chainlesschain 0.164.0 → 0.165.2

package/src/lib/plugin-runtime/marketplace-catalog.js

@@ -14,6 +14,8 @@ import {
   parsePluginDependencies,
 } from "./governance.js";
 import { describeCapabilities, normalizeCapabilities } from "./capabilities.js";
+import { normalizePublisherDeclaration } from "./publisher-trust.js";
+import { normalizeMarketplaceNetworkAuthority } from "./marketplace-network.js";
 
 export const PLUGIN_MARKETPLACE_CATALOG_SCHEMA =
   "cc-plugin-marketplace-catalog/v1";
@@ -42,6 +44,8 @@ export function buildPluginMarketplaceInstallPreflight({
   registryUrl,
   entry,
   fromCache = false,
+  registryDocumentSha256 = null,
+  registryNetworkAuthority = null,
   installed = {},
   hostVersion = null,
   strict = false,
@@ -53,6 +57,8 @@ export function buildPluginMarketplaceInstallPreflight({
         url: registryUrl,
         registry: { plugins: [entry] },
         fromCache,
+        documentSha256: registryDocumentSha256,
+        networkAuthority: registryNetworkAuthority,
       },
     ],
     installed,
@@ -108,6 +114,9 @@ export function buildPluginMarketplaceCandidateSelection({
       ),
     );
   }
+  if (catalog.dependencyGraph?.truncated === true) {
+    blockers.push(issue("DEPENDENCY_GRAPH_TRUNCATED"));
+  }
   if (selected) {
     for (const blocker of effectiveInstallBlockers(selected)) {
       blockers.push({
@@ -221,6 +230,9 @@ function buildInstallPreflight({ catalog, candidate, observedAt, selection }) {
     candidateDigest: candidate.candidateDigest,
     contentDigest: candidate.contentDigest,
     name: candidate.name,
+    ...(candidate.publisherIdentity
+      ? { publisherIdentity: candidate.publisherIdentity }
+      : {}),
     registry: candidate.registry,
     package: candidate.package,
     registryVersion: candidate.version,
@@ -331,6 +343,7 @@ export function buildPluginMarketplaceCatalog({
   candidates.sort(compareCandidates);
   sourceRows.sort((a, b) => a.priority - b.priority);
   const dependencyGraph = buildDependencyGraph(candidates, installedVersions);
+  applyDependencyCycleBlockers(candidates, dependencyGraph.cycles);
 
   const summary = {
     sourceCount: sourceRows.length,
@@ -359,7 +372,11 @@ export function buildPluginMarketplaceCatalog({
     schemaVersion: PLUGIN_MARKETPLACE_CATALOG_SCHEMA,
     strict: strict === true,
     hostVersion: boundedString(hostVersion, 128) || null,
-    sources: sourceRows.map(({ error: _error, ...source }) => source),
+    sources: sourceRows.map((source) => {
+      const authoritySource = { ...source };
+      delete authoritySource.error;
+      return authoritySource;
+    }),
     candidates,
     dependencyGraph,
   };
@@ -387,7 +404,7 @@ function normalizeCatalogSource(input, priority) {
   const raw = input && typeof input === "object" ? input : {};
   const sanitizedUrl = sanitizeUrl(raw.url);
   const url = sanitizedUrl || `invalid-source-${priority + 1}`;
-  const error = raw.error
+  let error = raw.error
     ? {
         code: boundedString(raw.error.code, 64) || "REGISTRY_FETCH_FAILED",
         message: scrubError(raw.error.message || raw.error),
@@ -398,6 +415,24 @@ function normalizeCatalogSource(input, priority) {
           message: "registry source URL is missing or invalid",
         }
       : null;
+  const documentSha256 = boundedString(raw.documentSha256, 64).toLowerCase();
+  if (raw.documentSha256 != null && !SHA256_RE.test(documentSha256)) {
+    error = {
+      code: "INVALID_REGISTRY_DOCUMENT_DIGEST",
+      message: "registry document SHA-256 is invalid",
+    };
+  }
+  let networkAuthority = null;
+  try {
+    networkAuthority = normalizeMarketplaceNetworkAuthority(
+      raw.networkAuthority,
+    );
+  } catch (networkError) {
+    error = {
+      code: "INVALID_REGISTRY_NETWORK_AUTHORITY",
+      message: scrubError(networkError.message),
+    };
+  }
   const registry =
     raw.registry && typeof raw.registry === "object" ? raw.registry : null;
   return {
@@ -408,6 +443,8 @@ function normalizeCatalogSource(input, priority) {
       url,
       name: boundedString(registry?.name, 256) || null,
       status: error ? "unavailable" : raw.fromCache ? "cached" : "online",
+      ...(documentSha256 ? { documentSha256 } : {}),
+      ...(networkAuthority ? { networkAuthority } : {}),
       candidateCount: 0,
       ...(error ? { error } : {}),
     },
@@ -504,6 +541,10 @@ function normalizeCandidate(entry, context) {
   }
 
   const publisherHealth = normalizePublisherHealth(raw.health);
+  const publisherIdentity = normalizePublisherDeclaration(raw.publisher);
+  if (raw.publisher != null && !publisherIdentity) {
+    warnings.push(issue("PUBLISHER_IDENTITY_DECLARATION_INVALID"));
+  }
   if (publisherHealth.status === "unhealthy") {
     blockers.push(issue("PUBLISHER_HEALTH_UNHEALTHY"));
   }
@@ -546,12 +587,19 @@ function normalizeCandidate(entry, context) {
     candidateId,
     name,
     version,
+    ...(publisherIdentity ? { publisherIdentity } : {}),
     description,
     registry: {
       sourceId: context.source.sourceId,
       priority: context.source.priority,
       url: context.source.url,
       status: context.source.status,
+      ...(context.source.documentSha256
+        ? { documentSha256: context.source.documentSha256 }
+        : {}),
+      ...(context.source.networkAuthority
+        ? { networkAuthority: context.source.networkAuthority }
+        : {}),
     },
     package: { source: sourceUrl, ref },
     integrity,
@@ -625,6 +673,9 @@ function normalizeCandidate(entry, context) {
       errors: candidate.dependencies.errors,
     },
     publisherHealth: candidate.health.publisher,
+    ...(candidate.publisherIdentity
+      ? { publisherIdentity: candidate.publisherIdentity }
+      : {}),
     governance: candidate.governance,
   };
   candidate.contentDigest = sha256Canonical(contentAuthority);
@@ -1006,6 +1057,21 @@ function findDependencyCycles(candidates, edges) {
   );
 }
 
+function applyDependencyCycleBlockers(candidates, cycles) {
+  const cyclicIds = new Set(cycles.flat());
+  for (const candidate of candidates) {
+    if (!cyclicIds.has(candidate.candidateId)) continue;
+    if (
+      !candidate.installability.blockers.some(
+        (blocker) => blocker.code === "DEPENDENCY_CYCLE",
+      )
+    ) {
+      candidate.installability.blockers.push(issue("DEPENDENCY_CYCLE"));
+    }
+    candidate.installability.status = "blocked";
+  }
+}
+
 function canonicalCycle(cycle) {
   if (cycle.length < 2) return cycle;
   const rotations = cycle.map((_, index) => [

package/src/lib/plugin-runtime/marketplace-impact.js

@@ -6,15 +6,20 @@
 import crypto from "node:crypto";
 import semver from "semver";
 import { diffCapabilities, normalizeCapabilities } from "./capabilities.js";
-import { PLUGIN_MARKETPLACE_PAYLOAD_SBOM_SCHEMA } from "./marketplace-artifact-readback.js";
+import {
+  PLUGIN_MARKETPLACE_CANONICAL_PAYLOAD_SBOM_SCHEMA,
+  isMarketplacePayloadSbomFormat,
+} from "./marketplace-artifact-readback.js";
 import { PLUGIN_MARKETPLACE_INSTALL_PREFLIGHT_SCHEMA } from "./marketplace-catalog.js";
 
 export const PLUGIN_MARKETPLACE_UPDATE_IMPACT_SCHEMA =
-  "cc-plugin-marketplace-update-impact/v1";
+  "cc-plugin-marketplace-update-impact/v2";
 
 export function buildPluginMarketplaceUpdateImpact({
   preflight,
   installed = null,
+  installedScopes = null,
+  targetScope = null,
   observedAt = new Date().toISOString(),
 } = {}) {
   if (
@@ -26,8 +31,25 @@ export function buildPluginMarketplaceUpdateImpact({
     );
   }
   const current = normalizeInstalled(installed);
+  const hasScopedInventory = Array.isArray(installedScopes);
+  const physical = normalizeInstalledScopes(installedScopes, current);
   const version = compareVersion(current?.version, preflight.registryVersion);
-  const source = compareSource(current?.source, preflight);
+  const sourceTransitions = physical.map((entry) => ({
+    scope: entry.scope,
+    transition: compareSource(entry.source, preflight),
+  }));
+  const physicalSourceSwitches = hasScopedInventory
+    ? sourceTransitions
+        .filter(({ transition }) => transition.requiresApproval)
+        .map(({ scope }) => scope)
+    : [];
+  const source = {
+    ...compareSource(current?.source, preflight),
+    requiresApproval:
+      compareSource(current?.source, preflight).requiresApproval ||
+      physicalSourceSwitches.length > 0,
+    physicalSourceSwitches,
+  };
   const integrity = compareIntegrity(
     current?.integrity,
     preflight.integrity,
@@ -46,21 +68,65 @@ export function buildPluginMarketplaceUpdateImpact({
     preflight.dependencies?.declared || {},
   );
   const approvals = [];
+  const blockers = [...preflight.blockers];
   if (source.requiresApproval) {
-    approvals.push({
+    pushUniqueFinding(approvals, {
       code: "SOURCE_SWITCH_APPROVAL_REQUIRED",
-      detail: source.kind,
+      detail:
+        physicalSourceSwitches.length > 0
+          ? `scopes: ${physicalSourceSwitches.join(", ")}`
+          : source.kind,
     });
   }
   if (version.kind === "downgrade") {
-    approvals.push({ code: "VERSION_DOWNGRADE_APPROVAL_REQUIRED" });
+    pushUniqueFinding(approvals, {
+      code: "VERSION_DOWNGRADE_APPROVAL_REQUIRED",
+    });
   }
   if (capabilities.widened) {
-    approvals.push({
+    pushUniqueFinding(approvals, {
       code: "CAPABILITY_WIDENING_CONSENT_REQUIRED",
       detail: capabilities.added.join(", "),
     });
   }
+  if (integrity.semanticPayloadBinding.downgraded) {
+    pushUniqueFinding(blockers, {
+      code: "SEMANTIC_SBOM_BINDING_DOWNGRADE",
+    });
+  }
+  if (current && version.kind === "candidate-version-deferred") {
+    pushUniqueFinding(blockers, {
+      code: "REGISTRY_VERSION_REQUIRED_FOR_UPDATE",
+    });
+  }
+
+  const candidateSemanticFormat = candidateSemanticPayloadFormat(preflight);
+  const semanticDowngradeScopes = hasScopedInventory
+    ? physical
+        .filter(
+          (entry) =>
+            semanticPayloadStrength(
+              entry.integrity?.sbom?.semanticPayloadFormat,
+            ) > semanticPayloadStrength(candidateSemanticFormat),
+        )
+        .map((entry) => entry.scope)
+    : [];
+  if (semanticDowngradeScopes.length > 0) {
+    pushUniqueFinding(blockers, {
+      code: "SEMANTIC_SBOM_BINDING_DOWNGRADE",
+      detail: `scopes: ${semanticDowngradeScopes.join(", ")}`,
+    });
+  }
+  const scopeAuthority =
+    hasScopedInventory || targetScope
+      ? buildScopeAuthorityChange({
+          current,
+          physical,
+          targetScope,
+          physicalSourceSwitches,
+          semanticDowngradeScopes,
+        })
+      : null;
 
   const changes = {
     version,
@@ -73,6 +139,7 @@ export function buildPluginMarketplaceUpdateImpact({
       status: preflight.governance.status,
       missing: preflight.governance.missing,
     },
+    ...(scopeAuthority ? { scopeAuthority } : {}),
   };
   const changeCount = countChanges(changes);
   const authority = {
@@ -83,20 +150,22 @@ export function buildPluginMarketplaceUpdateImpact({
       ? { selectionDigest: preflight.selectionDigest }
       : {}),
     installed: current,
+    installedScopes: physical,
     changes,
-    blockers: preflight.blockers,
+    blockers,
     approvals,
   };
   return {
     schemaVersion: PLUGIN_MARKETPLACE_UPDATE_IMPACT_SCHEMA,
     observedAt,
     impactDigest: sha256Canonical(authority),
-    status: preflight.blockers.length
+    status: blockers.length
       ? "blocked"
       : approvals.length || changeCount
         ? "review-required"
         : "no-change",
     installed: current,
+    installedScopes: physical,
     candidate: {
       candidateId: preflight.candidateId,
       candidateDigest: preflight.candidateDigest,
@@ -114,13 +183,13 @@ export function buildPluginMarketplaceUpdateImpact({
     },
     changes,
     changeCount,
-    blockers: preflight.blockers,
+    blockers,
     requiredApprovals: approvals,
     claims: {
       candidateMetadataVerified: false,
       candidateBytesFetched: false,
       candidateCodeExecuted: false,
-      installedEvidenceAuthority: "local-immutable-install",
+      installedEvidenceAuthority: "local-installed-state",
     },
   };
 }
@@ -131,6 +200,7 @@ function normalizeInstalled(value) {
     name: clean(value.name, 256) || null,
     version: clean(value.version, 128) || null,
     scope: clean(value.scope, 32) || null,
+    enabled: value.enabled !== false,
     source: normalizeInstalledSource(value.source),
     integrity: normalizeInstalledIntegrity(value.integrity),
     license: {
@@ -142,6 +212,22 @@ function normalizeInstalled(value) {
   };
 }
 
+function normalizeInstalledScopes(values, current) {
+  const normalized = (Array.isArray(values) ? values : [])
+    .map(normalizeInstalled)
+    .filter(Boolean);
+  if (normalized.length === 0 && current) normalized.push(current);
+  const byScope = new Map();
+  for (const entry of normalized) {
+    if (!entry.scope || byScope.has(entry.scope)) continue;
+    byScope.set(entry.scope, entry);
+  }
+  const rank = (scope) => ["user", "project", "local"].indexOf(scope);
+  return [...byScope.values()].sort(
+    (left, right) => rank(left.scope) - rank(right.scope),
+  );
+}
+
 function normalizeInstalledSource(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const authority = value.catalogAuthority;
@@ -183,6 +269,7 @@ function normalizeInstalledSource(value) {
 function normalizeInstalledIntegrity(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const payloadSchema = clean(value.sbom?.payloadSchema, 128) || null;
+  const semanticPayloadFormat = clean(value.sbom?.semanticPayloadFormat, 128);
   return {
     signature: {
       present: value.signature?.present === true,
@@ -193,11 +280,15 @@ function normalizeInstalledIntegrity(value) {
     sbom: {
       present: value.sbom?.present === true,
       digest: clean(value.sbom?.digest, 128) || null,
-      payloadSha256:
-        payloadSchema === PLUGIN_MARKETPLACE_PAYLOAD_SBOM_SCHEMA
-          ? clean(value.sbom?.payloadSha256, 128) || null
-          : null,
+      payloadSha256: isMarketplacePayloadSbomFormat(payloadSchema)
+        ? clean(value.sbom?.payloadSha256, 128) || null
+        : null,
       payloadSchema,
+      semanticPayloadFormat: isMarketplacePayloadSbomFormat(
+        semanticPayloadFormat,
+      )
+        ? semanticPayloadFormat
+        : null,
       fileCount: Number.isSafeInteger(value.sbom?.fileCount)
         ? value.sbom.fileCount
         : null,
@@ -294,6 +385,21 @@ function compareIntegrity(current, candidate, currentSource = null) {
     current?.signature?.publicKeySha256,
     candidate?.signature?.publicKeySha256,
   );
+  const installedSemanticFormat = isMarketplacePayloadSbomFormat(
+    current?.sbom?.semanticPayloadFormat,
+  )
+    ? current.sbom.semanticPayloadFormat
+    : null;
+  const candidateSemanticFormat =
+    isMarketplacePayloadSbomFormat(candidate?.sbom?.format) &&
+    candidate?.sbom?.status === "declared" &&
+    candidate?.sbom?.remoteVerification === "complete"
+      ? candidate.sbom.format
+      : null;
+  const semanticPayloadBinding = compareSemanticPayloadBinding(
+    installedSemanticFormat,
+    candidateSemanticFormat,
+  );
   return {
     manifestDigest: compareScalar(installedManifest, candidateManifest),
     signature: {
@@ -313,9 +419,94 @@ function compareIntegrity(current, candidate, currentSource = null) {
       installedSbomDocument,
       candidateSbomDocument,
     ),
+    semanticPayloadBinding,
   };
 }
 
+function compareSemanticPayloadBinding(from, to) {
+  const fromStrength = semanticPayloadStrength(from);
+  const toStrength = semanticPayloadStrength(to);
+  return {
+    from: from || null,
+    to: to || null,
+    kind: !from
+      ? to
+        ? "added"
+        : "absent"
+      : !to
+        ? "removed"
+        : from === to
+          ? "same"
+          : toStrength < fromStrength
+            ? "weakened"
+            : "changed-format",
+    changed: from !== to,
+    downgraded: fromStrength > toStrength,
+  };
+}
+
+function semanticPayloadStrength(format) {
+  return format === PLUGIN_MARKETPLACE_CANONICAL_PAYLOAD_SBOM_SCHEMA
+    ? 2
+    : isMarketplacePayloadSbomFormat(format)
+      ? 1
+      : 0;
+}
+
+function candidateSemanticPayloadFormat(preflight) {
+  const sbom = preflight.integrity?.sbom;
+  return isMarketplacePayloadSbomFormat(sbom?.format) &&
+    sbom.status === "declared" &&
+    sbom.remoteVerification === "complete"
+    ? sbom.format
+    : null;
+}
+
+function buildScopeAuthorityChange({
+  current,
+  physical,
+  targetScope,
+  physicalSourceSwitches,
+  semanticDowngradeScopes,
+}) {
+  const target = clean(targetScope, 32) || null;
+  if (!target && physical.length === 0) return null;
+  const rank = (scope) => ["user", "project", "local"].indexOf(scope);
+  const targetInstalled = physical.find((entry) => entry.scope === target);
+  const targetEnabled = targetInstalled?.enabled !== false;
+  const candidateWouldBeEffective = Boolean(
+    target &&
+    targetEnabled &&
+    (!current || rank(target) >= rank(current.scope)),
+  );
+  const effectiveTo = candidateWouldBeEffective
+    ? target
+    : current?.scope || null;
+  return {
+    targetScope: target,
+    effectiveFrom: current?.scope || null,
+    effectiveTo,
+    changed: (current?.scope || null) !== effectiveTo,
+    candidateWouldBeEffective,
+    physical: physical.map((entry) => ({
+      scope: entry.scope,
+      version: entry.version,
+      enabled: entry.enabled,
+      sourceType: entry.source?.type || null,
+      sourceRegistry: entry.source?.registry || null,
+      semanticPayloadFormat:
+        entry.integrity?.sbom?.semanticPayloadFormat || null,
+    })),
+    sourceSwitchScopes: physicalSourceSwitches,
+    semanticDowngradeScopes,
+  };
+}
+
+function pushUniqueFinding(list, finding) {
+  if (list.some((entry) => entry?.code === finding.code)) return;
+  list.push(finding);
+}
+
 function compareScalar(fromValue, toValue) {
   const from = clean(fromValue, 4096) || null;
   const to = clean(toValue, 4096) || null;
@@ -372,6 +563,7 @@ function countChanges(changes) {
   if (changes.integrity.signingKey.changed) count += 1;
   if (changes.integrity.sbomDigest.changed) count += 1;
   if (changes.integrity.sbomDocumentDigest.changed) count += 1;
+  if (changes.integrity.semanticPayloadBinding.changed) count += 1;
   if (changes.license.changed) count += 1;
   count +=
     changes.capabilities.added.length + changes.capabilities.removed.length;
@@ -379,6 +571,7 @@ function countChanges(changes) {
     changes.dependencies.added.length +
     changes.dependencies.removed.length +
     changes.dependencies.changed.length;
+  if (changes.scopeAuthority?.changed) count += 1;
   return count;
 }