chainlesschain 0.165.5 → 0.165.8

package/src/lib/project-mcp-trust.js

@@ -22,8 +22,20 @@ import {
   mutateSecurityStore,
   readSecurityStore,
 } from "./durable-security-store.js";
+import {
+  checkRecordedWorkspaceTrust,
+  evaluateWorkspaceTrustDecision,
+  projectWorkspaceTrustAudit,
+  recordWorkspaceTrustConsent,
+  resolveCanonicalWorkspaceRepoIdentity,
+  workspaceTrustPathSubject,
+} from "./workspace-trust.js";
 
-export const _deps = { withFileLock };
+export const _deps = {
+  withFileLock,
+  // Test-only seam. Production uses workspace-trust.js's one shared ledger.
+  workspaceTrustStorePath: () => null,
+};
 const workspaceAuthorities = new WeakMap();
 
 function storePath(opts = {}) {
@@ -38,6 +50,62 @@ export function projectMcpFingerprint(content) {
   return createHash("sha256").update(String(content), "utf-8").digest("hex");
 }
 
+const PROJECT_MCP_WORKSPACE_TRUST_SOURCE = "project-mcp";
+
+function workspaceTrustStoreOptions(opts = {}) {
+  const store =
+    opts.workspaceTrustStorePath ||
+    process.env.CC_WORKSPACE_TRUST_STORE ||
+    _deps.workspaceTrustStorePath() ||
+    // Custom source-store callers (notably isolated tests) get an adjacent
+    // shared ledger. Normal CLI calls omit storePath and therefore use the
+    // single workspace-trust.js default shared by all entry points.
+    (opts.storePath
+      ? path.join(path.dirname(opts.storePath), "workspace-trust-v1.json")
+      : null);
+  return store ? { storePath: store } : {};
+}
+
+function projectMcpWorkspaceTrustContext(file, content, opts = {}) {
+  const identity = resolveCanonicalWorkspaceRepoIdentity(
+    opts.workspaceRoot || path.dirname(file),
+  );
+  const subject = workspaceTrustPathSubject(identity, file);
+  const fingerprint = projectMcpFingerprint(content);
+  return { identity, subject, fingerprint };
+}
+
+function projectMcpWorkspaceRecordKey(context) {
+  const subjectDigest = createHash("sha256")
+    .update(context.subject, "utf8")
+    .digest("hex");
+  return `workspace-v1:${context.identity.workspaceId}:${subjectDigest}`;
+}
+
+function projectMcpDecision(status, context) {
+  const decision = evaluateWorkspaceTrustDecision({
+    identity: context.identity,
+    evidence: [
+      {
+        source: PROJECT_MCP_WORKSPACE_TRUST_SOURCE,
+        consent: status === "trusted" ? "explicit" : "missing",
+        fingerprint: context.fingerprint,
+        decision:
+          status === "trusted"
+            ? "allow"
+            : status === "first-use"
+              ? "ask"
+              : "deny",
+      },
+    ],
+  });
+  return {
+    status,
+    fingerprint: context.fingerprint,
+    workspaceTrust: projectWorkspaceTrustAudit(decision),
+  };
+}
+
 /**
  * Issue an in-process authority only after the caller has verified the exact
  * project file fingerprint. Plain config fields cannot forge this token.
@@ -50,7 +118,23 @@ export function issueProjectMcpWorkspaceAuthority({
   config = {},
 }) {
   const canonicalFile = fs.realpathSync.native(path.resolve(file));
-  const canonicalRoot = fs.realpathSync.native(path.resolve(workspaceRoot));
+  const workspaceIdentity =
+    resolveCanonicalWorkspaceRepoIdentity(workspaceRoot);
+  const canonicalRoot = workspaceIdentity.canonicalWorkspaceRoot;
+  const trustDecision = evaluateWorkspaceTrustDecision({
+    identity: workspaceIdentity,
+    evidence: [
+      {
+        source: PROJECT_MCP_WORKSPACE_TRUST_SOURCE,
+        consent: "host-bound",
+        fingerprint: projectMcpFingerprint(content),
+        decision: "allow",
+      },
+    ],
+  });
+  if (trustDecision.decision !== "allow") {
+    throw new Error("project MCP workspace identity is unavailable");
+  }
   const token = Object.freeze({});
   workspaceAuthorities.set(
     token,
@@ -58,6 +142,9 @@ export function issueProjectMcpWorkspaceAuthority({
       file: canonicalFile,
       fingerprint: projectMcpFingerprint(content),
       workspaceRoot: canonicalRoot,
+      workspaceId: workspaceIdentity.workspaceId,
+      repositoryId: workspaceIdentity.repositoryId,
+      workspaceTrust: projectWorkspaceTrustAudit(trustDecision),
       serverName: String(serverName || ""),
       url: typeof config.url === "string" ? config.url : "",
       transport: typeof config.transport === "string" ? config.transport : "",
@@ -100,6 +187,19 @@ export function resolveProjectMcpWorkspaceAuthority(token, expected = {}) {
   ) {
     return null;
   }
+  try {
+    const currentIdentity = resolveCanonicalWorkspaceRepoIdentity(
+      record.workspaceRoot,
+    );
+    if (
+      currentIdentity.workspaceId !== record.workspaceId ||
+      currentIdentity.repositoryId !== record.repositoryId
+    ) {
+      return null;
+    }
+  } catch {
+    return null;
+  }
   return record.workspaceRoot;
 }
 
@@ -112,29 +212,84 @@ function readStore(opts) {
  * @returns {{status:"first-use"|"trusted"|"changed", fingerprint:string}}
  */
 export function checkProjectMcpTrust(file, content, opts = {}) {
-  const fingerprint = projectMcpFingerprint(content);
-  const record = readStore(opts)[path.resolve(file)];
-  if (!record || !record.fingerprint) {
-    return { status: "first-use", fingerprint };
+  const context = projectMcpWorkspaceTrustContext(file, content, opts);
+  const store = readStore(opts);
+  const record = store[projectMcpWorkspaceRecordKey(context)];
+  const legacyRecord = store[path.resolve(file)];
+  if (!record || typeof record !== "object" || Array.isArray(record)) {
+    // A pre-v1 path-keyed grant cannot be shown to bind the current canonical
+    // workspace identity.  Treat it as changed rather than silently widening
+    // it; the existing explicit re-trust path records the v1 intersection.
+    const shared = checkRecordedWorkspaceTrust({
+      identity: context.identity,
+      source: PROJECT_MCP_WORKSPACE_TRUST_SOURCE,
+      subject: context.subject,
+      evidenceFingerprint: context.fingerprint,
+      ...workspaceTrustStoreOptions(opts),
+    });
+    return {
+      status:
+        legacyRecord?.fingerprint || shared.status === "changed"
+          ? "changed"
+          : "first-use",
+      fingerprint: context.fingerprint,
+      workspaceTrust: shared.audit,
+    };
+  }
+  const binding = record.workspaceTrust;
+  if (
+    record.fingerprint !== context.fingerprint ||
+    !binding ||
+    binding.workspaceId !== context.identity.workspaceId ||
+    binding.repositoryId !== context.identity.repositoryId ||
+    binding.subject !== context.subject
+  ) {
+    return projectMcpDecision("changed", context);
   }
+  const shared = checkRecordedWorkspaceTrust({
+    identity: context.identity,
+    source: PROJECT_MCP_WORKSPACE_TRUST_SOURCE,
+    subject: context.subject,
+    evidenceFingerprint: context.fingerprint,
+    ...workspaceTrustStoreOptions(opts),
+  });
   return {
-    status: record.fingerprint === fingerprint ? "trusted" : "changed",
-    fingerprint,
+    status: shared.status === "trusted" ? "trusted" : "changed",
+    fingerprint: context.fingerprint,
+    workspaceTrust: shared.audit,
   };
 }
 
 /** Record (or re-record) the trusted fingerprint for a file. */
 export function recordProjectMcpTrust(file, content, opts = {}) {
   const target = storePath(opts);
+  const context = projectMcpWorkspaceTrustContext(file, content, opts);
+  // Persist the shared record first.  If the legacy/source-specific store
+  // fails afterwards, the checker still requires both records and therefore
+  // cannot accidentally authorize from the shared ledger alone.
+  recordWorkspaceTrustConsent({
+    identity: context.identity,
+    source: PROJECT_MCP_WORKSPACE_TRUST_SOURCE,
+    subject: context.subject,
+    evidenceFingerprint: context.fingerprint,
+    consent: "explicit",
+    ...workspaceTrustStoreOptions(opts),
+  });
   return mutateSecurityStore(
     target,
     "project MCP trust",
     (store) => {
-      store[path.resolve(file)] = {
-        fingerprint: projectMcpFingerprint(content),
+      store[projectMcpWorkspaceRecordKey(context)] = {
+        fingerprint: context.fingerprint,
         trustedAt: new Date(
           typeof opts.now === "number" ? opts.now : Date.now(),
         ).toISOString(),
+        workspaceTrust: {
+          schemaVersion: context.identity.schemaVersion,
+          workspaceId: context.identity.workspaceId,
+          repositoryId: context.identity.repositoryId,
+          subject: context.subject,
+        },
       };
       return true;
     },

package/src/lib/remote-approval-bridge.js

@@ -43,11 +43,15 @@ import {
   REMOTE_MEMBERSHIP_HOST_UNAVAILABLE_CODE,
 } from "./remote-membership-host-store.js";
 import {
+  assertDirectWsUrlAllowed,
   buildDirectPairingUri,
+  isLoopbackBindHost,
   pickLanAddress,
   renderQrCode,
   resolveRemoteControlOptions,
+  resolveRemoteControlWsUrl,
 } from "./remote-control.js";
+import { logger } from "./logger.js";
 
 const DEFAULT_DECISION_TIMEOUT_MS = 5 * 60 * 1000;
 const REMOTE_LEASE_AUTHORIZATION_KIND =
@@ -345,7 +349,8 @@ export class RemoteApprovalBridge {
 
   /**
    * Pairing descriptor for devices. Relay-configured servers return a ready
-   * E2EE URI; otherwise build the direct-LAN URI from the caller's endpoint.
+   * E2EE URI; otherwise build a direct URI from the explicitly selected
+   * loopback/LAN endpoint.
    */
   pairingInfo({ lanWsUrl = null } = {}) {
     if (!this.pairing) return null;
@@ -363,6 +368,7 @@ export class RemoteApprovalBridge {
       });
     return {
       uri,
+      mode: this.pairing.uri ? "relay" : "direct",
       remoteSessionId: this.remoteSessionId,
       scopes: this.pairing.scopes,
       expiresAt: this.pairing.expiresAt,
@@ -1297,21 +1303,60 @@ export class RemoteApprovalBridge {
  * self-hosts a lightweight WS server on an OS-assigned port (no sessionManager
  * needed — the session stays client-hosted), starts a bridge for this run's
  * session, prints the pairing URI (+ optional QR) to stderr, and returns the
- * gate confirmer + teardown. Relay settings (env/config) flow through, so a
- * configured relay yields an E2EE pairing URI reaching devices off-LAN.
+ * gate confirmer + teardown. Relay settings flow through the startup
+ * environment; LAN exposure remains a separate explicit caller authority.
  */
 export async function startHeadlessRemoteApproval({
   agentSessionId,
+  allowLan = false,
   env = process.env,
-  config = {},
+  config = undefined,
   writeErr = () => {},
   isText = false,
   decisionTimeoutMs = undefined,
   deps = {},
 } = {}) {
+  let effectiveConfig = config;
+  if (effectiveConfig === undefined) {
+    try {
+      const configModule =
+        deps.configModule || (await import("./config-manager.js"));
+      effectiveConfig = configModule.loadConfig();
+    } catch {
+      effectiveConfig = {};
+    }
+  }
+  const resolved = resolveRemoteControlOptions({
+    flags: { allowApprove: true, allowLan: allowLan === true },
+    env,
+    config: effectiveConfig || {},
+  });
+  if (!resolved.relayUrl && !resolved.lanAccessible) {
+    throw new Error(
+      "remote approval is loopback-only by default; configure a relay, or enable " +
+        "allowLan with a non-loopback host (omit host to use 0.0.0.0) on a trusted network",
+    );
+  }
+  const lanAddress = resolved.lanAccessible
+    ? deps.lanAddress ||
+      (deps.pickLanAddress ? deps.pickLanAddress() : pickLanAddress())
+    : null;
+  const preflightLanWsUrl = resolveRemoteControlWsUrl(
+    { ...resolved, port: 1 },
+    { lanAddress },
+  );
+  if (
+    !resolved.relayUrl &&
+    resolved.lanAccessible &&
+    isLoopbackBindHost(new URL(preflightLanWsUrl).hostname)
+  ) {
+    throw new Error(
+      "LAN binding is enabled but no private LAN address can be advertised; " +
+        "configure a private host or a relay",
+    );
+  }
   const { ChainlessChainWSServer } =
     deps.serverModule || (await import("../gateways/ws/ws-server.js"));
-  const resolved = resolveRemoteControlOptions({ flags: {}, env, config });
   const server = new ChainlessChainWSServer({
     port: 0,
     host: resolved.host,
@@ -1319,50 +1364,95 @@ export async function startHeadlessRemoteApproval({
     remoteSessionRelayUrl: resolved.relayUrl,
     remoteSessionPeerId: resolved.peerId,
   });
-  await server.start();
-  const bridge = new RemoteApprovalBridge({
-    wsUrl: `ws://127.0.0.1:${server.port}`,
-    token: resolved.token,
-    agentSessionId,
-    scopes: ["observe", "approve"],
-    decisionTimeoutMs,
-  });
+  let bridge;
   try {
-    await bridge.start();
+    await server.start();
+    const createBridge =
+      deps.createBridge || ((options) => new RemoteApprovalBridge(options));
+    bridge = createBridge({
+      wsUrl: resolveRemoteControlWsUrl(
+        { ...resolved, port: server.port, allowLan: resolved.lanAccessible },
+        { lanAddress: null },
+      ),
+      token: resolved.token,
+      agentSessionId,
+      scopes: ["observe", "approve"],
+      decisionTimeoutMs,
+    });
+    try {
+      await bridge.start();
+    } catch (err) {
+      await server.stop().catch(() => undefined);
+      throw err;
+    }
+    const lanWsUrl = resolveRemoteControlWsUrl(
+      { ...resolved, port: server.port },
+      { lanAddress },
+    );
+    const pairing = bridge.pairingInfo({ lanWsUrl });
+    if (resolved.relayUrl && pairing?.mode !== "relay") {
+      throw new Error(
+        "the configured relay did not provide a pairing URI; refusing to fall back to direct pairing",
+      );
+    }
+    if (
+      !resolved.relayUrl &&
+      pairing?.mode !== "relay" &&
+      !resolved.lanAccessible
+    ) {
+      throw new Error(
+        "direct remote approval requires explicit allowLan on a trusted network",
+      );
+    }
+    if (pairing?.mode === "direct") {
+      if (isLoopbackBindHost(new URL(lanWsUrl).hostname)) {
+        throw new Error(
+          "LAN binding is enabled but no private LAN address can be advertised",
+        );
+      }
+      assertDirectWsUrlAllowed(lanWsUrl);
+      const warn = deps.warn || ((message) => logger.warn(message));
+      warn(
+        `LAN remote approval enabled on ${resolved.host}:${server.port}. ` +
+          "Direct pairing uses plaintext ws:// with bearer credentials; use only on a trusted network.",
+      );
+    }
+    if (!pairing?.uri) {
+      throw new Error("remote approval did not produce a pairing URI");
+    }
+    if (isText) {
+      writeErr(
+        "  remote-control: approvals can be answered from a paired device\n",
+      );
+      writeErr(`  pairing: ${pairing.uri}\n`);
+      const qr = await renderQrCode(pairing.uri, deps);
+      if (qr) writeErr(qr + "\n");
+    }
+    return {
+      pairing,
+      server,
+      bridge,
+      confirmer: bridge.makeConfirmer({
+        onAsk: (ask) => {
+          if (isText) {
+            writeErr(
+              `  permission(${ask.tool || "?"}): waiting for remote approval…\n`,
+            );
+          }
+        },
+      }),
+      consumeAuthorization: (authorization, context) =>
+        bridge.consumeAuthorization(authorization, context),
+      close: async () => {
+        await bridge.close().catch(() => undefined);
+        await server.stop().catch(() => undefined);
+      },
+    };
   } catch (err) {
+    if (bridge) {
+      await bridge.close().catch(() => undefined);
+    }
     await server.stop().catch(() => undefined);
     throw err;
   }
-  const lanAddress = deps.lanAddress || pickLanAddress() || "127.0.0.1";
-  const pairing = bridge.pairingInfo({
-    lanWsUrl: `ws://${lanAddress}:${server.port}`,
-  });
-  if (isText) {
-    writeErr(
-      "  remote-control: approvals can be answered from a paired device\n",
-    );
-    writeErr(`  pairing: ${pairing.uri}\n`);
-    const qr = await renderQrCode(pairing.uri, deps);
-    if (qr) writeErr(qr + "\n");
-  }
-  return {
-    pairing,
-    server,
-    bridge,
-    confirmer: bridge.makeConfirmer({
-      onAsk: (ask) => {
-        if (isText) {
-          writeErr(
-            `  permission(${ask.tool || "?"}): waiting for remote approval…\n`,
-          );
-        }
-      },
-    }),
-    consumeAuthorization: (authorization, context) =>
-      bridge.consumeAuthorization(authorization, context),
-    close: async () => {
-      await bridge.close().catch(() => undefined);
-      await server.stop().catch(() => undefined);
-    },
-  };
 }