chainlesschain 0.163.8 → 0.164.0

package/src/repl/ide-status.js

@@ -45,7 +45,7 @@ export function renderIdeStatus(mcp, diag = null) {
     lines.push(`  tools: ${tools.map((t) => IDE_PREFIX + t).join(", ")}`);
     lines.push(
       "  selection/diagnostics auto-share each turn · " +
-        "@selection / @diagnostics expand on demand",
+        "@selection / @diagnostics / @terminal / @context expand on demand",
     );
     return lines.join("\n");
   }

package/src/repl/prompt-interactions.js

@@ -18,6 +18,8 @@ import {
 } from "./repl-keybindings.js";
 import {
   detectClipboardImageCapability,
+  MAX_CLIPBOARD_IMAGE_ATTACHMENTS,
+  MAX_CLIPBOARD_IMAGE_TOTAL_BYTES,
   readClipboardImageChip,
 } from "./clipboard-image.js";
 import { layoutTerminalText } from "./terminal-layout.js";
@@ -36,6 +38,12 @@ function safeErrorText(value) {
     .join("\n");
 }
 
+function boundedClipboardQueueLimit(value, fallback, maximum) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) return fallback;
+  return Math.min(parsed, maximum);
+}
+
 export const PROMPT_INTERACTION_SLASH_COMMANDS = Object.freeze([
   Object.freeze({
     name: "/recap",
@@ -136,6 +144,17 @@ export class PromptInteractionController {
     this.persistSuggestionEnabled = options.persistSuggestionEnabled;
     this.clipboardBinding = options.clipboardBinding || null;
     this.clipboardImageChips = [];
+    this.clipboardImageBytes = 0;
+    this.maxClipboardImageAttachments = boundedClipboardQueueLimit(
+      options.maxClipboardImageAttachments,
+      MAX_CLIPBOARD_IMAGE_ATTACHMENTS,
+      MAX_CLIPBOARD_IMAGE_ATTACHMENTS,
+    );
+    this.maxClipboardImageTotalBytes = boundedClipboardQueueLimit(
+      options.maxClipboardImageTotalBytes,
+      MAX_CLIPBOARD_IMAGE_TOTAL_BYTES,
+      MAX_CLIPBOARD_IMAGE_TOTAL_BYTES,
+    );
 
     const validated = validateReplKeybindings(options.keybindings || {});
     this.keybindingDiagnostics = validated.errors.slice();
@@ -279,12 +298,38 @@ export class PromptInteractionController {
         this._print(result.reason, { error: true });
         return { handled: true, action: "paste-image", ...result };
       }
-      const result = await readClipboardImageChip(this.clipboardBinding);
+      if (
+        this.clipboardImageChips.length >= this.maxClipboardImageAttachments
+      ) {
+        const result = {
+          ok: false,
+          supported: true,
+          mode: detectClipboardImageCapability(this.clipboardBinding).mode,
+          reason: `Clipboard attachment queue is limited to ${this.maxClipboardImageAttachments} images.`,
+        };
+        this._print(result.reason, { error: true });
+        return { handled: true, action: "paste-image", ...result };
+      }
+      let result = await readClipboardImageChip(this.clipboardBinding);
       if (result.ok) {
-        this.clipboardImageChips.push(result.chip);
-        this._print(
-          `Image attached from clipboard (${result.mediaType}, ${result.bytes} bytes).`,
-        );
+        if (
+          this.clipboardImageBytes + result.bytes >
+          this.maxClipboardImageTotalBytes
+        ) {
+          result = {
+            ok: false,
+            supported: true,
+            mode: result.mode,
+            reason: `Clipboard attachment queue exceeds ${this.maxClipboardImageTotalBytes} bytes.`,
+          };
+          this._print(result.reason, { error: true });
+        } else {
+          this.clipboardImageChips.push(result.chip);
+          this.clipboardImageBytes += result.bytes;
+          this._print(
+            `Image attached from clipboard (${result.mediaType}, ${result.bytes} bytes).`,
+          );
+        }
       } else {
         this._print(result.reason, { error: true });
       }
@@ -371,12 +416,20 @@ export class PromptInteractionController {
   takeClipboardImageChips() {
     const chips = this.clipboardImageChips.slice();
     this.clipboardImageChips.length = 0;
+    this.clipboardImageBytes = 0;
     return chips;
   }
 
+  clearClipboardImageChips() {
+    const cleared = this.clipboardImageChips.length;
+    this.clipboardImageChips.length = 0;
+    this.clipboardImageBytes = 0;
+    return cleared;
+  }
+
   dispose() {
     this.suggestions.dispose();
-    this.clipboardImageChips.length = 0;
+    this.clearClipboardImageChips();
   }
 }
 

package/src/runtime/agent-core.js

@@ -2401,20 +2401,88 @@ export async function executeTool(name, args, context = {}) {
   //                         shell-policy denylist also still applies.
   // No matching rule + no host policy → every existing layer runs unchanged
   // (default behaviour is byte-for-byte).
-  const settingsVerdict = context.permissionRules
+  let permissionAuthority = null;
+  let effectivePermissionRules = context.permissionRules || null;
+  if (typeof context.permissionRulesProvider === "function") {
+    try {
+      permissionAuthority = await context.permissionRulesProvider({
+        cwd,
+        tool: name,
+        args,
+      });
+      effectivePermissionRules =
+        permissionAuthority?.rules || permissionAuthority || null;
+      if (
+        effectivePermissionRules &&
+        (!Array.isArray(effectivePermissionRules.allow) ||
+          !Array.isArray(effectivePermissionRules.ask) ||
+          !Array.isArray(effectivePermissionRules.deny))
+      ) {
+        throw new TypeError(
+          "permission authority provider returned an invalid ruleset",
+        );
+      }
+    } catch (error) {
+      return {
+        error:
+          `[Permission Authority] Tool "${name}" was blocked because the current permission authority could not be resolved. ` +
+          "No tool side effect was started.",
+        policy: {
+          decision: "blocked",
+          via: "permission-authority-load",
+          code: error?.code || "CC_PERMISSION_AUTHORITY_UNAVAILABLE",
+        },
+      };
+    }
+  }
+  const evaluatedSettingsVerdict = effectivePermissionRules
     ? evaluatePermissionRules({
         tool: name,
         args,
         cwd,
-        rules: context.permissionRules,
+        rules: effectivePermissionRules,
       })
     : { decision: null, rule: null };
+  const permissionRuleSource = evaluatedSettingsVerdict.rule
+    ? permissionAuthority?.sources?.[
+        `${evaluatedSettingsVerdict.decision}:${evaluatedSettingsVerdict.rule}`
+      ] || null
+    : null;
+  const matchedScopedRule = permissionRuleSource?.startsWith("scoped:")
+    ? permissionAuthority?.scoped?.rules?.find(
+        (record) =>
+          record.status === "active" &&
+          `scoped:${record.id}` === permissionRuleSource,
+      )
+    : null;
+  const settingsVerdict = {
+    ...evaluatedSettingsVerdict,
+    source: permissionRuleSource,
+    priority:
+      evaluatedSettingsVerdict.decision === "deny"
+        ? 1
+        : evaluatedSettingsVerdict.decision === "ask"
+          ? 3
+          : evaluatedSettingsVerdict.decision === "allow"
+            ? 4
+            : null,
+    scopedRule: matchedScopedRule || null,
+  };
 
   // 1. settings deny
   if (settingsVerdict.decision === "deny") {
     return {
       error: `[Permission] Tool "${name}" denied by settings rule: ${settingsVerdict.rule}. This is a configured policy — retrying won't help; tell the user if the task genuinely needs it.`,
-      policy: { decision: "deny", rule: settingsVerdict.rule, via: "settings" },
+      policy: {
+        decision: "deny",
+        rule: settingsVerdict.rule,
+        via: "settings",
+        source: settingsVerdict.source,
+        priority: settingsVerdict.priority,
+        scopedRuleId: settingsVerdict.scopedRule?.id || null,
+        revision: settingsVerdict.scopedRule?.revision || null,
+        expiresAt: settingsVerdict.scopedRule?.expiresAt || null,
+      },
     };
   }
 
@@ -2523,6 +2591,11 @@ export async function executeTool(name, args, context = {}) {
           decision: "ask",
           rule: settingsVerdict.rule,
           via: "settings",
+          source: settingsVerdict.source,
+          priority: settingsVerdict.priority,
+          scopedRuleId: settingsVerdict.scopedRule?.id || null,
+          revision: settingsVerdict.scopedRule?.revision || null,
+          expiresAt: settingsVerdict.scopedRule?.expiresAt || null,
         },
       };
     }
@@ -2865,6 +2938,7 @@ export async function executeTool(name, args, context = {}) {
       backgroundUsageFailureState: context.backgroundUsageFailureState || null,
       planManager,
       permissionRules: context.permissionRules || null,
+      permissionRulesProvider: context.permissionRulesProvider || null,
       effectiveAllowedToolNames: context.effectiveAllowedToolNames ?? null,
       hostManagedToolPolicy: context.hostManagedToolPolicy || null,
       externalToolDescriptors: context.externalToolDescriptors || null,
@@ -8719,6 +8793,9 @@ async function _executeSpawnSubAgent(args, ctx) {
     // Parent execution authority is inherited as a tighten-only bundle and is
     // re-enforced by the child's executeTool path on every provider tool call.
     ...(ctx.permissionRules ? { permissionRules: ctx.permissionRules } : {}),
+    ...(ctx.permissionRulesProvider
+      ? { permissionRulesProvider: ctx.permissionRulesProvider }
+      : {}),
     ...(childHostManagedToolPolicy
       ? { hostManagedToolPolicy: childHostManagedToolPolicy }
       : {}),
@@ -11351,6 +11428,9 @@ export async function* agentLoop(messages, options) {
       : options.additionalDirectories || null,
     sandbox: options.sandbox || null,
     permissionRules: hermeticExecution ? null : options.permissionRules || null,
+    permissionRulesProvider: hermeticExecution
+      ? null
+      : options.permissionRulesProvider || null,
     permissionConfirm: hermeticExecution
       ? null
       : options.permissionConfirm || null,

package/src/runtime/headless-runner.js

@@ -65,6 +65,7 @@ import {
   reconcileSideEffects,
   classifyToolSideEffect,
 } from "../lib/side-effect-ledger.js";
+import { collectToolResourceIdentifiers } from "../lib/permission-side-effect-center.js";
 import { DiffReviewFollowUpTracker } from "../lib/diff-review-follow-up.js";
 import { SIDE_EFFECT_LEDGER_EVENT } from "../lib/side-effect-ledger-store.js";
 import {
@@ -105,6 +106,7 @@ import {
   exitCodeForEndReason,
 } from "../lib/exit-codes.cjs";
 import { isolationLevel } from "../lib/agent-sandbox.js";
+import { captureAmbientExecutionLocation } from "../lib/execution-location-runtime.js";
 import { createBackgroundPhaseReporter } from "../lib/background-phase-reporter.js";
 import { createBackgroundInteractionClient } from "../lib/background-interaction-resolver.js";
 import { withQuietStdout } from "./quiet-stdout.js";
@@ -738,34 +740,26 @@ async function runAgentHeadlessInWorkspace(
   let permissionRules = hermeticExecution
     ? null
     : options.permissionRules || null;
+  let permissionRulesProvider = hermeticExecution
+    ? null
+    : options.permissionRulesProvider || null;
   let managedSettings = null;
   let settingsFiles = [];
   if (!hermeticExecution) {
-    try {
-      const { loadSettings, applyManagedPermissionPolicy } =
-        await import("../lib/settings-loader.cjs");
-      const loaded = loadSettings({
-        cwd,
-        settingsFile: options.settingsFile,
-        managedSettingsFile: options.managedSettingsFile,
-      });
-      managedSettings = loaded.managed;
-      settingsFiles = Array.isArray(loaded.files) ? loaded.files : [];
-      if (!permissionRules) {
-        const total =
-          loaded.rules.allow.length +
-          loaded.rules.ask.length +
-          loaded.rules.deny.length;
-        permissionRules = total > 0 ? loaded.rules : null;
-      } else if (managedSettings) {
-        permissionRules = applyManagedPermissionPolicy(
-          permissionRules,
-          managedSettings,
-        );
-      }
-    } catch (error) {
-      if (error?.code === "CC_MANAGED_SETTINGS_INVALID") throw error;
-      // Preserve caller-provided rules; absent settings keep legacy behavior.
+    const { createPermissionRulesProvider, loadPermissionAuthority } =
+      await import("../lib/permission-authority.js");
+    const authorityOptions = {
+      cwd,
+      settingsFile: options.settingsFile,
+      managedSettingsFile: options.managedSettingsFile,
+      baseRules: options.permissionRules || null,
+    };
+    const loaded = loadPermissionAuthority(authorityOptions);
+    managedSettings = loaded.managed;
+    settingsFiles = Array.isArray(loaded.files) ? loaded.files : [];
+    permissionRules = loaded.hasRules ? loaded.rules : null;
+    if (!permissionRulesProvider) {
+      permissionRulesProvider = createPermissionRulesProvider(authorityOptions);
     }
   }
 
@@ -1719,6 +1713,10 @@ async function runAgentHeadlessInWorkspace(
           provider,
           model,
           observabilityScope: options.observabilityScope,
+          executionLocation: captureAmbientExecutionLocation({
+            provider,
+            model,
+          }),
         });
       }
       // Persist the expanded content so a resumed session faithfully replays
@@ -2163,6 +2161,7 @@ async function runAgentHeadlessInWorkspace(
     hookDb: hermeticExecution ? null : db,
     approvalGate: hermeticExecution ? null : approvalGate,
     permissionRules: hermeticExecution ? null : permissionRules,
+    permissionRulesProvider: hermeticExecution ? null : permissionRulesProvider,
     settingsHooks: hermeticExecution ? null : settingsHooks,
     // Seed the subagent-contract CEILING with this run's permission mode so a
     // spawned sub-agent inherits/tightens from it (tighten-only): a
@@ -2758,6 +2757,12 @@ async function runAgentHeadlessInWorkspace(
                     // and countDuplicateCommittedEffects can measure `0` repeats.
                     meta: {
                       tool: event.tool,
+                      toolUseId: telemetryToolId,
+                      turnId: event.turn_id || null,
+                      resources: collectToolResourceIdentifiers(
+                        event.tool,
+                        event.args,
+                      ),
                       idempotencyKey: operationIdempotencyKey({
                         tool: event.tool,
                         args: event.args,

package/src/runtime/headless-stream.js

@@ -60,6 +60,7 @@ import {
   expandIdeMentions,
 } from "../lib/ide-context.js";
 import { detectVersionSkew, versionSkewMessage } from "../lib/version-skew.js";
+import { captureAmbientExecutionLocation } from "../lib/execution-location-runtime.js";
 import {
   resolveAgentMcp,
   resolvePermissionPromptTool,
@@ -114,6 +115,7 @@ import {
   reconcileSideEffects,
   classifyToolSideEffect,
 } from "../lib/side-effect-ledger.js";
+import { collectToolResourceIdentifiers } from "../lib/permission-side-effect-center.js";
 import { DiffReviewFollowUpTracker } from "../lib/diff-review-follow-up.js";
 import {
   loadSideEffectLedger,
@@ -909,6 +911,12 @@ async function runTurn(
                 // and countDuplicateCommittedEffects can measure `0` repeats.
                 meta: {
                   tool: event.tool,
+                  toolUseId: toolUseId || null,
+                  turnId: event.turn_id || null,
+                  resources: collectToolResourceIdentifiers(
+                    event.tool,
+                    event.args,
+                  ),
                   idempotencyKey: operationIdempotencyKey({
                     tool: event.tool,
                     args: event.args,
@@ -1608,33 +1616,27 @@ async function runAgentHeadlessStreamInWorkspace(
   // .claude/settings.json permission rules (deny > ask > allow); see
   // runAgentHeadless for the full semantics. null = no file → unchanged.
   let permissionRules = options.permissionRules || null;
+  let permissionRulesProvider = options.permissionRulesProvider || null;
   let managedSettings = null;
   let settingsFiles = [];
-  try {
-    const { loadSettings, applyManagedPermissionPolicy } =
-      await import("../lib/settings-loader.cjs");
-    const loaded = loadSettings({
-      cwd,
-      settingsFile: options.settingsFile,
-      managedSettingsFile: options.managedSettingsFile,
-    });
-    managedSettings = loaded.managed;
-    settingsFiles = Array.isArray(loaded.files) ? loaded.files : [];
-    if (!permissionRules) {
-      const total =
-        loaded.rules.allow.length +
-        loaded.rules.ask.length +
-        loaded.rules.deny.length;
-      permissionRules = total > 0 ? loaded.rules : null;
-    } else if (managedSettings) {
-      permissionRules = applyManagedPermissionPolicy(
-        permissionRules,
-        managedSettings,
-      );
-    }
-  } catch (error) {
-    if (error?.code === "CC_MANAGED_SETTINGS_INVALID") throw error;
-    // Preserve caller-provided rules; absent settings keep legacy behavior.
+  const { createPermissionRulesProvider, loadPermissionAuthority } =
+    await import("../lib/permission-authority.js");
+  const authorityOptions = {
+    cwd,
+    settingsFile: options.settingsFile,
+    managedSettingsFile: options.managedSettingsFile,
+    baseRules: options.permissionRules || null,
+  };
+  const loadedPermissionAuthority = loadPermissionAuthority(authorityOptions);
+  managedSettings = loadedPermissionAuthority.managed;
+  settingsFiles = Array.isArray(loadedPermissionAuthority.files)
+    ? loadedPermissionAuthority.files
+    : [];
+  permissionRules = loadedPermissionAuthority.hasRules
+    ? loadedPermissionAuthority.rules
+    : null;
+  if (!permissionRulesProvider) {
+    permissionRulesProvider = createPermissionRulesProvider(authorityOptions);
   }
 
   // .claude/settings.json `hooks` block (decision-capable PreToolUse/PostToolUse).
@@ -2368,6 +2370,10 @@ async function runAgentHeadlessStreamInWorkspace(
             provider,
             model,
             observabilityScope: options.observabilityScope,
+            executionLocation: captureAmbientExecutionLocation({
+              provider,
+              model,
+            }),
           }),
           "startSession",
         );
@@ -2791,6 +2797,7 @@ async function runAgentHeadlessStreamInWorkspace(
     hookDb: db,
     approvalGate,
     permissionRules,
+    permissionRulesProvider,
     settingsHooks,
     toolAdmission: options.toolAdmission || null,
     classifyAllShell,