chainlesschain 0.165.5 → 0.165.8

package/src/lib/paths.js

@@ -1,49 +1,277 @@
+import { existsSync, lstatSync } from "node:fs";
 import { homedir } from "node:os";
-import { isAbsolute, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { CONFIG_DIR_NAME } from "../constants.js";
 import { getPlatform } from "./platform.js";
+import {
+  CLAUDE_CONFIG_DIR_ENV,
+  resolveClaudeProjectStorageDir,
+  usesClaudeConfigDirectory,
+} from "./claude-project-storage-layout.js";
 import {
   assertSafeOwnerOnlyPath,
   ensurePrivateDirectory,
   repairPrivatePaths,
 } from "./secure-fs.js";
 
+const securedClaudeProjectStorageEntries = new Map();
+
+function pathContains(parent, candidate) {
+  const relation = relative(parent, candidate);
+  return (
+    relation === "" ||
+    (!relation.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) &&
+      relation !== ".." &&
+      !isAbsolute(relation))
+  );
+}
+
+function nearestGitWorktreeRoot(cwd) {
+  let current = resolve(cwd);
+  for (;;) {
+    if (existsSync(join(current, ".git"))) return current;
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
+function configHomeError(message) {
+  const error = new Error(message);
+  error.code = "CONFIG_HOME_UNSAFE";
+  return error;
+}
+
+function isBroadSharedConfigRoot(resolvedHome, env) {
+  const platform = getPlatform();
+  const candidates =
+    platform === "win32"
+      ? [
+          "C:\\Users",
+          "C:\\Users\\Public",
+          "C:\\Windows",
+          "C:\\ProgramData",
+          "C:\\Program Files",
+          "C:\\Program Files (x86)",
+          env?.PUBLIC,
+          env?.ProgramData,
+          env?.PROGRAMDATA,
+          env?.SystemRoot,
+          env?.WINDIR,
+        ]
+      : [
+          "/tmp",
+          "/var/tmp",
+          "/usr",
+          "/etc",
+          "/var",
+          "/home",
+          "/root",
+          "/run",
+          "/opt",
+          "/srv",
+          "/mnt",
+          "/media",
+        ];
+  return candidates.some((candidate) => {
+    if (typeof candidate !== "string" || !candidate) return false;
+    try {
+      const normalized = resolve(candidate);
+      return platform === "win32"
+        ? normalized.toLowerCase() === resolvedHome.toLowerCase()
+        : normalized === resolvedHome;
+    } catch {
+      return false;
+    }
+  });
+}
+
+/**
+ * Reject broad shared directories before any owner-only chmod/DACL repair.
+ * Unlike the generic secure-fs guard, config/data roots are high-value and
+ * must never target a shared system parent such as C:\\Users or /home.
+ */
+export function assertSafeConfigDataRoot(dirPath, options = {}) {
+  const resolvedPath = resolve(dirPath);
+  if (isBroadSharedConfigRoot(resolvedPath, options.env || process.env)) {
+    throw configHomeError(
+      "Config/data root must not be a broad shared system directory",
+    );
+  }
+  assertSafeOwnerOnlyPath(resolvedPath);
+  return resolvedPath;
+}
+
+function resolveConfiguredHome(configured, variableName, cwd, env) {
+  const windowsLiteral = configured.replaceAll("/", "\\");
+  if (
+    windowsLiteral.startsWith("\\\\?\\") ||
+    windowsLiteral.startsWith("\\\\.\\")
+  ) {
+    throw configHomeError(
+      `${variableName} must not use a Windows device namespace`,
+    );
+  }
+  if (!isAbsolute(configured)) {
+    throw configHomeError(
+      `${variableName} must be an absolute path for owner-only storage`,
+    );
+  }
+  const resolvedHome = resolve(configured);
+  try {
+    assertSafeConfigDataRoot(resolvedHome, { env });
+  } catch (error) {
+    if (error?.code === "CONFIG_HOME_UNSAFE") throw error;
+    throw configHomeError(
+      `${variableName} must not be a broad shared system directory`,
+    );
+  }
+  const resolvedCwd = resolve(cwd);
+  const worktreeRoot = nearestGitWorktreeRoot(resolvedCwd);
+  if (
+    pathContains(resolvedHome, resolvedCwd) ||
+    pathContains(resolvedCwd, resolvedHome) ||
+    (worktreeRoot &&
+      (pathContains(worktreeRoot, resolvedHome) ||
+        pathContains(resolvedHome, worktreeRoot)))
+  ) {
+    throw configHomeError(
+      `${variableName} must not be the current working directory, its worktree, or any nested/ancestor path`,
+    );
+  }
+  // This is deliberately a no-IO validation. Directory creation/ACL repair
+  // remains in ensureHomeDir(), but broad roots and device aliases are refused
+  // before any caller can ask the secure-fs layer to mutate them.
+  return resolvedHome;
+}
+
+/**
+ * Resolve the CLI's authoritative config/data root. CHAINLESSCHAIN_HOME is a
+ * native explicit override and takes precedence over CLAUDE_CONFIG_DIR; the
+ * latter is only a compatible fallback for an otherwise unconfigured CLI.
+ */
+export function resolveConfigDataRoot(options = {}) {
+  const env = options.env || process.env;
+  const cwd = options.cwd || process.cwd();
+  const nativeHome = env.CHAINLESSCHAIN_HOME;
+  if (nativeHome) {
+    return Object.freeze({
+      path: resolveConfiguredHome(nativeHome, "CHAINLESSCHAIN_HOME", cwd, env),
+      source: "chainlesschain",
+    });
+  }
+  if (usesClaudeConfigDirectory(env)) {
+    const configured = env[CLAUDE_CONFIG_DIR_ENV].trim();
+    return Object.freeze({
+      path: resolveConfiguredHome(configured, CLAUDE_CONFIG_DIR_ENV, cwd, env),
+      source: "claude",
+    });
+  }
+  return Object.freeze({
+    path: join(homedir(), CONFIG_DIR_NAME),
+    source: "default",
+  });
+}
+
 export function getHomeDir() {
-  const configured = process.env.CHAINLESSCHAIN_HOME;
-  if (configured) {
-    const windowsLiteral = configured.replaceAll("/", "\\");
-    if (
-      windowsLiteral.startsWith("\\\\?\\") ||
-      windowsLiteral.startsWith("\\\\.\\")
-    ) {
-      const error = new Error(
-        "CHAINLESSCHAIN_HOME must not use a Windows device namespace",
-      );
-      error.code = "CONFIG_HOME_UNSAFE";
-      throw error;
+  return resolveConfigDataRoot().path;
+}
+
+/**
+ * Claude-compatible session storage is opt-in and only activates when the
+ * launcher supplied both CLAUDE_CONFIG_DIR and a safe project directory name.
+ * Legacy callers continue to use `<home>/sessions`.
+ */
+export function getClaudeProjectStorageDir(options = {}) {
+  const env = options.env || process.env;
+  const root = resolveConfigDataRoot({ ...options, env });
+  if (root.source !== "claude") return null;
+  return resolveClaudeProjectStorageDir(root.path, { env });
+}
+
+export function getSessionStoreDir(options = {}) {
+  return (
+    getClaudeProjectStorageDir(options) ||
+    join(resolveConfigDataRoot(options).path, "sessions")
+  );
+}
+
+/**
+ * Secure a Claude-compatible project storage tree without trusting inherited
+ * Windows ACLs on pre-existing descendants.  The config root is repaired
+ * first, then every child is created below that verified boundary and repaired
+ * together in one Windows ACL batch.  This keeps the security invariant while
+ * avoiding a PowerShell process for every storage subdirectory.
+ */
+export function ensureClaudeProjectStorageTree(
+  homeDir,
+  projectDir,
+  options = {},
+) {
+  const home = resolve(homeDir);
+  const projectsDir = join(home, "projects");
+  const project = resolve(projectDir);
+  const extraDirectories = Array.isArray(options.extraDirectories)
+    ? options.extraDirectories.map((entry) => resolve(entry))
+    : [];
+  if (!pathContains(projectsDir, project) || project === projectsDir) {
+    throw configHomeError(
+      "Claude project storage path must remain below projects",
+    );
+  }
+  if (extraDirectories.some((entry) => !pathContains(project, entry))) {
+    throw configHomeError(
+      "Claude project storage descendants must remain below the project root",
+    );
+  }
+
+  ensurePrivateDirectory(home, {
+    applyWindowsAcl: true,
+    failIfUnavailable: true,
+  });
+  const descendants = [projectsDir, project, ...extraDirectories];
+  if (getPlatform() === "win32") {
+    const repairTargets = [];
+    for (const directory of descendants) {
+      ensurePrivateDirectory(directory, {
+        applyWindowsAcl: false,
+        failIfUnavailable: true,
+      });
+      let current = null;
+      try {
+        const entry = lstatSync(directory);
+        current = `${entry.dev}:${entry.ino}`;
+      } catch {
+        // ensurePrivateDirectory above either created the directory or threw;
+        // retain a fail-closed repair target if a filesystem race removed it.
+      }
+      // The secure-fs layer caches verified Windows ACLs per path. Keep a
+      // matching tree cache so repeated session writes do not re-run a batch,
+      // but force a repair whenever this helper first observes a descendant.
+      if (securedClaudeProjectStorageEntries.get(directory) !== current) {
+        repairTargets.push(directory);
+      }
     }
-    if (!isAbsolute(configured)) {
-      const error = new Error(
-        "CHAINLESSCHAIN_HOME must be an absolute path for owner-only storage",
-      );
-      error.code = "CONFIG_HOME_UNSAFE";
-      throw error;
+    if (repairTargets.length > 0) {
+      // A private parent is not proof that an older child has no broad explicit
+      // ACE. Repair all newly observed descendants in one fail-closed batch.
+      repairPrivatePaths(repairTargets, { platform: "win32" });
+      for (const directory of repairTargets) {
+        securedClaudeProjectStorageEntries.set(
+          directory,
+          (() => {
+            const entry = lstatSync(directory);
+            return `${entry.dev}:${entry.ino}`;
+          })(),
+        );
+      }
     }
-    const resolvedHome = resolve(configured);
-    const relativeCwd = relative(resolvedHome, resolve(process.cwd()));
-    if (
-      relativeCwd === "" ||
-      (!relativeCwd.startsWith("..") && !isAbsolute(relativeCwd))
-    ) {
-      const error = new Error(
-        "CHAINLESSCHAIN_HOME must not be the current working directory or one of its ancestors",
-      );
-      error.code = "CONFIG_HOME_UNSAFE";
-      throw error;
+  } else {
+    for (const directory of descendants) {
+      ensurePrivateDirectory(directory, { failIfUnavailable: true });
     }
-    return configured;
   }
-  return join(homedir(), CONFIG_DIR_NAME);
+  return project;
 }
 
 export function getBinDir() {

package/src/lib/permission-request.js

@@ -0,0 +1,48 @@
+/**
+ * Canonicalize the part of a tool request that is classified and shown to the
+ * user for approval. Keeping this in one place prevents the safety classifier
+ * and the permission prompt from silently reasoning about different inputs.
+ */
+
+function quoteArgvToken(value) {
+  const token = String(value);
+  if (token && !/[\s|;&"'\\]/u.test(token)) return token;
+  return `"${token.replace(/\\/gu, "\\\\").replace(/"/gu, '\\"')}"`;
+}
+
+export function normalizePermissionRequest({ tool, args } = {}) {
+  const normalizedArgs = args && typeof args === "object" ? args : {};
+  const command =
+    typeof normalizedArgs.command === "string"
+      ? normalizedArgs.command
+      : Array.isArray(normalizedArgs.argv)
+        ? normalizedArgs.argv.map(quoteArgvToken).join(" ")
+        : "";
+  const source = String(
+    normalizedArgs.path ??
+      normalizedArgs.file_path ??
+      normalizedArgs.source ??
+      normalizedArgs.from ??
+      "",
+  );
+  const destination = String(
+    normalizedArgs.destination ??
+      normalizedArgs.new_path ??
+      normalizedArgs.to ??
+      "",
+  );
+  const detail =
+    command ||
+    (source && destination
+      ? `${source} -> ${destination}`
+      : source || destination);
+
+  return Object.freeze({
+    tool: String(tool || "unknown").trim() || "unknown",
+    args: normalizedArgs,
+    command,
+    source,
+    destination,
+    detail,
+  });
+}

package/src/lib/plugin-runtime/bin.js

@@ -81,7 +81,9 @@ export function collectPluginBinCommands(opts = {}) {
     }
     return [];
   }
-  const { trusted, skipped } = partitionByTrust(plugins);
+  const { trusted, skipped } = partitionByTrust(plugins, {
+    workspaceRoot: opts.cwd,
+  });
   warnUntrustedOnce(
     skipped
       .filter((p) => p.manifest?.components?.bin?.length)

package/src/lib/plugin-runtime/hooks.js

@@ -215,7 +215,9 @@ export function collectPluginHooks(opts = {}) {
   }
   // A hook runs a shell command — gate it behind trust so a cloned repo's
   // project plugin can't run commands the moment the agent starts.
-  const { trusted, skipped } = partitionByTrust(plugins);
+  const { trusted, skipped } = partitionByTrust(plugins, {
+    workspaceRoot: opts.cwd,
+  });
   warnUntrustedOnce(
     skipped.filter((p) => p.manifest?.components?.hooks).map((p) => p.name),
     "hooks",