chainlesschain 0.163.7 → 0.164.0

package/src/lib/sub-agent-context.js

@@ -323,6 +323,7 @@ export class SubAgentContext {
     // parent's policy, Plan lock, workspace sandbox, or unattended boundary.
     this._parentAuthority = Object.freeze({
       permissionRules: options.permissionRules || null,
+      permissionRulesProvider: options.permissionRulesProvider || null,
       hostManagedToolPolicy: options.hostManagedToolPolicy || null,
       planManager: options.planManager || null,
       sandbox: options.sandbox || null,
@@ -618,6 +619,9 @@ export class SubAgentContext {
     if (authority.permissionRules) {
       options.permissionRules = authority.permissionRules;
     }
+    if (authority.permissionRulesProvider) {
+      options.permissionRulesProvider = authority.permissionRulesProvider;
+    }
     if (authority.hostManagedToolPolicy) {
       options.hostManagedToolPolicy = authority.hostManagedToolPolicy;
     }

package/src/lib/workflow-definition-contract.js

@@ -0,0 +1,149 @@
+import { createHash } from "node:crypto";
+
+export const WORKFLOW_DEFINITION_SCHEMA = "cc-dynamic-workflow-definition/v1";
+export const COWORK_WORKFLOW_RECORD_SCHEMA = "cc-cowork-workflow-record/v1";
+export const MAX_WORKFLOW_DEFINITION_BYTES = 1024 * 1024;
+
+function stableJsonValue(value, state = { nodes: 0, depth: 0 }) {
+  state.nodes += 1;
+  if (state.nodes > 20_000 || state.depth > 32) {
+    throw new TypeError("workflow definition exceeds canonicalization limits");
+  }
+  if (
+    value === null ||
+    typeof value === "boolean" ||
+    typeof value === "string"
+  ) {
+    return value;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("workflow definition contains a non-finite number");
+    }
+    return Object.is(value, -0) ? 0 : value;
+  }
+  if (Array.isArray(value)) {
+    const childState = { ...state, depth: state.depth + 1 };
+    const output = value.map((item) => stableJsonValue(item, childState));
+    state.nodes = childState.nodes;
+    return output;
+  }
+  if (value && typeof value === "object") {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new TypeError(
+        "workflow definition must contain plain JSON objects",
+      );
+    }
+    const childState = { ...state, depth: state.depth + 1 };
+    const output = {};
+    for (const key of Object.keys(value).sort()) {
+      const child = value[key];
+      if (child === undefined) continue;
+      if (["function", "symbol", "bigint"].includes(typeof child)) {
+        throw new TypeError("workflow definition contains a non-JSON value");
+      }
+      output[key] = stableJsonValue(child, childState);
+    }
+    state.nodes = childState.nodes;
+    return output;
+  }
+  throw new TypeError("workflow definition contains a non-JSON value");
+}
+
+function deepFreeze(value) {
+  if (!value || typeof value !== "object" || Object.isFrozen(value)) {
+    return value;
+  }
+  for (const child of Object.values(value)) deepFreeze(child);
+  return Object.freeze(value);
+}
+
+function digestDefinition(definition) {
+  const canonical = JSON.stringify(definition);
+  if (Buffer.byteLength(canonical, "utf8") > MAX_WORKFLOW_DEFINITION_BYTES) {
+    throw new TypeError(
+      `workflow definition exceeds ${MAX_WORKFLOW_DEFINITION_BYTES} bytes`,
+    );
+  }
+  return `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
+}
+
+function integrityError(message) {
+  const error = new Error(message);
+  error.code = "WORKFLOW_DEFINITION_INTEGRITY";
+  return error;
+}
+
+export function normalizeWorkflowDefinitionDigest(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim().toLowerCase();
+  return /^sha256:[a-f0-9]{64}$/u.test(normalized) ? normalized : null;
+}
+
+export function createWorkflowDefinitionAuthority(workflow) {
+  const definition = deepFreeze(stableJsonValue(workflow));
+  return Object.freeze({
+    schema: WORKFLOW_DEFINITION_SCHEMA,
+    definitionDigest: digestDefinition(definition),
+    definition,
+  });
+}
+
+export function createCoworkWorkflowRecord(workflow) {
+  const authority = createWorkflowDefinitionAuthority(workflow);
+  const record = {
+    schema: COWORK_WORKFLOW_RECORD_SCHEMA,
+    definitionSchema: authority.schema,
+    definitionDigest: authority.definitionDigest,
+    definition: authority.definition,
+  };
+  const serialized = JSON.stringify(record, null, 2);
+  if (Buffer.byteLength(serialized, "utf8") > MAX_WORKFLOW_DEFINITION_BYTES) {
+    throw new TypeError(
+      `workflow definition exceeds ${MAX_WORKFLOW_DEFINITION_BYTES} bytes`,
+    );
+  }
+  return Object.freeze(record);
+}
+
+export function verifyCoworkWorkflowRecord(value, options = {}) {
+  if (
+    value?.schema !== COWORK_WORKFLOW_RECORD_SCHEMA &&
+    options.allowLegacy === true
+  ) {
+    const authority = createWorkflowDefinitionAuthority(value);
+    return Object.freeze({
+      status: "legacy-unversioned",
+      recordSchema: null,
+      definitionSchema: authority.schema,
+      definitionDigest: authority.definitionDigest,
+      definition: authority.definition,
+    });
+  }
+  if (!value || value.schema !== COWORK_WORKFLOW_RECORD_SCHEMA) {
+    throw integrityError(
+      `workflow record must use ${COWORK_WORKFLOW_RECORD_SCHEMA}`,
+    );
+  }
+  if (value.definitionSchema !== WORKFLOW_DEFINITION_SCHEMA) {
+    throw integrityError("workflow definition schema is unsupported");
+  }
+  const declaredDigest = normalizeWorkflowDefinitionDigest(
+    value.definitionDigest,
+  );
+  if (!declaredDigest) {
+    throw integrityError("workflow definition digest is invalid");
+  }
+  const authority = createWorkflowDefinitionAuthority(value.definition);
+  if (authority.definitionDigest !== declaredDigest) {
+    throw integrityError("workflow definition digest mismatch");
+  }
+  return Object.freeze({
+    status: "versioned",
+    recordSchema: COWORK_WORKFLOW_RECORD_SCHEMA,
+    definitionSchema: authority.schema,
+    definitionDigest: authority.definitionDigest,
+    definition: authority.definition,
+  });
+}

package/src/repl/agent-repl.js

@@ -25,6 +25,7 @@ import path from "path";
 import { randomUUID } from "node:crypto";
 import { isPromise, isProxy } from "node:util/types";
 import { logger } from "../lib/logger.js";
+import { captureAmbientExecutionLocation } from "../lib/execution-location-runtime.js";
 import { issueMcpStdioExecutionAuthority } from "../lib/mcp-stdio-execution-authority.js";
 import { getPlanModeManager, PlanState } from "../lib/plan-mode.js";
 import { createVimState, feedNormalKey } from "../lib/repl-vim.js";
@@ -88,6 +89,7 @@ import {
   persistSideEffectLedger,
 } from "../lib/side-effect-ledger-store.js";
 import { operationIdempotencyKey } from "../lib/idempotency.js";
+import { collectToolResourceIdentifiers } from "../lib/permission-side-effect-center.js";
 import {
   preserveDurableSystemMessageProvenance,
   projectCanonicalResumeMessages,
@@ -173,6 +175,7 @@ import {
   createPromptInteractionSurface,
   mergeClipboardImageChips,
 } from "./prompt-interactions.js";
+import { createSystemClipboardImageBinding } from "./clipboard-image.js";
 import {
   buildPermissionPrompt,
   resolveAskIdleTimeoutMs,
@@ -407,9 +410,11 @@ export async function runReplDirectToolWithLedger({
 let _hookDb = null;
 let _compressor = null;
 let _approvalGate = null;
-// .claude/settings.json permission rules (deny > ask > allow) + an interactive
-// confirmer for `ask` matches. Loaded once at REPL startup; null = no file.
+// Static + CLI-owned scoped permission rules (deny > ask > allow) and an
+// interactive confirmer for `ask` matches. Scoped rules are refreshed at each
+// tool boundary so TTL expiry and external revocation affect a live session.
 let _permissionRules = null;
+let _permissionRulesProvider = null;
 let _permissionConfirm = null;
 let _managedPermissionRulesOnly = false;
 // .claude/settings.json `hooks` block (decision-capable PreToolUse/PostToolUse).
@@ -546,6 +551,7 @@ async function executeTool(name, args) {
     cwd: process.cwd(),
     approvalGate: _approvalGate,
     permissionRules: _permissionRules,
+    permissionRulesProvider: _permissionRulesProvider,
     permissionConfirm: _permissionConfirm,
     settingsHooks: _settingsHooks,
     classifyAllShell: _classifyAllShell,
@@ -770,6 +776,12 @@ export async function agentLoop(messages, options) {
               key: sideEffect.key,
               meta: {
                 tool: event.tool,
+                toolUseId: event.tool_use_id || null,
+                turnId: event.turn_id || null,
+                resources: collectToolResourceIdentifiers(
+                  event.tool,
+                  event.args,
+                ),
                 idempotencyKey: operationIdempotencyKey({
                   tool: event.tool,
                   args: event.args,
@@ -3271,9 +3283,14 @@ async function startAgentReplInWorkspaceOwned(
   // Load .claude/settings.json permission rules + wire an interactive confirmer
   // so `ask` rules prompt (rather than fall closed like headless does).
   try {
-    const { loadSettings, readBooleanSetting } =
-      await import("../lib/settings-loader.cjs");
-    const loaded = loadSettings({ cwd: process.cwd() });
+    const { readBooleanSetting } = await import("../lib/settings-loader.cjs");
+    const { createPermissionRulesProvider, loadPermissionAuthority } =
+      await import("../lib/permission-authority.js");
+    const permissionAuthorityOptions = { cwd: process.cwd() };
+    const loaded = loadPermissionAuthority(permissionAuthorityOptions);
+    _permissionRulesProvider = createPermissionRulesProvider(
+      permissionAuthorityOptions,
+    );
     _managedPermissionRulesOnly =
       loaded.managed?.allowManagedPermissionRulesOnly === true;
     // Claude-Code 2.1.186 respondToBashCommands (default OFF / opt-in when unset).
@@ -3356,8 +3373,16 @@ async function startAgentReplInWorkspaceOwned(
       });
     };
   } catch (_err) {
-    if (_err?.code === "CC_MANAGED_SETTINGS_INVALID") throw _err;
+    if (
+      _err?.code === "CC_MANAGED_SETTINGS_INVALID" ||
+      _err?.code === "CONFIG_HOME_UNSAFE" ||
+      String(_err?.code || "").startsWith("CC_SCOPED_PERMISSION_") ||
+      String(_err?.code || "").startsWith("DURABLE_SECURITY_STORE_")
+    ) {
+      throw _err;
+    }
     _permissionRules = null;
+    _permissionRulesProvider = null;
     _permissionConfirm = null;
     _managedPermissionRulesOnly = false;
   }
@@ -3475,6 +3500,7 @@ async function startAgentReplInWorkspaceOwned(
       title: `Agent ${new Date().toISOString().slice(0, 10)}`,
       provider,
       model,
+      executionLocation: captureAmbientExecutionLocation({ provider, model }),
     };
     if (useJsonl) {
       sessionId = startReplJsonlSession(
@@ -4642,6 +4668,12 @@ async function startAgentReplInWorkspaceOwned(
 
   // Prompt-side interaction modules share the production readline surface.
   // A per-REPL registry avoids singleton handlers retaining an old session.
+  const _clipboardBinding = Object.prototype.hasOwnProperty.call(
+    options,
+    "clipboardBinding",
+  )
+    ? options.clipboardBinding
+    : createSystemClipboardImageBinding();
   const _promptInteractionSurface = createPromptInteractionSurface({
     readline: rl,
     config: _promptInteractionConfig,
@@ -4649,7 +4681,7 @@ async function startAgentReplInWorkspaceOwned(
     getSessionId: () => sessionId,
     getSuggestionContext: () => ({ messages: messages.slice() }),
     persistSuggestionEnabled: _persistPromptSuggestionsEnabled,
-    clipboardBinding: options.clipboardBinding || null,
+    clipboardBinding: _clipboardBinding,
     generateSuggestions: resolveReplPromptSuggestionGenerator(
       useJsonl,
       options.generatePromptSuggestions,
@@ -5936,6 +5968,7 @@ async function startAgentReplInWorkspaceOwned(
       if (snap) _clearedConversation = snap;
       messages.length = 1; // Keep system prompt
       _checkpointMarks.length = 0; // checkpoint marks no longer map to anything
+      _promptInteractions.clearClipboardImageChips();
       logger.info(
         snap
           ? "Conversation cleared — run /rewind clear to restore it"
@@ -9056,6 +9089,7 @@ async function startAgentReplInWorkspaceOwned(
         prepareCall,
         approvalGate: _approvalGate,
         permissionRules: _permissionRules,
+        permissionRulesProvider: _permissionRulesProvider,
         permissionConfirm: _permissionConfirm,
         settingsHooks: _settingsHooks,
         hookSupervisor: _asyncHookSupervisor,

package/src/repl/chat-repl.js

@@ -55,6 +55,7 @@ import {
 import { installPipeSafety } from "../runtime/pipe-safety.js";
 import { installOutputBackpressure } from "../runtime/output-backpressure.js";
 import { assertChatSessionUsageAdmission } from "../lib/chat-session-admission.js";
+import { captureAmbientExecutionLocation } from "../lib/execution-location-runtime.js";
 
 const SLASH_COMMANDS = {
   "/exit": "Exit the chat",
@@ -114,6 +115,7 @@ export async function startChatRepl(options = {}) {
         title: "chat-repl",
         provider,
         model,
+        executionLocation: captureAmbientExecutionLocation({ provider, model }),
       });
     } catch {
       sessionId = null;