chainlesschain 0.163.8 → 0.165.1

package/src/runtime/headless-runner.js

@@ -65,6 +65,7 @@ import {
   reconcileSideEffects,
   classifyToolSideEffect,
 } from "../lib/side-effect-ledger.js";
+import { collectToolResourceIdentifiers } from "../lib/permission-side-effect-center.js";
 import { DiffReviewFollowUpTracker } from "../lib/diff-review-follow-up.js";
 import { SIDE_EFFECT_LEDGER_EVENT } from "../lib/side-effect-ledger-store.js";
 import {
@@ -105,6 +106,7 @@ import {
   exitCodeForEndReason,
 } from "../lib/exit-codes.cjs";
 import { isolationLevel } from "../lib/agent-sandbox.js";
+import { captureAmbientExecutionLocation } from "../lib/execution-location-runtime.js";
 import { createBackgroundPhaseReporter } from "../lib/background-phase-reporter.js";
 import { createBackgroundInteractionClient } from "../lib/background-interaction-resolver.js";
 import { withQuietStdout } from "./quiet-stdout.js";
@@ -738,34 +740,26 @@ async function runAgentHeadlessInWorkspace(
   let permissionRules = hermeticExecution
     ? null
     : options.permissionRules || null;
+  let permissionRulesProvider = hermeticExecution
+    ? null
+    : options.permissionRulesProvider || null;
   let managedSettings = null;
   let settingsFiles = [];
   if (!hermeticExecution) {
-    try {
-      const { loadSettings, applyManagedPermissionPolicy } =
-        await import("../lib/settings-loader.cjs");
-      const loaded = loadSettings({
-        cwd,
-        settingsFile: options.settingsFile,
-        managedSettingsFile: options.managedSettingsFile,
-      });
-      managedSettings = loaded.managed;
-      settingsFiles = Array.isArray(loaded.files) ? loaded.files : [];
-      if (!permissionRules) {
-        const total =
-          loaded.rules.allow.length +
-          loaded.rules.ask.length +
-          loaded.rules.deny.length;
-        permissionRules = total > 0 ? loaded.rules : null;
-      } else if (managedSettings) {
-        permissionRules = applyManagedPermissionPolicy(
-          permissionRules,
-          managedSettings,
-        );
-      }
-    } catch (error) {
-      if (error?.code === "CC_MANAGED_SETTINGS_INVALID") throw error;
-      // Preserve caller-provided rules; absent settings keep legacy behavior.
+    const { createPermissionRulesProvider, loadPermissionAuthority } =
+      await import("../lib/permission-authority.js");
+    const authorityOptions = {
+      cwd,
+      settingsFile: options.settingsFile,
+      managedSettingsFile: options.managedSettingsFile,
+      baseRules: options.permissionRules || null,
+    };
+    const loaded = loadPermissionAuthority(authorityOptions);
+    managedSettings = loaded.managed;
+    settingsFiles = Array.isArray(loaded.files) ? loaded.files : [];
+    permissionRules = loaded.hasRules ? loaded.rules : null;
+    if (!permissionRulesProvider) {
+      permissionRulesProvider = createPermissionRulesProvider(authorityOptions);
     }
   }
 
@@ -1466,6 +1460,8 @@ async function runAgentHeadlessInWorkspace(
   if (!hermeticExecution) {
     try {
       approvalGate = await getApprovalGate();
+      approvalGate =
+        approvalGate?.createSessionScope?.(sessionId) || approvalGate;
       if (approvalGate && (options.permissionMode || "default") === "auto") {
         // autoMode.decisions: user-configured riskLevel → allow/ask/deny
         // classifier. Only wrap when settings actually customize the map so the
@@ -1489,6 +1485,7 @@ async function runAgentHeadlessInWorkspace(
         }
       }
       if (approvalGate) {
+        approvalGate.setAuthorizationConsumer?.(null);
         if (typeof approvalGate.setSessionPolicy === "function") {
           approvalGate.setSessionPolicy(sessionId, perm.sessionPolicy);
         }
@@ -1719,6 +1716,10 @@ async function runAgentHeadlessInWorkspace(
           provider,
           model,
           observabilityScope: options.observabilityScope,
+          executionLocation: captureAmbientExecutionLocation({
+            provider,
+            model,
+          }),
         });
       }
       // Persist the expanded content so a resumed session faithfully replays
@@ -1982,6 +1983,18 @@ async function runAgentHeadlessInWorkspace(
     !options.permissionPromptTool
   ) {
     try {
+      if (
+        !approvalGate ||
+        typeof approvalGate.setConfirmer !== "function" ||
+        typeof approvalGate.setAuthorizationConsumer !== "function" ||
+        typeof approvalGate.consumeAuthorization !== "function"
+      ) {
+        const error = new Error(
+          "installed session-core cannot bind and consume durable remote approval",
+        );
+        error.code = "CC_REMOTE_APPROVAL_GATE_UNAVAILABLE";
+        throw error;
+      }
       const { startHeadlessRemoteApproval } =
         await import("../lib/remote-approval-bridge.js");
       _remoteApproval = await (
@@ -1991,11 +2004,12 @@ async function runAgentHeadlessInWorkspace(
         writeErr,
         isText,
       });
-      if (approvalGate && typeof approvalGate.setConfirmer === "function") {
-        approvalGate.setConfirmer(
-          _bgPhase.wrapConfirmer(_remoteApproval.confirmer),
-        );
-      }
+      approvalGate.setConfirmer(
+        _bgPhase.wrapConfirmer(_remoteApproval.confirmer),
+      );
+      approvalGate.setAuthorizationConsumer(
+        _remoteApproval.consumeAuthorization,
+      );
     } catch (err) {
       // Remote approval could not come up → keep headless fail-closed rather
       // than running un-gated; say why so the user can fix pairing.
@@ -2163,6 +2177,7 @@ async function runAgentHeadlessInWorkspace(
     hookDb: hermeticExecution ? null : db,
     approvalGate: hermeticExecution ? null : approvalGate,
     permissionRules: hermeticExecution ? null : permissionRules,
+    permissionRulesProvider: hermeticExecution ? null : permissionRulesProvider,
     settingsHooks: hermeticExecution ? null : settingsHooks,
     // Seed the subagent-contract CEILING with this run's permission mode so a
     // spawned sub-agent inherits/tightens from it (tighten-only): a
@@ -2758,6 +2773,12 @@ async function runAgentHeadlessInWorkspace(
                     // and countDuplicateCommittedEffects can measure `0` repeats.
                     meta: {
                       tool: event.tool,
+                      toolUseId: telemetryToolId,
+                      turnId: event.turn_id || null,
+                      resources: collectToolResourceIdentifiers(
+                        event.tool,
+                        event.args,
+                      ),
                       idempotencyKey: operationIdempotencyKey({
                         tool: event.tool,
                         args: event.args,
@@ -3269,6 +3290,7 @@ async function runAgentHeadlessInWorkspace(
     await cleanupDeadline.run("remote-approval", () =>
       _remoteApproval?.close?.(),
     );
+    approvalGate?.setAuthorizationConsumer?.(null);
     // settings.json Stop + SessionEnd hooks when the run finishes. Stop is the
     // canonical async-hook trigger ("run the test suite at turn end"); fire its
     // async hooks fire-and-forget, then settle so a fast background check can

package/src/runtime/headless-stream.js

@@ -60,6 +60,7 @@ import {
   expandIdeMentions,
 } from "../lib/ide-context.js";
 import { detectVersionSkew, versionSkewMessage } from "../lib/version-skew.js";
+import { captureAmbientExecutionLocation } from "../lib/execution-location-runtime.js";
 import {
   resolveAgentMcp,
   resolvePermissionPromptTool,
@@ -114,6 +115,7 @@ import {
   reconcileSideEffects,
   classifyToolSideEffect,
 } from "../lib/side-effect-ledger.js";
+import { collectToolResourceIdentifiers } from "../lib/permission-side-effect-center.js";
 import { DiffReviewFollowUpTracker } from "../lib/diff-review-follow-up.js";
 import {
   loadSideEffectLedger,
@@ -909,6 +911,12 @@ async function runTurn(
                 // and countDuplicateCommittedEffects can measure `0` repeats.
                 meta: {
                   tool: event.tool,
+                  toolUseId: toolUseId || null,
+                  turnId: event.turn_id || null,
+                  resources: collectToolResourceIdentifiers(
+                    event.tool,
+                    event.args,
+                  ),
                   idempotencyKey: operationIdempotencyKey({
                     tool: event.tool,
                     args: event.args,
@@ -1608,33 +1616,27 @@ async function runAgentHeadlessStreamInWorkspace(
   // .claude/settings.json permission rules (deny > ask > allow); see
   // runAgentHeadless for the full semantics. null = no file → unchanged.
   let permissionRules = options.permissionRules || null;
+  let permissionRulesProvider = options.permissionRulesProvider || null;
   let managedSettings = null;
   let settingsFiles = [];
-  try {
-    const { loadSettings, applyManagedPermissionPolicy } =
-      await import("../lib/settings-loader.cjs");
-    const loaded = loadSettings({
-      cwd,
-      settingsFile: options.settingsFile,
-      managedSettingsFile: options.managedSettingsFile,
-    });
-    managedSettings = loaded.managed;
-    settingsFiles = Array.isArray(loaded.files) ? loaded.files : [];
-    if (!permissionRules) {
-      const total =
-        loaded.rules.allow.length +
-        loaded.rules.ask.length +
-        loaded.rules.deny.length;
-      permissionRules = total > 0 ? loaded.rules : null;
-    } else if (managedSettings) {
-      permissionRules = applyManagedPermissionPolicy(
-        permissionRules,
-        managedSettings,
-      );
-    }
-  } catch (error) {
-    if (error?.code === "CC_MANAGED_SETTINGS_INVALID") throw error;
-    // Preserve caller-provided rules; absent settings keep legacy behavior.
+  const { createPermissionRulesProvider, loadPermissionAuthority } =
+    await import("../lib/permission-authority.js");
+  const authorityOptions = {
+    cwd,
+    settingsFile: options.settingsFile,
+    managedSettingsFile: options.managedSettingsFile,
+    baseRules: options.permissionRules || null,
+  };
+  const loadedPermissionAuthority = loadPermissionAuthority(authorityOptions);
+  managedSettings = loadedPermissionAuthority.managed;
+  settingsFiles = Array.isArray(loadedPermissionAuthority.files)
+    ? loadedPermissionAuthority.files
+    : [];
+  permissionRules = loadedPermissionAuthority.hasRules
+    ? loadedPermissionAuthority.rules
+    : null;
+  if (!permissionRulesProvider) {
+    permissionRulesProvider = createPermissionRulesProvider(authorityOptions);
   }
 
   // .claude/settings.json `hooks` block (decision-capable PreToolUse/PostToolUse).
@@ -2057,6 +2059,8 @@ async function runAgentHeadlessStreamInWorkspace(
   let approvalGate = null;
   try {
     approvalGate = await getApprovalGate();
+    approvalGate =
+      approvalGate?.createSessionScope?.(sessionId) || approvalGate;
     if (approvalGate && (options.permissionMode || "default") === "auto") {
       // autoMode.decisions: user-configured riskLevel → allow/ask/deny
       // classifier (same wiring as headless-runner). Only wrap when settings
@@ -2080,6 +2084,7 @@ async function runAgentHeadlessStreamInWorkspace(
       }
     }
     if (approvalGate) {
+      approvalGate.setAuthorizationConsumer?.(null);
       approvalGate.setSessionPolicy?.(sessionId, perm.sessionPolicy);
       approvalGate.setConfirmer?.(
         interactive && perm.allowInteractiveApprovals
@@ -2368,6 +2373,10 @@ async function runAgentHeadlessStreamInWorkspace(
             provider,
             model,
             observabilityScope: options.observabilityScope,
+            executionLocation: captureAmbientExecutionLocation({
+              provider,
+              model,
+            }),
           }),
           "startSession",
         );
@@ -2736,6 +2745,18 @@ async function runAgentHeadlessStreamInWorkspace(
     options.interactiveApprovals !== true
   ) {
     try {
+      if (
+        !approvalGate ||
+        typeof approvalGate.setConfirmer !== "function" ||
+        typeof approvalGate.setAuthorizationConsumer !== "function" ||
+        typeof approvalGate.consumeAuthorization !== "function"
+      ) {
+        const error = new Error(
+          "installed session-core cannot bind and consume durable remote approval",
+        );
+        error.code = "CC_REMOTE_APPROVAL_GATE_UNAVAILABLE";
+        throw error;
+      }
       const startRemoteApproval =
         deps.startHeadlessRemoteApproval ||
         (await import("../lib/remote-approval-bridge.js"))
@@ -2751,9 +2772,10 @@ async function runAgentHeadlessStreamInWorkspace(
         remote_session_id: _remoteApproval.pairing.remoteSessionId,
         expires_at: _remoteApproval.pairing.expiresAt,
       });
-      if (approvalGate && typeof approvalGate.setConfirmer === "function") {
-        approvalGate.setConfirmer(_remoteApproval.confirmer);
-      }
+      approvalGate.setConfirmer(_remoteApproval.confirmer);
+      approvalGate.setAuthorizationConsumer(
+        _remoteApproval.consumeAuthorization,
+      );
     } catch (err) {
       emit({
         type: "remote_control",
@@ -2791,6 +2813,7 @@ async function runAgentHeadlessStreamInWorkspace(
     hookDb: db,
     approvalGate,
     permissionRules,
+    permissionRulesProvider,
     settingsHooks,
     toolAdmission: options.toolAdmission || null,
     classifyAllShell,