chainlesschain 0.164.0 → 0.165.1

package/src/lib/with-file-lock.js

@@ -12,10 +12,13 @@
  * `timeoutMs`, it proceeds unlocked. Callers that set `failIfUnavailable` get a
  * strict lock: every owner has a PID + unguessable token, a live owner is never
  * reclaimed merely because the directory is old, and corrupt ownership fails
- * closed. Confirmed-dead owners are reclaimed with an exact-token marker inside
- * the lock directory so a delayed contender cannot delete a replacement lock.
- * Strict callers may use bounded jittered retries and an after-release yield to
- * avoid Windows sharing transients and fixed-interval lock convoys.
+ * closed. The default filesystem publishes a fully populated, uniquely staged
+ * directory in one rename so a process killed during acquisition cannot expose
+ * an ownerless lock. Confirmed-dead owners are reclaimed with an exact-token
+ * marker inside the lock directory so a delayed contender cannot delete a
+ * replacement lock. Strict callers may use bounded jittered retries and an
+ * after-release yield to avoid Windows sharing transients and fixed-interval
+ * lock convoys.
  *
  * @param {string} targetPath  the file being guarded (lock is `${targetPath}.lock`)
  * @param {(ctx:{locked:boolean})=>T} fn  critical section; receives whether the lock was held
@@ -37,6 +40,10 @@ export function withFileLock(targetPath, fn, opts = {}) {
     _ownerToken = () => randomUUID(),
     failIfUnavailable = false,
   } = opts;
+  const isOwnerAlive =
+    typeof opts._isOwnerAlive === "function"
+      ? opts._isOwnerAlive
+      : (candidate) => _isProcessAlive(candidate.pid);
 
   const lockDir = `${targetPath}.lock`;
   const ownerPath = path.join(lockDir, "owner.json");
@@ -52,36 +59,9 @@ export function withFileLock(targetPath, fn, opts = {}) {
 
   for (;;) {
     try {
-      _fs.mkdirSync(lockDir);
-      try {
-        _fs.writeFileSync(ownerPath, JSON.stringify(owner), {
-          encoding: "utf8",
-          mode: 0o600,
-          flag: "wx",
-        });
-        held = true;
-        break;
-      } catch (error) {
-        _fs.rmSync(lockDir, { recursive: true, force: true });
-        acquisitionError = error;
-        if (
-          failIfUnavailable &&
-          isTransientLockError(error) &&
-          waitForRetry({
-            _now,
-            _sleep,
-            _random,
-            deadline,
-            retryAttempt: retryAttempt++,
-            retryMs,
-            maxRetryMs,
-            retryJitterMs,
-          })
-        ) {
-          continue;
-        }
-        break;
-      }
+      acquireOwnedDirectory(_fs, lockDir, owner);
+      held = true;
+      break;
     } catch (error) {
       if (!error || error.code !== "EEXIST") {
         acquisitionError = error;
@@ -108,8 +88,8 @@ export function withFileLock(targetPath, fn, opts = {}) {
       const incumbent = ownerRead.owner;
       acquisitionError = ownerRead.error;
       if (incumbent) {
-        if (!_isProcessAlive(incumbent.pid)) {
-          if (reclaimOwnedDirectory(_fs, lockDir, incumbent, _isProcessAlive)) {
+        if (!isOwnerAlive(incumbent)) {
+          if (reclaimOwnedDirectory(_fs, lockDir, incumbent, isOwnerAlive)) {
             continue;
           }
         }
@@ -200,6 +180,61 @@ const defaultFs = {
   rmSync: (p, o) => fs.rmSync(p, o),
 };
 
+function acquireOwnedDirectory(_fs, lockDir, owner) {
+  const serializedOwner = JSON.stringify(owner);
+  // Injected legacy filesystems used by a few consumers may not implement
+  // rename. Keep their old acquire path, while the real Node filesystem always
+  // uses the crash-safe staged publication below.
+  if (typeof _fs.renameSync !== "function") {
+    _fs.mkdirSync(lockDir);
+    try {
+      _fs.writeFileSync(path.join(lockDir, "owner.json"), serializedOwner, {
+        encoding: "utf8",
+        mode: 0o600,
+        flag: "wx",
+      });
+      return;
+    } catch (error) {
+      _fs.rmSync(lockDir, { recursive: true, force: true });
+      throw error;
+    }
+  }
+
+  const candidateDir = `${lockDir}.acquire-${owner.token}`;
+  try {
+    _fs.mkdirSync(candidateDir);
+    _fs.writeFileSync(path.join(candidateDir, "owner.json"), serializedOwner, {
+      encoding: "utf8",
+      mode: 0o600,
+      flag: "wx",
+    });
+    _fs.renameSync(candidateDir, lockDir);
+  } catch (error) {
+    try {
+      _fs.rmSync(candidateDir, { recursive: true, force: true });
+    } catch {
+      /* uniquely-tokened acquisition debris cannot block the lock path */
+    }
+    if (directoryExists(_fs, lockDir)) {
+      const contention = new Error("State lock already exists", {
+        cause: error,
+      });
+      contention.code = "EEXIST";
+      throw contention;
+    }
+    throw error;
+  }
+}
+
+function directoryExists(_fs, target) {
+  try {
+    _fs.statSync(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -310,7 +345,7 @@ function writeOwnerMarker(_fs, markerPath, owner) {
   });
 }
 
-function reclaimOwnedDirectory(_fs, lockDir, owner, processAlive) {
+function reclaimOwnedDirectory(_fs, lockDir, owner, ownerAlive) {
   const markerPath = path.join(lockDir, `.reclaim-${owner.token}`);
   try {
     writeOwnerMarker(_fs, markerPath, owner);
@@ -319,7 +354,7 @@ function reclaimOwnedDirectory(_fs, lockDir, owner, processAlive) {
     throw error;
   }
   const current = readOwner(_fs, path.join(lockDir, "owner.json"));
-  if (!sameOwner(current, owner) || processAlive(owner.pid)) {
+  if (!sameOwner(current, owner) || ownerAlive(owner)) {
     removeOwnMarker(_fs, markerPath, owner);
     return false;
   }

package/src/repl/agent-repl.js

@@ -3175,6 +3175,11 @@ async function startAgentReplInWorkspaceOwned(
     const { getApprovalGate } =
       await import("../lib/session-core-singletons.js");
     _approvalGate = await getApprovalGate();
+    _approvalGate =
+      _approvalGate?.createSessionScope?.(
+        sessionId || `repl-scope:${randomUUID()}`,
+      ) || _approvalGate;
+    _approvalGate?.setAuthorizationConsumer?.(null);
     // autoMode.decisions: wrap the gate with the configurable classifier
     // BEFORE setConfirmer so the wrapper captures the interactive confirmer.
     // Inactive (delegating) unless the session mode is "auto"; not installed
@@ -3252,29 +3257,53 @@ async function startAgentReplInWorkspaceOwned(
           },
         };
       };
-      _approvalGate.setConfirmer(async ({ tool, args, riskLevel }) => {
-        if (_dontAskActive()) {
-          process.stdout.write(
-            chalk.yellow(
-              `\n  ✕ denied without asking (dontAsk mode): ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}\n`,
-            ),
+      _approvalGate.setConfirmer(
+        async ({
+          tool,
+          args,
+          riskLevel,
+          action,
+          cwd,
+          workspace,
+          sessionId,
+          session,
+          targetEnv,
+          policyVersion,
+        }) => {
+          if (_dontAskActive()) {
+            process.stdout.write(
+              chalk.yellow(
+                `\n  ✕ denied without asking (dontAsk mode): ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}\n`,
+              ),
+            );
+            return false;
+          }
+          await _fireNotification(
+            `Permission needed: ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}`,
+            "info",
+            _sessionHandle,
           );
-          return false;
-        }
-        await _fireNotification(
-          `Permission needed: ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}`,
-          "info",
-          _sessionHandle,
-        );
-        const local = askGateApprovalLocally({ tool, args, riskLevel });
-        if (!_remoteApproval?.bridge) return local.promise;
-        return raceLocalAndRemote({
-          bridge: _remoteApproval.bridge,
-          ask: describeAskContext({ tool, args, riskLevel }),
-          local,
-          writeOut: (text) => process.stdout.write(chalk.cyan(text)),
-        });
-      });
+          const local = askGateApprovalLocally({ tool, args, riskLevel });
+          if (!_remoteApproval?.bridge) return local.promise;
+          return raceLocalAndRemote({
+            bridge: _remoteApproval.bridge,
+            ask: describeAskContext({
+              tool,
+              args,
+              riskLevel,
+              action,
+              cwd,
+              workspace,
+              sessionId,
+              session,
+              targetEnv,
+              policyVersion,
+            }),
+            local,
+            writeOut: (text) => process.stdout.write(chalk.cyan(text)),
+          });
+        },
+      );
     }
   } catch (_err) {
     _approvalGate = null;
@@ -3364,13 +3393,11 @@ async function startAgentReplInWorkspaceOwned(
         _sessionHandle,
       );
       const local = askPermissionLocally({ tool, args, rule, reason });
-      if (!_remoteApproval?.bridge) return local.promise;
-      return raceLocalAndRemote({
-        bridge: _remoteApproval.bridge,
-        ask: describeAskContext({ tool, args, rule, reason }),
-        local,
-        writeOut: (text) => process.stdout.write(chalk.cyan(text)),
-      });
+      // This confirmer is consumed as a legacy boolean by settings/hook
+      // admission. A remote lease must never be flattened there and then skip
+      // the ApprovalGate consume, so this path remains local-only until it can
+      // carry the opaque authorization through its own dispatch boundary.
+      return local.promise;
     };
   } catch (_err) {
     if (
@@ -3568,6 +3595,18 @@ async function startAgentReplInWorkspaceOwned(
   // purely how the confirmers consume it — they RACE the terminal prompt
   // against the paired device instead of gating on the remote alone.
   const _startRemoteApproval = async () => {
+    if (
+      !_approvalGate ||
+      typeof _approvalGate.setConfirmer !== "function" ||
+      typeof _approvalGate.setAuthorizationConsumer !== "function" ||
+      typeof _approvalGate.consumeAuthorization !== "function"
+    ) {
+      const error = new Error(
+        "installed session-core cannot bind and consume durable remote approval",
+      );
+      error.code = "CC_REMOTE_APPROVAL_GATE_UNAVAILABLE";
+      throw error;
+    }
     const { startHeadlessRemoteApproval } =
       await import("../lib/remote-approval-bridge.js");
     const started = await startHeadlessRemoteApproval({
@@ -3580,6 +3619,7 @@ async function startAgentReplInWorkspaceOwned(
       pairing: started.pairing,
       close: started.close,
     };
+    _approvalGate.setAuthorizationConsumer(started.consumeAuthorization);
     logger.log(
       chalk.cyan(
         "  remote-control: permission prompts can be answered from a paired device (first answer — terminal or device — wins)",
@@ -3597,6 +3637,7 @@ async function startAgentReplInWorkspaceOwned(
   const _stopRemoteApproval = async () => {
     const active = _remoteApproval;
     _remoteApproval = null; // confirmers fall back to local-only immediately
+    _approvalGate?.setAuthorizationConsumer?.(null);
     if (active) await active.close().catch(() => undefined);
   };
 

package/src/repl/remote-approval.js

@@ -19,14 +19,21 @@
 /**
  * Normalize the shapes the REPL's two confirmers receive (ApprovalGate
  * `{tool, args, riskLevel}` / settings-hook `{tool, args, rule, reason}`)
- * into the bridge's `{tool, action, detail}` ask payload.
+ * into the bridge's exact durable ask payload.
  */
 export function describeAskContext({
   tool,
   args,
+  action = null,
   rule = null,
   reason = null,
   riskLevel = null,
+  cwd = null,
+  workspace = null,
+  sessionId = null,
+  session = null,
+  targetEnv = null,
+  policyVersion = null,
 } = {}) {
   const detail =
     typeof args?.command === "string"
@@ -38,17 +45,24 @@ export function describeAskContext({
           : null;
   return {
     tool: tool || null,
-    action: rule
-      ? `ask-rule:${rule}`
-      : reason || (riskLevel ? `${riskLevel}-risk` : null),
+    action:
+      action ||
+      (rule
+        ? `ask-rule:${rule}`
+        : reason || (riskLevel ? `${riskLevel}-risk` : null)),
     detail,
+    operationArgs: args === undefined ? null : structuredClone(args),
+    workspace: workspace || cwd || null,
+    session: session || sessionId || null,
+    targetEnv: targetEnv || null,
+    policyVersion: policyVersion || null,
   };
 }
 
 // These outcomes are not a remote human decision. The terminal may still
 // answer, but its result is accepted only if resolveLocally can durably settle
 // the same live card.
-const NON_DECISIVE_REMOTE = new Set(["timeout", "closed"]);
+const NON_DECISIVE_REMOTE = new Set(["timeout", "closed", "lease-unavailable"]);
 
 /**
  * Race the local interactive prompt against the paired-device decision.
@@ -83,14 +97,22 @@ export async function raceLocalAndRemote({
     () => ({ src: "local", approved: false }),
   );
   let winner = await Promise.race([remoteLeg, localLeg]);
+  let remoteUnavailableWithoutCard = false;
   if (
     winner.src === "remote" &&
     NON_DECISIVE_REMOTE.has(winner.decision?.via)
   ) {
+    remoteUnavailableWithoutCard =
+      winner.decision?.via === "lease-unavailable" && !requestId;
     winner = await localLeg;
   }
   if (winner.src === "local") {
-    if (!requestId) return false;
+    // Unsupported tools have no durable remote card to settle. In that exact
+    // lease-unavailable case, preserve the existing local confirmation path;
+    // timeout/closed responses without a request id remain fail-closed.
+    if (!requestId) {
+      return remoteUnavailableWithoutCard && winner.approved === true;
+    }
     try {
       const persisted = bridge.resolveLocally(requestId, winner.approved);
       return persisted === true && winner.approved === true;
@@ -107,5 +129,5 @@ export async function raceLocalAndRemote({
   writeOut(
     `\n  ✓ ${winner.decision.approved ? "allowed" : "denied"} from paired device\n`,
   );
-  return winner.decision.approved === true;
+  return winner.decision;
 }