = "capsule/server.cjs";
 const CAPSULE_BUILDER = "esbuild-wasm";
 const CAPSULE_BUILDER_VERSION = "0.28.1";
@@ -64,6 +64,25 @@ const CAPSULE_RESOLVER_SHA256 =
 const CAPSULE_RESOLVER_BYTES = 24_417;
 const CAPSULE_STDIN_WRAPPER_SCHEMA =
   "chainlesschain.mcp-stdio-capsule-stdin-wrapper/v1";
+const CAPSULE_BUILTIN_POLICY_SCHEMA =
+  "chainlesschain.mcp-stdio-static-builtin-policy/v2";
+const CAPSULE_EXECUTION_CONTEXT_ISOLATION =
+  "required-mcp-os-sandbox-boundaries-v1";
+// These builtins can create a fresh JavaScript isolate/process or evaluate
+// code through a privileged runtime surface. Same-realm Module guards do not
+// propagate there, so their presence is bound explicitly to the capsule
+// manifest and is admissible only through the product's mandatory
+// filesystem/network/process-tree/code-snapshot OS sandbox contract.
+const CAPSULE_EXECUTION_CONTEXT_BUILTINS = new Set([
+  "child_process",
+  "cluster",
+  "inspector",
+  "inspector/promises",
+  "vm",
+  "worker_threads",
+]);
+const CAPSULE_BUILTIN_ALLOWLIST_MARKER =
+  "__CHAINLESSCHAIN_MCP_STATIC_BUILTIN_ALLOWLIST_8F43C70E__";
 const INDEX_LABEL = "MCP stdio package materialization index";
 const MANIFEST_LABEL = "MCP stdio package materialization manifest";
 const MAX_FILES = 10_000;
@@ -128,7 +147,7 @@ export function getMcpStdioPackageMaterializationRoot(options = {}) {
   return path.resolve(
     options.root ||
       process.env.CC_MCP_PACKAGE_MATERIALIZATION_ROOT ||
-      path.join(getCacheDir(), "mcp-stdio-package-materializations-v3"),
+      path.join(getCacheDir(), "mcp-stdio-package-materializations-v5"),
   );
 }
 
@@ -138,7 +157,7 @@ export function getMcpStdioPackageMaterializationIndexPath(options = {}) {
       process.env.CC_MCP_PACKAGE_MATERIALIZATION_INDEX ||
       path.join(
         getMachineSecurityAnchorDir(),
-        "mcp-stdio-package-materializations-v3.json",
+        "mcp-stdio-package-materializations-v5.json",
       ),
   );
 }
@@ -1036,20 +1055,32 @@ async function runCapsuleBuilderWorker({
 function capsuleRuntimeGuard() {
   return `;(() => {
   const Module = require("node:module");
-  const allowed = new Set(Module.builtinModules.flatMap((name) => [name, name.startsWith("node:") ? name : "node:" + name]));
+  const known = new Set(Module.builtinModules.flatMap((name) => [name, name.startsWith("node:") ? name : "node:" + name]));
+  const allowed = new Set(${CAPSULE_BUILTIN_ALLOWLIST_MARKER});
   const originalLoad = Module._load;
   const originalResolveFilename = Module._resolveFilename;
   const blocked = (kind, request) => {
     const error = new Error("MCP stdio capsule blocked " + kind + (request === undefined ? "" : ": " + String(request)));
-    error.code = kind === "native module loading" ? "CC_MCP_STDIO_NATIVE_MODULE_BLOCKED" : "CC_MCP_STDIO_EXTERNAL_MODULE_BLOCKED";
+    error.code = kind === "native module loading"
+      ? "CC_MCP_STDIO_NATIVE_MODULE_BLOCKED"
+      : kind === "builtin module loading" || kind === "internal binding loading"
+        ? "CC_MCP_STDIO_BUILTIN_MODULE_BLOCKED"
+        : "CC_MCP_STDIO_EXTERNAL_MODULE_BLOCKED";
     throw error;
   };
+  const assertAllowedModule = (kind, request) => {
+    if (typeof request !== "string") blocked(kind, request);
+    if (known.has(request) && !allowed.has(request)) {
+      blocked("builtin module loading", request);
+    }
+    if (!known.has(request)) blocked(kind, request);
+  };
   Object.defineProperty(Module, "_load", {
     configurable: false,
     enumerable: false,
     writable: false,
     value: function(request) {
-      if (typeof request !== "string" || !allowed.has(request)) blocked("external module loading", request);
+      assertAllowedModule("external module loading", request);
       return Reflect.apply(originalLoad, this, arguments);
     },
   });
@@ -1058,10 +1089,33 @@ function capsuleRuntimeGuard() {
     enumerable: false,
     writable: false,
     value: function(request) {
-      if (typeof request !== "string" || !allowed.has(request)) blocked("external module resolution", request);
+      assertAllowedModule("external module resolution", request);
       return Reflect.apply(originalResolveFilename, this, arguments);
     },
   });
+  if (typeof process.getBuiltinModule === "function") {
+    const originalGetBuiltinModule = process.getBuiltinModule;
+    Object.defineProperty(process, "getBuiltinModule", {
+      configurable: false,
+      enumerable: false,
+      writable: false,
+      value: function(request) {
+        if (typeof request !== "string" || !allowed.has(request)) {
+          blocked("builtin module loading", request);
+        }
+        return Reflect.apply(originalGetBuiltinModule, this, arguments);
+      },
+    });
+  }
+  for (const bindingName of ["binding", "_linkedBinding"]) {
+    if (typeof process[bindingName] !== "function") continue;
+    Object.defineProperty(process, bindingName, {
+      configurable: false,
+      enumerable: false,
+      writable: false,
+      value: function(request) { blocked("internal binding loading", request); },
+    });
+  }
   Object.defineProperty(process, "dlopen", {
     configurable: false,
     enumerable: false,
@@ -1071,6 +1125,54 @@ function capsuleRuntimeGuard() {
 })();`;
 }
 
+function expandBuiltinAllowlist(externalBuiltins) {
+  const allowed = new Set();
+  for (const name of externalBuiltins) {
+    const canonical = name.startsWith("node:") ? name.slice(5) : name;
+    allowed.add(canonical);
+    allowed.add(`node:${canonical}`);
+  }
+  return Object.freeze([...allowed].sort());
+}
+
+function executionContextBuiltins(externalBuiltins) {
+  return Object.freeze(
+    [
+      ...new Set(
+        externalBuiltins
+          .map((name) => (name.startsWith("node:") ? name.slice(5) : name))
+          .filter((name) => CAPSULE_EXECUTION_CONTEXT_BUILTINS.has(name))
+          .map((name) => `node:${name}`),
+      ),
+    ].sort(),
+  );
+}
+
+function bindCapsuleBuiltinAllowlist(outputBytes, allowedBuiltins) {
+  const source = Buffer.from(
+    outputBytes.buffer,
+    outputBytes.byteOffset,
+    outputBytes.byteLength,
+  ).toString("utf8");
+  const markerCount = source.split(CAPSULE_BUILTIN_ALLOWLIST_MARKER).length - 1;
+  if (markerCount !== 1) {
+    throw new Error(
+      "MCP capsule output did not retain exactly one host builtin-policy marker",
+    );
+  }
+  const output = Buffer.from(
+    source.replace(
+      CAPSULE_BUILTIN_ALLOWLIST_MARKER,
+      JSON.stringify(allowedBuiltins),
+    ),
+    "utf8",
+  );
+  if (output.length <= 0 || output.length > MAX_CAPSULE_BYTES) {
+    throw new Error("MCP capsule output exceeds its post-policy byte limit");
+  }
+  return output;
+}
+
 export function esbuildRelativeEntrypointArg(
   entrypointRelative,
   canonicalSnapshotRoot,
@@ -1318,11 +1420,14 @@ async function buildCapsule({
     }
   }
 
-  const output = Buffer.from(
-    result.output.buffer,
-    result.output.byteOffset,
-    result.output.byteLength,
+  const normalizedExternalBuiltins = Object.freeze(
+    [...new Set(externalBuiltins)].sort(),
   );
+  const allowedBuiltins = expandBuiltinAllowlist(normalizedExternalBuiltins);
+  const transitiveBuiltins = executionContextBuiltins(
+    normalizedExternalBuiltins,
+  );
+  const output = bindCapsuleBuiltinAllowlist(result.output, allowedBuiltins);
   let descriptor;
   try {
     descriptor = _deps.fs.openSync(
@@ -1388,7 +1493,17 @@ async function buildCapsule({
     nodeTarget: "node22",
     inputCount: inputs.length,
     inputDigest: sha256(canonicalJson(inputs)),
-    externalBuiltins: Object.freeze([...new Set(externalBuiltins)].sort()),
+    externalBuiltins: normalizedExternalBuiltins,
+    builtinPolicy: Object.freeze({
+      schema: CAPSULE_BUILTIN_POLICY_SCHEMA,
+      mode: "static-external-only",
+      allowedBuiltins,
+      executionContextBuiltins: transitiveBuiltins,
+      transitiveIsolation:
+        transitiveBuiltins.length > 0
+          ? CAPSULE_EXECUTION_CONTEXT_ISOLATION
+          : "not-required",
+    }),
   });
 }
 
@@ -1446,6 +1561,22 @@ function validateManifest(manifest) {
     manifest.capsule.externalBuiltins.some(
       (name) => typeof name !== "string" || !NODE_BUILTINS.has(name),
     ) ||
+    manifest.capsule?.builtinPolicy?.schema !== CAPSULE_BUILTIN_POLICY_SCHEMA ||
+    manifest.capsule?.builtinPolicy?.mode !== "static-external-only" ||
+    !Array.isArray(manifest.capsule?.builtinPolicy?.allowedBuiltins) ||
+    manifest.capsule.builtinPolicy.allowedBuiltins.some(
+      (name) => typeof name !== "string" || !NODE_BUILTINS.has(name),
+    ) ||
+    !Array.isArray(manifest.capsule?.builtinPolicy?.executionContextBuiltins) ||
+    manifest.capsule.builtinPolicy.executionContextBuiltins.some(
+      (name) =>
+        typeof name !== "string" ||
+        !name.startsWith("node:") ||
+        !CAPSULE_EXECUTION_CONTEXT_BUILTINS.has(name.slice(5)),
+    ) ||
+    !["not-required", CAPSULE_EXECUTION_CONTEXT_ISOLATION].includes(
+      manifest.capsule?.builtinPolicy?.transitiveIsolation,
+    ) ||
     !Array.isArray(manifest.files) ||
     !Number.isSafeInteger(manifest.fileCount) ||
     !Number.isSafeInteger(manifest.totalBytes) ||
@@ -1464,6 +1595,18 @@ function validateManifest(manifest) {
     manifest.capsule.inputCount > manifest.fileCount ||
     canonicalJson(manifest.capsule.externalBuiltins) !==
       canonicalJson([...new Set(manifest.capsule.externalBuiltins)].sort()) ||
+    canonicalJson(manifest.capsule.builtinPolicy.allowedBuiltins) !==
+      canonicalJson(
+        expandBuiltinAllowlist(manifest.capsule.externalBuiltins),
+      ) ||
+    canonicalJson(manifest.capsule.builtinPolicy.executionContextBuiltins) !==
+      canonicalJson(
+        executionContextBuiltins(manifest.capsule.externalBuiltins),
+      ) ||
+    manifest.capsule.builtinPolicy.transitiveIsolation !==
+      (manifest.capsule.builtinPolicy.executionContextBuiltins.length > 0
+        ? CAPSULE_EXECUTION_CONTEXT_ISOLATION
+        : "not-required") ||
     sha256(canonicalJson(manifest.files)) !== manifest.closureDigest
   ) {
     throw materializationError(
@@ -1591,6 +1734,15 @@ function verifyPublishedGeneration(root, record, expectedFingerprint) {
       capsule: Object.freeze({
         ...manifest.capsule,
         externalBuiltins: Object.freeze([...manifest.capsule.externalBuiltins]),
+        builtinPolicy: Object.freeze({
+          ...manifest.capsule.builtinPolicy,
+          allowedBuiltins: Object.freeze([
+            ...manifest.capsule.builtinPolicy.allowedBuiltins,
+          ]),
+          executionContextBuiltins: Object.freeze([
+            ...manifest.capsule.builtinPolicy.executionContextBuiltins,
+          ]),
+        }),
       }),
       closureDigest: manifest.closureDigest,
       fileCount: manifest.fileCount,

package/src/lib/packer/pkg-config-generator.js

@@ -428,6 +428,8 @@ export function generatePkgConfig(ctx) {
     `${posixify(cliRoot)}/src/lib/process-execution-broker/windows-sandbox-helper.dll`,
     `${posixify(cliRoot)}/src/lib/process-execution-broker/windows-sandbox-helper.exe`,
     `${posixify(cliRoot)}/src/lib/process-execution-broker/windows-sandbox.cs`,
+    `${posixify(cliRoot)}/src/lib/process-execution-broker/macos-mcp-launcher.c`,
+    `${posixify(cliRoot)}/src/lib/process-execution-broker/macos-mcp-launcher-protocol.json`,
     `${posixify(cliRoot)}/install/install.ps1`,
     ...capsuleBuilderAssets(cliRoot).map(posixify),
   ];

package/src/lib/permission-authority.js

@@ -0,0 +1,77 @@
+/** Resolve static settings plus CLI-owned workspace-scoped permission rules. */
+
+import settingsLoader from "./settings-loader.cjs";
+import { ScopedPermissionStore } from "./scoped-permission-store.js";
+
+const { applyManagedPermissionPolicy, loadSettings } = settingsLoader;
+const KINDS = ["allow", "ask", "deny"];
+
+function cloneRules(rules) {
+  return Object.fromEntries(
+    KINDS.map((kind) => [kind, [...(rules?.[kind] || [])]]),
+  );
+}
+
+function hasRules(rules) {
+  return KINDS.some((kind) => rules[kind].length > 0);
+}
+
+export function loadPermissionAuthority({
+  cwd = process.cwd(),
+  settingsFile = null,
+  managedSettingsFile = null,
+  env = process.env,
+  baseRules = null,
+  scopedStore = null,
+} = {}) {
+  const loaded = loadSettings({
+    cwd,
+    settingsFile,
+    managedSettingsFile,
+    env,
+  });
+  const sources = baseRules ? {} : { ...loaded.sources };
+  let rules = baseRules
+    ? applyManagedPermissionPolicy(baseRules, loaded.managed, sources)
+    : cloneRules(loaded.rules);
+  let scoped = null;
+
+  // Explicit caller rules retain their historical replacement semantics.
+  // Managed-only policy also suppresses every user-owned scoped grant.
+  if (!baseRules) {
+    scoped = (scopedStore || new ScopedPermissionStore({ cwd })).list();
+    const managedOnly =
+      loaded.managed?.allowManagedPermissionRulesOnly === true;
+    scoped = {
+      ...scoped,
+      rules: scoped.rules.map((record) => ({
+        ...record,
+        effectiveStatus:
+          managedOnly && record.status === "active"
+            ? "suppressed-by-managed-policy"
+            : record.status,
+      })),
+    };
+    if (!managedOnly) {
+      for (const record of scoped.rules) {
+        if (record.status !== "active") continue;
+        if (!rules[record.decision].includes(record.rule)) {
+          rules[record.decision].push(record.rule);
+          sources[`${record.decision}:${record.rule}`] = `scoped:${record.id}`;
+        }
+      }
+    }
+  }
+
+  return {
+    ...loaded,
+    rules,
+    sources,
+    scoped,
+    hasRules: hasRules(rules),
+  };
+}
+
+export function createPermissionRulesProvider(options = {}) {
+  return () => loadPermissionAuthority(options);
+}