chainlesschain 0.163.8 → 0.165.1

package/src/lib/with-file-lock.js

@@ -12,10 +12,13 @@
  * `timeoutMs`, it proceeds unlocked. Callers that set `failIfUnavailable` get a
  * strict lock: every owner has a PID + unguessable token, a live owner is never
  * reclaimed merely because the directory is old, and corrupt ownership fails
- * closed. Confirmed-dead owners are reclaimed with an exact-token marker inside
- * the lock directory so a delayed contender cannot delete a replacement lock.
- * Strict callers may use bounded jittered retries and an after-release yield to
- * avoid Windows sharing transients and fixed-interval lock convoys.
+ * closed. The default filesystem publishes a fully populated, uniquely staged
+ * directory in one rename so a process killed during acquisition cannot expose
+ * an ownerless lock. Confirmed-dead owners are reclaimed with an exact-token
+ * marker inside the lock directory so a delayed contender cannot delete a
+ * replacement lock. Strict callers may use bounded jittered retries and an
+ * after-release yield to avoid Windows sharing transients and fixed-interval
+ * lock convoys.
  *
  * @param {string} targetPath  the file being guarded (lock is `${targetPath}.lock`)
  * @param {(ctx:{locked:boolean})=>T} fn  critical section; receives whether the lock was held
@@ -37,6 +40,10 @@ export function withFileLock(targetPath, fn, opts = {}) {
     _ownerToken = () => randomUUID(),
     failIfUnavailable = false,
   } = opts;
+  const isOwnerAlive =
+    typeof opts._isOwnerAlive === "function"
+      ? opts._isOwnerAlive
+      : (candidate) => _isProcessAlive(candidate.pid);
 
   const lockDir = `${targetPath}.lock`;
   const ownerPath = path.join(lockDir, "owner.json");
@@ -52,36 +59,9 @@ export function withFileLock(targetPath, fn, opts = {}) {
 
   for (;;) {
     try {
-      _fs.mkdirSync(lockDir);
-      try {
-        _fs.writeFileSync(ownerPath, JSON.stringify(owner), {
-          encoding: "utf8",
-          mode: 0o600,
-          flag: "wx",
-        });
-        held = true;
-        break;
-      } catch (error) {
-        _fs.rmSync(lockDir, { recursive: true, force: true });
-        acquisitionError = error;
-        if (
-          failIfUnavailable &&
-          isTransientLockError(error) &&
-          waitForRetry({
-            _now,
-            _sleep,
-            _random,
-            deadline,
-            retryAttempt: retryAttempt++,
-            retryMs,
-            maxRetryMs,
-            retryJitterMs,
-          })
-        ) {
-          continue;
-        }
-        break;
-      }
+      acquireOwnedDirectory(_fs, lockDir, owner);
+      held = true;
+      break;
     } catch (error) {
       if (!error || error.code !== "EEXIST") {
         acquisitionError = error;
@@ -108,8 +88,8 @@ export function withFileLock(targetPath, fn, opts = {}) {
       const incumbent = ownerRead.owner;
       acquisitionError = ownerRead.error;
       if (incumbent) {
-        if (!_isProcessAlive(incumbent.pid)) {
-          if (reclaimOwnedDirectory(_fs, lockDir, incumbent, _isProcessAlive)) {
+        if (!isOwnerAlive(incumbent)) {
+          if (reclaimOwnedDirectory(_fs, lockDir, incumbent, isOwnerAlive)) {
             continue;
           }
         }
@@ -200,6 +180,61 @@ const defaultFs = {
   rmSync: (p, o) => fs.rmSync(p, o),
 };
 
+function acquireOwnedDirectory(_fs, lockDir, owner) {
+  const serializedOwner = JSON.stringify(owner);
+  // Injected legacy filesystems used by a few consumers may not implement
+  // rename. Keep their old acquire path, while the real Node filesystem always
+  // uses the crash-safe staged publication below.
+  if (typeof _fs.renameSync !== "function") {
+    _fs.mkdirSync(lockDir);
+    try {
+      _fs.writeFileSync(path.join(lockDir, "owner.json"), serializedOwner, {
+        encoding: "utf8",
+        mode: 0o600,
+        flag: "wx",
+      });
+      return;
+    } catch (error) {
+      _fs.rmSync(lockDir, { recursive: true, force: true });
+      throw error;
+    }
+  }
+
+  const candidateDir = `${lockDir}.acquire-${owner.token}`;
+  try {
+    _fs.mkdirSync(candidateDir);
+    _fs.writeFileSync(path.join(candidateDir, "owner.json"), serializedOwner, {
+      encoding: "utf8",
+      mode: 0o600,
+      flag: "wx",
+    });
+    _fs.renameSync(candidateDir, lockDir);
+  } catch (error) {
+    try {
+      _fs.rmSync(candidateDir, { recursive: true, force: true });
+    } catch {
+      /* uniquely-tokened acquisition debris cannot block the lock path */
+    }
+    if (directoryExists(_fs, lockDir)) {
+      const contention = new Error("State lock already exists", {
+        cause: error,
+      });
+      contention.code = "EEXIST";
+      throw contention;
+    }
+    throw error;
+  }
+}
+
+function directoryExists(_fs, target) {
+  try {
+    _fs.statSync(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -310,7 +345,7 @@ function writeOwnerMarker(_fs, markerPath, owner) {
   });
 }
 
-function reclaimOwnedDirectory(_fs, lockDir, owner, processAlive) {
+function reclaimOwnedDirectory(_fs, lockDir, owner, ownerAlive) {
   const markerPath = path.join(lockDir, `.reclaim-${owner.token}`);
   try {
     writeOwnerMarker(_fs, markerPath, owner);
@@ -319,7 +354,7 @@ function reclaimOwnedDirectory(_fs, lockDir, owner, processAlive) {
     throw error;
   }
   const current = readOwner(_fs, path.join(lockDir, "owner.json"));
-  if (!sameOwner(current, owner) || processAlive(owner.pid)) {
+  if (!sameOwner(current, owner) || ownerAlive(owner)) {
     removeOwnMarker(_fs, markerPath, owner);
     return false;
   }

package/src/lib/workflow-definition-contract.js

@@ -0,0 +1,149 @@
+import { createHash } from "node:crypto";
+
+export const WORKFLOW_DEFINITION_SCHEMA = "cc-dynamic-workflow-definition/v1";
+export const COWORK_WORKFLOW_RECORD_SCHEMA = "cc-cowork-workflow-record/v1";
+export const MAX_WORKFLOW_DEFINITION_BYTES = 1024 * 1024;
+
+function stableJsonValue(value, state = { nodes: 0, depth: 0 }) {
+  state.nodes += 1;
+  if (state.nodes > 20_000 || state.depth > 32) {
+    throw new TypeError("workflow definition exceeds canonicalization limits");
+  }
+  if (
+    value === null ||
+    typeof value === "boolean" ||
+    typeof value === "string"
+  ) {
+    return value;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("workflow definition contains a non-finite number");
+    }
+    return Object.is(value, -0) ? 0 : value;
+  }
+  if (Array.isArray(value)) {
+    const childState = { ...state, depth: state.depth + 1 };
+    const output = value.map((item) => stableJsonValue(item, childState));
+    state.nodes = childState.nodes;
+    return output;
+  }
+  if (value && typeof value === "object") {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new TypeError(
+        "workflow definition must contain plain JSON objects",
+      );
+    }
+    const childState = { ...state, depth: state.depth + 1 };
+    const output = {};
+    for (const key of Object.keys(value).sort()) {
+      const child = value[key];
+      if (child === undefined) continue;
+      if (["function", "symbol", "bigint"].includes(typeof child)) {
+        throw new TypeError("workflow definition contains a non-JSON value");
+      }
+      output[key] = stableJsonValue(child, childState);
+    }
+    state.nodes = childState.nodes;
+    return output;
+  }
+  throw new TypeError("workflow definition contains a non-JSON value");
+}
+
+function deepFreeze(value) {
+  if (!value || typeof value !== "object" || Object.isFrozen(value)) {
+    return value;
+  }
+  for (const child of Object.values(value)) deepFreeze(child);
+  return Object.freeze(value);
+}
+
+function digestDefinition(definition) {
+  const canonical = JSON.stringify(definition);
+  if (Buffer.byteLength(canonical, "utf8") > MAX_WORKFLOW_DEFINITION_BYTES) {
+    throw new TypeError(
+      `workflow definition exceeds ${MAX_WORKFLOW_DEFINITION_BYTES} bytes`,
+    );
+  }
+  return `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
+}
+
+function integrityError(message) {
+  const error = new Error(message);
+  error.code = "WORKFLOW_DEFINITION_INTEGRITY";
+  return error;
+}
+
+export function normalizeWorkflowDefinitionDigest(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim().toLowerCase();
+  return /^sha256:[a-f0-9]{64}$/u.test(normalized) ? normalized : null;
+}
+
+export function createWorkflowDefinitionAuthority(workflow) {
+  const definition = deepFreeze(stableJsonValue(workflow));
+  return Object.freeze({
+    schema: WORKFLOW_DEFINITION_SCHEMA,
+    definitionDigest: digestDefinition(definition),
+    definition,
+  });
+}
+
+export function createCoworkWorkflowRecord(workflow) {
+  const authority = createWorkflowDefinitionAuthority(workflow);
+  const record = {
+    schema: COWORK_WORKFLOW_RECORD_SCHEMA,
+    definitionSchema: authority.schema,
+    definitionDigest: authority.definitionDigest,
+    definition: authority.definition,
+  };
+  const serialized = JSON.stringify(record, null, 2);
+  if (Buffer.byteLength(serialized, "utf8") > MAX_WORKFLOW_DEFINITION_BYTES) {
+    throw new TypeError(
+      `workflow definition exceeds ${MAX_WORKFLOW_DEFINITION_BYTES} bytes`,
+    );
+  }
+  return Object.freeze(record);
+}
+
+export function verifyCoworkWorkflowRecord(value, options = {}) {
+  if (
+    value?.schema !== COWORK_WORKFLOW_RECORD_SCHEMA &&
+    options.allowLegacy === true
+  ) {
+    const authority = createWorkflowDefinitionAuthority(value);
+    return Object.freeze({
+      status: "legacy-unversioned",
+      recordSchema: null,
+      definitionSchema: authority.schema,
+      definitionDigest: authority.definitionDigest,
+      definition: authority.definition,
+    });
+  }
+  if (!value || value.schema !== COWORK_WORKFLOW_RECORD_SCHEMA) {
+    throw integrityError(
+      `workflow record must use ${COWORK_WORKFLOW_RECORD_SCHEMA}`,
+    );
+  }
+  if (value.definitionSchema !== WORKFLOW_DEFINITION_SCHEMA) {
+    throw integrityError("workflow definition schema is unsupported");
+  }
+  const declaredDigest = normalizeWorkflowDefinitionDigest(
+    value.definitionDigest,
+  );
+  if (!declaredDigest) {
+    throw integrityError("workflow definition digest is invalid");
+  }
+  const authority = createWorkflowDefinitionAuthority(value.definition);
+  if (authority.definitionDigest !== declaredDigest) {
+    throw integrityError("workflow definition digest mismatch");
+  }
+  return Object.freeze({
+    status: "versioned",
+    recordSchema: COWORK_WORKFLOW_RECORD_SCHEMA,
+    definitionSchema: authority.schema,
+    definitionDigest: authority.definitionDigest,
+    definition: authority.definition,
+  });
+}

package/src/repl/agent-repl.js

@@ -25,6 +25,7 @@ import path from "path";
 import { randomUUID } from "node:crypto";
 import { isPromise, isProxy } from "node:util/types";
 import { logger } from "../lib/logger.js";
+import { captureAmbientExecutionLocation } from "../lib/execution-location-runtime.js";
 import { issueMcpStdioExecutionAuthority } from "../lib/mcp-stdio-execution-authority.js";
 import { getPlanModeManager, PlanState } from "../lib/plan-mode.js";
 import { createVimState, feedNormalKey } from "../lib/repl-vim.js";
@@ -88,6 +89,7 @@ import {
   persistSideEffectLedger,
 } from "../lib/side-effect-ledger-store.js";
 import { operationIdempotencyKey } from "../lib/idempotency.js";
+import { collectToolResourceIdentifiers } from "../lib/permission-side-effect-center.js";
 import {
   preserveDurableSystemMessageProvenance,
   projectCanonicalResumeMessages,
@@ -173,6 +175,7 @@ import {
   createPromptInteractionSurface,
   mergeClipboardImageChips,
 } from "./prompt-interactions.js";
+import { createSystemClipboardImageBinding } from "./clipboard-image.js";
 import {
   buildPermissionPrompt,
   resolveAskIdleTimeoutMs,
@@ -407,9 +410,11 @@ export async function runReplDirectToolWithLedger({
 let _hookDb = null;
 let _compressor = null;
 let _approvalGate = null;
-// .claude/settings.json permission rules (deny > ask > allow) + an interactive
-// confirmer for `ask` matches. Loaded once at REPL startup; null = no file.
+// Static + CLI-owned scoped permission rules (deny > ask > allow) and an
+// interactive confirmer for `ask` matches. Scoped rules are refreshed at each
+// tool boundary so TTL expiry and external revocation affect a live session.
 let _permissionRules = null;
+let _permissionRulesProvider = null;
 let _permissionConfirm = null;
 let _managedPermissionRulesOnly = false;
 // .claude/settings.json `hooks` block (decision-capable PreToolUse/PostToolUse).
@@ -546,6 +551,7 @@ async function executeTool(name, args) {
     cwd: process.cwd(),
     approvalGate: _approvalGate,
     permissionRules: _permissionRules,
+    permissionRulesProvider: _permissionRulesProvider,
     permissionConfirm: _permissionConfirm,
     settingsHooks: _settingsHooks,
     classifyAllShell: _classifyAllShell,
@@ -770,6 +776,12 @@ export async function agentLoop(messages, options) {
               key: sideEffect.key,
               meta: {
                 tool: event.tool,
+                toolUseId: event.tool_use_id || null,
+                turnId: event.turn_id || null,
+                resources: collectToolResourceIdentifiers(
+                  event.tool,
+                  event.args,
+                ),
                 idempotencyKey: operationIdempotencyKey({
                   tool: event.tool,
                   args: event.args,
@@ -3163,6 +3175,11 @@ async function startAgentReplInWorkspaceOwned(
     const { getApprovalGate } =
       await import("../lib/session-core-singletons.js");
     _approvalGate = await getApprovalGate();
+    _approvalGate =
+      _approvalGate?.createSessionScope?.(
+        sessionId || `repl-scope:${randomUUID()}`,
+      ) || _approvalGate;
+    _approvalGate?.setAuthorizationConsumer?.(null);
     // autoMode.decisions: wrap the gate with the configurable classifier
     // BEFORE setConfirmer so the wrapper captures the interactive confirmer.
     // Inactive (delegating) unless the session mode is "auto"; not installed
@@ -3240,29 +3257,53 @@ async function startAgentReplInWorkspaceOwned(
           },
         };
       };
-      _approvalGate.setConfirmer(async ({ tool, args, riskLevel }) => {
-        if (_dontAskActive()) {
-          process.stdout.write(
-            chalk.yellow(
-              `\n  ✕ denied without asking (dontAsk mode): ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}\n`,
-            ),
+      _approvalGate.setConfirmer(
+        async ({
+          tool,
+          args,
+          riskLevel,
+          action,
+          cwd,
+          workspace,
+          sessionId,
+          session,
+          targetEnv,
+          policyVersion,
+        }) => {
+          if (_dontAskActive()) {
+            process.stdout.write(
+              chalk.yellow(
+                `\n  ✕ denied without asking (dontAsk mode): ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}\n`,
+              ),
+            );
+            return false;
+          }
+          await _fireNotification(
+            `Permission needed: ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}`,
+            "info",
+            _sessionHandle,
           );
-          return false;
-        }
-        await _fireNotification(
-          `Permission needed: ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}`,
-          "info",
-          _sessionHandle,
-        );
-        const local = askGateApprovalLocally({ tool, args, riskLevel });
-        if (!_remoteApproval?.bridge) return local.promise;
-        return raceLocalAndRemote({
-          bridge: _remoteApproval.bridge,
-          ask: describeAskContext({ tool, args, riskLevel }),
-          local,
-          writeOut: (text) => process.stdout.write(chalk.cyan(text)),
-        });
-      });
+          const local = askGateApprovalLocally({ tool, args, riskLevel });
+          if (!_remoteApproval?.bridge) return local.promise;
+          return raceLocalAndRemote({
+            bridge: _remoteApproval.bridge,
+            ask: describeAskContext({
+              tool,
+              args,
+              riskLevel,
+              action,
+              cwd,
+              workspace,
+              sessionId,
+              session,
+              targetEnv,
+              policyVersion,
+            }),
+            local,
+            writeOut: (text) => process.stdout.write(chalk.cyan(text)),
+          });
+        },
+      );
     }
   } catch (_err) {
     _approvalGate = null;
@@ -3271,9 +3312,14 @@ async function startAgentReplInWorkspaceOwned(
   // Load .claude/settings.json permission rules + wire an interactive confirmer
   // so `ask` rules prompt (rather than fall closed like headless does).
   try {
-    const { loadSettings, readBooleanSetting } =
-      await import("../lib/settings-loader.cjs");
-    const loaded = loadSettings({ cwd: process.cwd() });
+    const { readBooleanSetting } = await import("../lib/settings-loader.cjs");
+    const { createPermissionRulesProvider, loadPermissionAuthority } =
+      await import("../lib/permission-authority.js");
+    const permissionAuthorityOptions = { cwd: process.cwd() };
+    const loaded = loadPermissionAuthority(permissionAuthorityOptions);
+    _permissionRulesProvider = createPermissionRulesProvider(
+      permissionAuthorityOptions,
+    );
     _managedPermissionRulesOnly =
       loaded.managed?.allowManagedPermissionRulesOnly === true;
     // Claude-Code 2.1.186 respondToBashCommands (default OFF / opt-in when unset).
@@ -3347,17 +3393,23 @@ async function startAgentReplInWorkspaceOwned(
         _sessionHandle,
       );
       const local = askPermissionLocally({ tool, args, rule, reason });
-      if (!_remoteApproval?.bridge) return local.promise;
-      return raceLocalAndRemote({
-        bridge: _remoteApproval.bridge,
-        ask: describeAskContext({ tool, args, rule, reason }),
-        local,
-        writeOut: (text) => process.stdout.write(chalk.cyan(text)),
-      });
+      // This confirmer is consumed as a legacy boolean by settings/hook
+      // admission. A remote lease must never be flattened there and then skip
+      // the ApprovalGate consume, so this path remains local-only until it can
+      // carry the opaque authorization through its own dispatch boundary.
+      return local.promise;
     };
   } catch (_err) {
-    if (_err?.code === "CC_MANAGED_SETTINGS_INVALID") throw _err;
+    if (
+      _err?.code === "CC_MANAGED_SETTINGS_INVALID" ||
+      _err?.code === "CONFIG_HOME_UNSAFE" ||
+      String(_err?.code || "").startsWith("CC_SCOPED_PERMISSION_") ||
+      String(_err?.code || "").startsWith("DURABLE_SECURITY_STORE_")
+    ) {
+      throw _err;
+    }
     _permissionRules = null;
+    _permissionRulesProvider = null;
     _permissionConfirm = null;
     _managedPermissionRulesOnly = false;
   }
@@ -3475,6 +3527,7 @@ async function startAgentReplInWorkspaceOwned(
       title: `Agent ${new Date().toISOString().slice(0, 10)}`,
       provider,
       model,
+      executionLocation: captureAmbientExecutionLocation({ provider, model }),
     };
     if (useJsonl) {
       sessionId = startReplJsonlSession(
@@ -3542,6 +3595,18 @@ async function startAgentReplInWorkspaceOwned(
   // purely how the confirmers consume it — they RACE the terminal prompt
   // against the paired device instead of gating on the remote alone.
   const _startRemoteApproval = async () => {
+    if (
+      !_approvalGate ||
+      typeof _approvalGate.setConfirmer !== "function" ||
+      typeof _approvalGate.setAuthorizationConsumer !== "function" ||
+      typeof _approvalGate.consumeAuthorization !== "function"
+    ) {
+      const error = new Error(
+        "installed session-core cannot bind and consume durable remote approval",
+      );
+      error.code = "CC_REMOTE_APPROVAL_GATE_UNAVAILABLE";
+      throw error;
+    }
     const { startHeadlessRemoteApproval } =
       await import("../lib/remote-approval-bridge.js");
     const started = await startHeadlessRemoteApproval({
@@ -3554,6 +3619,7 @@ async function startAgentReplInWorkspaceOwned(
       pairing: started.pairing,
       close: started.close,
     };
+    _approvalGate.setAuthorizationConsumer(started.consumeAuthorization);
     logger.log(
       chalk.cyan(
         "  remote-control: permission prompts can be answered from a paired device (first answer — terminal or device — wins)",
@@ -3571,6 +3637,7 @@ async function startAgentReplInWorkspaceOwned(
   const _stopRemoteApproval = async () => {
     const active = _remoteApproval;
     _remoteApproval = null; // confirmers fall back to local-only immediately
+    _approvalGate?.setAuthorizationConsumer?.(null);
     if (active) await active.close().catch(() => undefined);
   };
 
@@ -4642,6 +4709,12 @@ async function startAgentReplInWorkspaceOwned(
 
   // Prompt-side interaction modules share the production readline surface.
   // A per-REPL registry avoids singleton handlers retaining an old session.
+  const _clipboardBinding = Object.prototype.hasOwnProperty.call(
+    options,
+    "clipboardBinding",
+  )
+    ? options.clipboardBinding
+    : createSystemClipboardImageBinding();
   const _promptInteractionSurface = createPromptInteractionSurface({
     readline: rl,
     config: _promptInteractionConfig,
@@ -4649,7 +4722,7 @@ async function startAgentReplInWorkspaceOwned(
     getSessionId: () => sessionId,
     getSuggestionContext: () => ({ messages: messages.slice() }),
     persistSuggestionEnabled: _persistPromptSuggestionsEnabled,
-    clipboardBinding: options.clipboardBinding || null,
+    clipboardBinding: _clipboardBinding,
     generateSuggestions: resolveReplPromptSuggestionGenerator(
       useJsonl,
       options.generatePromptSuggestions,
@@ -5936,6 +6009,7 @@ async function startAgentReplInWorkspaceOwned(
       if (snap) _clearedConversation = snap;
       messages.length = 1; // Keep system prompt
       _checkpointMarks.length = 0; // checkpoint marks no longer map to anything
+      _promptInteractions.clearClipboardImageChips();
       logger.info(
         snap
           ? "Conversation cleared — run /rewind clear to restore it"
@@ -9056,6 +9130,7 @@ async function startAgentReplInWorkspaceOwned(
         prepareCall,
         approvalGate: _approvalGate,
         permissionRules: _permissionRules,
+        permissionRulesProvider: _permissionRulesProvider,
         permissionConfirm: _permissionConfirm,
         settingsHooks: _settingsHooks,
         hookSupervisor: _asyncHookSupervisor,

package/src/repl/chat-repl.js

@@ -55,6 +55,7 @@ import {
 import { installPipeSafety } from "../runtime/pipe-safety.js";
 import { installOutputBackpressure } from "../runtime/output-backpressure.js";
 import { assertChatSessionUsageAdmission } from "../lib/chat-session-admission.js";
+import { captureAmbientExecutionLocation } from "../lib/execution-location-runtime.js";
 
 const SLASH_COMMANDS = {
   "/exit": "Exit the chat",
@@ -114,6 +115,7 @@ export async function startChatRepl(options = {}) {
         title: "chat-repl",
         provider,
         model,
+        executionLocation: captureAmbientExecutionLocation({ provider, model }),
       });
     } catch {
       sessionId = null;