chainlesschain 0.165.6 → 0.165.8

package/src/lib/mcp-oauth.js

@@ -484,7 +484,23 @@ export function loadTokenStore() {
 }
 
 export function getStoredToken(serverUrl) {
-  return loadTokenStore()[serverKey(serverUrl)] || null;
+  const record = loadTokenStore()[serverKey(serverUrl)] || null;
+  return record?.revoked === true ? null : record;
+}
+
+function tokenRecordRevision(record) {
+  return Number.isSafeInteger(record?.credential_revision) &&
+    record.credential_revision >= 0
+    ? record.credential_revision
+    : 0;
+}
+
+function tokenRevisionConflict(serverUrl) {
+  const error = new Error(
+    `MCP OAuth credential changed while it was being refreshed: ${serverKey(serverUrl)}`,
+  );
+  error.code = "MCP_TOKEN_STORE_REVISION_CONFLICT";
+  return error;
 }
 
 // The store holds OAuth access + refresh tokens, so it must not be world-
@@ -642,7 +658,7 @@ export function withStoreLock(file, fn) {
   }
 }
 
-export function saveStoredToken(serverUrl, record) {
+export function saveStoredToken(serverUrl, record, options = {}) {
   const file = tokenStorePath();
   return _deps.withStoreLock(file, () => {
     const r = _readStore(file); // re-read inside the lock (latest state)
@@ -654,24 +670,56 @@ export function saveStoredToken(serverUrl, record) {
       _warnCorruptStoreOnce(file, r.err, archived);
     }
     const store = r.store;
-    store[serverKey(serverUrl)] = { server: serverKey(serverUrl), ...record };
+    const key = serverKey(serverUrl);
+    const current = store[key] || null;
+    if (
+      options.expectedRevision != null &&
+      (tokenRecordRevision(current) !== options.expectedRevision ||
+        current?.revoked === true)
+    ) {
+      throw tokenRevisionConflict(serverUrl);
+    }
+    store[key] = {
+      ...record,
+      server: key,
+      credential_revision: tokenRecordRevision(current) + 1,
+      revoked: false,
+    };
     _writeStoreSecure(file, store);
-    return store[serverKey(serverUrl)];
+    return store[key];
   });
 }
 
-export function deleteStoredToken(serverUrl) {
+function revokeStoredToken(serverUrl, { expectedRevision = null } = {}) {
   const file = tokenStorePath();
   return _deps.withStoreLock(file, () => {
     const store = loadTokenStore(); // re-read inside the lock (latest state)
     const key = serverKey(serverUrl);
-    if (!(key in store)) return false;
-    delete store[key];
+    const current = store[key];
+    if (!current || current.revoked === true) return false;
+    if (
+      expectedRevision != null &&
+      tokenRecordRevision(current) !== expectedRevision
+    ) {
+      return false;
+    }
+    // Keep a revision-only tombstone. An in-flight refresh that read the old
+    // credential must not resurrect it after explicit logout/revocation.
+    store[key] = {
+      server: key,
+      credential_revision: tokenRecordRevision(current) + 1,
+      revoked: true,
+      revoked_at: _deps.now(),
+    };
     _writeStoreSecure(file, store);
     return true;
   });
 }
 
+export function deleteStoredToken(serverUrl) {
+  return revokeStoredToken(serverUrl);
+}
+
 /** True when a record's access token is missing or within `skewMs` of expiry. */
 export function isTokenExpired(record, { skewMs = 60_000 } = {}) {
   if (!record || !record.access_token) return true;
@@ -692,6 +740,8 @@ export function isTokenExpired(record, { skewMs = 60_000 } = {}) {
  * @param {string} serverUrl
  * @param {{ forceRefresh?: boolean }} [opts]
  */
+const tokenRefreshFlights = new Map();
+
 export async function ensureValidToken(
   serverUrl,
   { forceRefresh = false } = {},
@@ -700,21 +750,52 @@ export async function ensureValidToken(
   if (!record) return null;
   if (!forceRefresh && !isTokenExpired(record)) return record.access_token;
   if (!record.refresh_token || !record.endpoints?.token_endpoint) {
-    // Can't refresh. On a forced refresh the cached token is known-rejected, so
-    // hand back null (caller should stop retrying and prompt re-login); on the
-    // proactive path keep the existing behaviour of using what we have.
-    return forceRefresh ? null : record.access_token || null;
+    // Reaching this branch means the cached access token is expired (including
+    // the safety skew) or the server already rejected it. Reusing it would
+    // create a deterministic 401/403 loop, so every caller fails closed.
+    return null;
   }
-  try {
-    const tok = await refreshAccessToken(
-      { token_endpoint: record.endpoints.token_endpoint },
-      { refreshToken: record.refresh_token, clientId: record.client_id },
-    );
-    const updated = saveStoredToken(serverUrl, { ...record, ...tok });
-    return updated.access_token;
-  } catch {
-    return forceRefresh ? null : record.access_token || null;
+  const key = serverKey(serverUrl);
+  let refresh = tokenRefreshFlights.get(key);
+  if (!refresh) {
+    refresh = (async () => {
+      try {
+        const tok = await refreshAccessToken(
+          { token_endpoint: record.endpoints.token_endpoint },
+          { refreshToken: record.refresh_token, clientId: record.client_id },
+        );
+        const updated = saveStoredToken(
+          serverUrl,
+          { ...record, ...tok },
+          { expectedRevision: tokenRecordRevision(record) },
+        );
+        return { status: "refreshed", accessToken: updated.access_token };
+      } catch (error) {
+        if ([400, 401, 403].includes(error?.status)) {
+          const revoked = revokeStoredToken(serverUrl, {
+            expectedRevision: tokenRecordRevision(record),
+          });
+          return { status: revoked ? "revoked" : "conflict" };
+        }
+        return {
+          status:
+            error?.code === "MCP_TOKEN_STORE_REVISION_CONFLICT"
+              ? "conflict"
+              : "failed",
+        };
+      } finally {
+        tokenRefreshFlights.delete(key);
+      }
+    })();
+    tokenRefreshFlights.set(key, refresh);
+  }
+  const outcome = await refresh;
+  if (outcome.status === "refreshed") return outcome.accessToken;
+  if (outcome.status === "revoked") return null;
+  if (outcome.status === "conflict") {
+    return getStoredToken(serverUrl)?.access_token || null;
   }
+  return null;
 }
 
 // ── interactive orchestrator ──────────────────────────────────────────────

package/src/lib/mcp-tls.js

@@ -2,11 +2,24 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import { createHash } from "node:crypto";
+import { createHash, X509Certificate } from "node:crypto";
+import { createSecureContext } from "node:tls";
 import { isProxy } from "node:util/types";
 import { Agent } from "undici";
 
 export const MCP_TLS_MAX_FILE_BYTES = 1024 * 1024;
+export const MCP_TLS_MANAGED_SOURCE_REQUIRED_CODE =
+  "CC_MCP_TLS_MANAGED_SOURCE_REQUIRED";
+export const MCP_TLS_MANAGED_SOURCE_REQUIRED_MESSAGE =
+  "MCP TLS configuration is restricted to managed provisioned sources";
+
+// TLS file paths are a privileged configuration capability: merely marking a
+// JSON object as `configScope: "managed"` must never let a project, user, or
+// headless config read certificate material. Keep the provisioned snapshot in
+// a module-private WeakMap so it cannot be recreated by JSON, object spread,
+// or a lookalike field supplied by an MCP config source.
+const MANAGED_MCP_TLS_PROVENANCE = new WeakMap();
+const MANAGED_MCP_TLS_SCOPE = "managed";
 
 const TLS_KEYS = new Set([
   "certFile",
@@ -22,6 +35,16 @@ function tlsError(code, message, cause = undefined) {
   return error;
 }
 
+function managedTlsSourceRequiredError() {
+  // Do not include the claimed scope, source file, certificate path, or any
+  // TLS configuration field here. This error is surfaced by headless and MCP
+  // connection diagnostics, where config values are not safe to disclose.
+  return tlsError(
+    MCP_TLS_MANAGED_SOURCE_REQUIRED_CODE,
+    MCP_TLS_MANAGED_SOURCE_REQUIRED_MESSAGE,
+  );
+}
+
 function plainTlsObject(value) {
   if (
     !value ||
@@ -129,6 +152,47 @@ export function normalizeMcpTlsConfig(value) {
   };
 }
 
+/**
+ * Convert TLS settings from the organization-managed MCP loader into an
+ * immutable, non-forgeable configuration capability.
+ *
+ * This is deliberately separate from `normalizeMcpTlsConfig`: normalization
+ * validates data, while provisioning records the trusted source provenance
+ * that is required before a certificate/key/CA file can be opened.
+ */
+export function provisionManagedMcpTlsConfig(value) {
+  const config = normalizeMcpTlsConfig(value);
+  if (!config) return null;
+  const provisioned = Object.freeze({ ...config });
+  MANAGED_MCP_TLS_PROVENANCE.set(
+    provisioned,
+    Object.freeze({ configScope: MANAGED_MCP_TLS_SCOPE }),
+  );
+  return provisioned;
+}
+
+/**
+ * Enforce the managed source boundary before any TLS path is normalized or
+ * opened. The private provenance association survives normal config-object
+ * spreads because the provisioned `tls` value itself is preserved, but a
+ * caller cannot manufacture it from JSON or by setting `configScope`.
+ */
+export function assertManagedMcpTlsConfig(value, { configScope } = {}) {
+  if (value == null) return null;
+  const provenance =
+    value && typeof value === "object"
+      ? MANAGED_MCP_TLS_PROVENANCE.get(value)
+      : null;
+  if (
+    !provenance ||
+    configScope !== MANAGED_MCP_TLS_SCOPE ||
+    provenance.configScope !== MANAGED_MCP_TLS_SCOPE
+  ) {
+    throw managedTlsSourceRequiredError();
+  }
+  return value;
+}
+
 function readTlsFile(filePath, label, fsImpl) {
   if (!filePath) return null;
   let descriptor = null;
@@ -194,8 +258,29 @@ function updateDigestPart(hash, value) {
   hash.update(length).update(bytes);
 }
 
-export function loadMcpTlsMaterial(value, { fsImpl = fs } = {}) {
-  const config = normalizeMcpTlsConfig(value);
+function validateCertificateBytes(bytes) {
+  if (!bytes) return;
+  const text = bytes.toString("utf8");
+  const pemCertificates = text.match(
+    /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/gu,
+  );
+  if (pemCertificates?.length) {
+    for (const certificate of pemCertificates) new X509Certificate(certificate);
+    return;
+  }
+  new X509Certificate(bytes);
+}
+
+export function loadMcpTlsMaterial(
+  value,
+  {
+    configScope,
+    fsImpl = fs,
+    createSecureContextImpl = createSecureContext,
+    validateCertificateImpl = validateCertificateBytes,
+  } = {},
+) {
+  const config = assertManagedMcpTlsConfig(value, { configScope });
   if (!config) return null;
   const cert = readTlsFile(config.certFile, "certFile", fsImpl);
   const key = readTlsFile(config.keyFile, "keyFile", fsImpl);
@@ -207,6 +292,21 @@ export function loadMcpTlsMaterial(value, { fsImpl = fs } = {}) {
     ...(config.serverName ? { servername: config.serverName } : {}),
     rejectUnauthorized: config.rejectUnauthorized,
   };
+  try {
+    // Parse certificates and verify the client cert/key pair before creating a
+    // dispatcher or issuing any outbound request. Node/Undici would otherwise
+    // discover malformed or mismatched material only during a network dial.
+    validateCertificateImpl(cert);
+    validateCertificateImpl(ca);
+    createSecureContextImpl(connectOptions);
+  } catch {
+    // TLS parser diagnostics may quote attacker-controlled PEM text or paths.
+    // Keep the product error fixed and do not retain the parser error as cause.
+    throw tlsError(
+      "CC_MCP_TLS_MATERIAL_INVALID",
+      "MCP TLS certificate material is invalid or the client key does not match",
+    );
+  }
   const identityHash = createHash("sha256");
   updateDigestPart(identityHash, cert);
   updateDigestPart(identityHash, key);

package/src/lib/paths.js

@@ -1,49 +1,277 @@
+import { existsSync, lstatSync } from "node:fs";
 import { homedir } from "node:os";
-import { isAbsolute, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { CONFIG_DIR_NAME } from "../constants.js";
 import { getPlatform } from "./platform.js";
+import {
+  CLAUDE_CONFIG_DIR_ENV,
+  resolveClaudeProjectStorageDir,
+  usesClaudeConfigDirectory,
+} from "./claude-project-storage-layout.js";
 import {
   assertSafeOwnerOnlyPath,
   ensurePrivateDirectory,
   repairPrivatePaths,
 } from "./secure-fs.js";
 
+const securedClaudeProjectStorageEntries = new Map();
+
+function pathContains(parent, candidate) {
+  const relation = relative(parent, candidate);
+  return (
+    relation === "" ||
+    (!relation.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) &&
+      relation !== ".." &&
+      !isAbsolute(relation))
+  );
+}
+
+function nearestGitWorktreeRoot(cwd) {
+  let current = resolve(cwd);
+  for (;;) {
+    if (existsSync(join(current, ".git"))) return current;
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
+function configHomeError(message) {
+  const error = new Error(message);
+  error.code = "CONFIG_HOME_UNSAFE";
+  return error;
+}
+
+function isBroadSharedConfigRoot(resolvedHome, env) {
+  const platform = getPlatform();
+  const candidates =
+    platform === "win32"
+      ? [
+          "C:\\Users",
+          "C:\\Users\\Public",
+          "C:\\Windows",
+          "C:\\ProgramData",
+          "C:\\Program Files",
+          "C:\\Program Files (x86)",
+          env?.PUBLIC,
+          env?.ProgramData,
+          env?.PROGRAMDATA,
+          env?.SystemRoot,
+          env?.WINDIR,
+        ]
+      : [
+          "/tmp",
+          "/var/tmp",
+          "/usr",
+          "/etc",
+          "/var",
+          "/home",
+          "/root",
+          "/run",
+          "/opt",
+          "/srv",
+          "/mnt",
+          "/media",
+        ];
+  return candidates.some((candidate) => {
+    if (typeof candidate !== "string" || !candidate) return false;
+    try {
+      const normalized = resolve(candidate);
+      return platform === "win32"
+        ? normalized.toLowerCase() === resolvedHome.toLowerCase()
+        : normalized === resolvedHome;
+    } catch {
+      return false;
+    }
+  });
+}
+
+/**
+ * Reject broad shared directories before any owner-only chmod/DACL repair.
+ * Unlike the generic secure-fs guard, config/data roots are high-value and
+ * must never target a shared system parent such as C:\\Users or /home.
+ */
+export function assertSafeConfigDataRoot(dirPath, options = {}) {
+  const resolvedPath = resolve(dirPath);
+  if (isBroadSharedConfigRoot(resolvedPath, options.env || process.env)) {
+    throw configHomeError(
+      "Config/data root must not be a broad shared system directory",
+    );
+  }
+  assertSafeOwnerOnlyPath(resolvedPath);
+  return resolvedPath;
+}
+
+function resolveConfiguredHome(configured, variableName, cwd, env) {
+  const windowsLiteral = configured.replaceAll("/", "\\");
+  if (
+    windowsLiteral.startsWith("\\\\?\\") ||
+    windowsLiteral.startsWith("\\\\.\\")
+  ) {
+    throw configHomeError(
+      `${variableName} must not use a Windows device namespace`,
+    );
+  }
+  if (!isAbsolute(configured)) {
+    throw configHomeError(
+      `${variableName} must be an absolute path for owner-only storage`,
+    );
+  }
+  const resolvedHome = resolve(configured);
+  try {
+    assertSafeConfigDataRoot(resolvedHome, { env });
+  } catch (error) {
+    if (error?.code === "CONFIG_HOME_UNSAFE") throw error;
+    throw configHomeError(
+      `${variableName} must not be a broad shared system directory`,
+    );
+  }
+  const resolvedCwd = resolve(cwd);
+  const worktreeRoot = nearestGitWorktreeRoot(resolvedCwd);
+  if (
+    pathContains(resolvedHome, resolvedCwd) ||
+    pathContains(resolvedCwd, resolvedHome) ||
+    (worktreeRoot &&
+      (pathContains(worktreeRoot, resolvedHome) ||
+        pathContains(resolvedHome, worktreeRoot)))
+  ) {
+    throw configHomeError(
+      `${variableName} must not be the current working directory, its worktree, or any nested/ancestor path`,
+    );
+  }
+  // This is deliberately a no-IO validation. Directory creation/ACL repair
+  // remains in ensureHomeDir(), but broad roots and device aliases are refused
+  // before any caller can ask the secure-fs layer to mutate them.
+  return resolvedHome;
+}
+
+/**
+ * Resolve the CLI's authoritative config/data root. CHAINLESSCHAIN_HOME is a
+ * native explicit override and takes precedence over CLAUDE_CONFIG_DIR; the
+ * latter is only a compatible fallback for an otherwise unconfigured CLI.
+ */
+export function resolveConfigDataRoot(options = {}) {
+  const env = options.env || process.env;
+  const cwd = options.cwd || process.cwd();
+  const nativeHome = env.CHAINLESSCHAIN_HOME;
+  if (nativeHome) {
+    return Object.freeze({
+      path: resolveConfiguredHome(nativeHome, "CHAINLESSCHAIN_HOME", cwd, env),
+      source: "chainlesschain",
+    });
+  }
+  if (usesClaudeConfigDirectory(env)) {
+    const configured = env[CLAUDE_CONFIG_DIR_ENV].trim();
+    return Object.freeze({
+      path: resolveConfiguredHome(configured, CLAUDE_CONFIG_DIR_ENV, cwd, env),
+      source: "claude",
+    });
+  }
+  return Object.freeze({
+    path: join(homedir(), CONFIG_DIR_NAME),
+    source: "default",
+  });
+}
+
 export function getHomeDir() {
-  const configured = process.env.CHAINLESSCHAIN_HOME;
-  if (configured) {
-    const windowsLiteral = configured.replaceAll("/", "\\");
-    if (
-      windowsLiteral.startsWith("\\\\?\\") ||
-      windowsLiteral.startsWith("\\\\.\\")
-    ) {
-      const error = new Error(
-        "CHAINLESSCHAIN_HOME must not use a Windows device namespace",
-      );
-      error.code = "CONFIG_HOME_UNSAFE";
-      throw error;
+  return resolveConfigDataRoot().path;
+}
+
+/**
+ * Claude-compatible session storage is opt-in and only activates when the
+ * launcher supplied both CLAUDE_CONFIG_DIR and a safe project directory name.
+ * Legacy callers continue to use `<home>/sessions`.
+ */
+export function getClaudeProjectStorageDir(options = {}) {
+  const env = options.env || process.env;
+  const root = resolveConfigDataRoot({ ...options, env });
+  if (root.source !== "claude") return null;
+  return resolveClaudeProjectStorageDir(root.path, { env });
+}
+
+export function getSessionStoreDir(options = {}) {
+  return (
+    getClaudeProjectStorageDir(options) ||
+    join(resolveConfigDataRoot(options).path, "sessions")
+  );
+}
+
+/**
+ * Secure a Claude-compatible project storage tree without trusting inherited
+ * Windows ACLs on pre-existing descendants.  The config root is repaired
+ * first, then every child is created below that verified boundary and repaired
+ * together in one Windows ACL batch.  This keeps the security invariant while
+ * avoiding a PowerShell process for every storage subdirectory.
+ */
+export function ensureClaudeProjectStorageTree(
+  homeDir,
+  projectDir,
+  options = {},
+) {
+  const home = resolve(homeDir);
+  const projectsDir = join(home, "projects");
+  const project = resolve(projectDir);
+  const extraDirectories = Array.isArray(options.extraDirectories)
+    ? options.extraDirectories.map((entry) => resolve(entry))
+    : [];
+  if (!pathContains(projectsDir, project) || project === projectsDir) {
+    throw configHomeError(
+      "Claude project storage path must remain below projects",
+    );
+  }
+  if (extraDirectories.some((entry) => !pathContains(project, entry))) {
+    throw configHomeError(
+      "Claude project storage descendants must remain below the project root",
+    );
+  }
+
+  ensurePrivateDirectory(home, {
+    applyWindowsAcl: true,
+    failIfUnavailable: true,
+  });
+  const descendants = [projectsDir, project, ...extraDirectories];
+  if (getPlatform() === "win32") {
+    const repairTargets = [];
+    for (const directory of descendants) {
+      ensurePrivateDirectory(directory, {
+        applyWindowsAcl: false,
+        failIfUnavailable: true,
+      });
+      let current = null;
+      try {
+        const entry = lstatSync(directory);
+        current = `${entry.dev}:${entry.ino}`;
+      } catch {
+        // ensurePrivateDirectory above either created the directory or threw;
+        // retain a fail-closed repair target if a filesystem race removed it.
+      }
+      // The secure-fs layer caches verified Windows ACLs per path. Keep a
+      // matching tree cache so repeated session writes do not re-run a batch,
+      // but force a repair whenever this helper first observes a descendant.
+      if (securedClaudeProjectStorageEntries.get(directory) !== current) {
+        repairTargets.push(directory);
+      }
     }
-    if (!isAbsolute(configured)) {
-      const error = new Error(
-        "CHAINLESSCHAIN_HOME must be an absolute path for owner-only storage",
-      );
-      error.code = "CONFIG_HOME_UNSAFE";
-      throw error;
+    if (repairTargets.length > 0) {
+      // A private parent is not proof that an older child has no broad explicit
+      // ACE. Repair all newly observed descendants in one fail-closed batch.
+      repairPrivatePaths(repairTargets, { platform: "win32" });
+      for (const directory of repairTargets) {
+        securedClaudeProjectStorageEntries.set(
+          directory,
+          (() => {
+            const entry = lstatSync(directory);
+            return `${entry.dev}:${entry.ino}`;
+          })(),
+        );
+      }
     }
-    const resolvedHome = resolve(configured);
-    const relativeCwd = relative(resolvedHome, resolve(process.cwd()));
-    if (
-      relativeCwd === "" ||
-      (!relativeCwd.startsWith("..") && !isAbsolute(relativeCwd))
-    ) {
-      const error = new Error(
-        "CHAINLESSCHAIN_HOME must not be the current working directory or one of its ancestors",
-      );
-      error.code = "CONFIG_HOME_UNSAFE";
-      throw error;
+  } else {
+    for (const directory of descendants) {
+      ensurePrivateDirectory(directory, { failIfUnavailable: true });
     }
-    return configured;
   }
-  return join(homedir(), CONFIG_DIR_NAME);
+  return project;
 }
 
 export function getBinDir() {

package/src/lib/permission-request.js

@@ -0,0 +1,48 @@
+/**
+ * Canonicalize the part of a tool request that is classified and shown to the
+ * user for approval. Keeping this in one place prevents the safety classifier
+ * and the permission prompt from silently reasoning about different inputs.
+ */
+
+function quoteArgvToken(value) {
+  const token = String(value);
+  if (token && !/[\s|;&"'\\]/u.test(token)) return token;
+  return `"${token.replace(/\\/gu, "\\\\").replace(/"/gu, '\\"')}"`;
+}
+
+export function normalizePermissionRequest({ tool, args } = {}) {
+  const normalizedArgs = args && typeof args === "object" ? args : {};
+  const command =
+    typeof normalizedArgs.command === "string"
+      ? normalizedArgs.command
+      : Array.isArray(normalizedArgs.argv)
+        ? normalizedArgs.argv.map(quoteArgvToken).join(" ")
+        : "";
+  const source = String(
+    normalizedArgs.path ??
+      normalizedArgs.file_path ??
+      normalizedArgs.source ??
+      normalizedArgs.from ??
+      "",
+  );
+  const destination = String(
+    normalizedArgs.destination ??
+      normalizedArgs.new_path ??
+      normalizedArgs.to ??
+      "",
+  );
+  const detail =
+    command ||
+    (source && destination
+      ? `${source} -> ${destination}`
+      : source || destination);
+
+  return Object.freeze({
+    tool: String(tool || "unknown").trim() || "unknown",
+    args: normalizedArgs,
+    command,
+    source,
+    destination,
+    detail,
+  });
+}

package/src/lib/plugin-runtime/bin.js

@@ -81,7 +81,9 @@ export function collectPluginBinCommands(opts = {}) {
     }
     return [];
   }
-  const { trusted, skipped } = partitionByTrust(plugins);
+  const { trusted, skipped } = partitionByTrust(plugins, {
+    workspaceRoot: opts.cwd,
+  });
   warnUntrustedOnce(
     skipped
       .filter((p) => p.manifest?.components?.bin?.length)