chainlesschain 0.165.6 → 0.165.8

package/src/lib/plugin-runtime/remote-source.js

@@ -40,6 +40,11 @@ import {
 } from "../plugin-source-identity.js";
 import { createMarketplaceNetworkTransport } from "./marketplace-network.js";
 import { fetchAndMaterializeMarketplaceArchive } from "./marketplace-archive-source.js";
+import {
+  createSameOriginMarketplaceHeaderFetch,
+  runMarketplaceCommandSource,
+  runMarketplaceHeadersHelper,
+} from "./marketplace-command-source.js";
 import {
   assertMarketplaceSourceExecutable,
   normalizeMarketplacePackageSource,
@@ -215,12 +220,27 @@ export async function fetchRegistry(url, opts = {}) {
     );
   }
 
+  // This descriptor is local operator configuration, never registry metadata.
+  // It is intentionally evaluated only for the registry request and later
+  // carried in an opaque authority for the selected same-origin archive.
+  const marketplaceRequestHeaders = await resolveMarketplaceCatalogHeaders(
+    url,
+    opts,
+  );
+
   const networkTransport = createMarketplaceNetworkTransport({
     proxyUrl: opts.proxyUrl,
     pacFile: opts.pacFile,
     caFile: opts.caFile,
   });
-  const fetchImpl = networkTransport?.fetch || _deps.fetch;
+  const transportFetch = networkTransport?.fetch || _deps.fetch;
+  const fetchImpl = marketplaceRequestHeaders
+    ? createSameOriginMarketplaceHeaderFetch(
+        transportFetch,
+        new URL(url).origin,
+        marketplaceRequestHeaders,
+      )
+    : transportFetch;
   let networkErr = null;
   let cacheFallbackAllowed = false;
   try {
@@ -283,6 +303,7 @@ export async function fetchRegistry(url, opts = {}) {
       },
       url,
       managedPolicy,
+      marketplaceRequestHeaders,
     );
   } catch (err) {
     networkErr = err;
@@ -308,7 +329,14 @@ export async function fetchRegistry(url, opts = {}) {
         cacheDir,
         expectedSha256,
       });
-      if (cached) return bindFetchedRegistry(cached, url, managedPolicy);
+      if (cached) {
+        return bindFetchedRegistry(
+          cached,
+          url,
+          managedPolicy,
+          marketplaceRequestHeaders,
+        );
+      }
     } catch (cacheError) {
       throw new Error(
         `could not fetch registry ${displayUrl}: ${publicRegistryErrorMessage(networkErr)}; verified immutable cache rejected: ${publicRegistryCacheErrorMessage(cacheError)}`,
@@ -323,6 +351,38 @@ export async function fetchRegistry(url, opts = {}) {
   );
 }
 
+function configuredMarketplaceHeadersHelper(url, opts) {
+  if (opts.headersHelper != null) return opts.headersHelper;
+  const marketplace = opts.config?.plugins?.marketplace;
+  if (!marketplace || typeof marketplace !== "object") return null;
+  let origin = null;
+  try {
+    origin = new URL(url).origin;
+  } catch {
+    return null;
+  }
+  const perOrigin = marketplace.headersHelpers;
+  if (
+    perOrigin &&
+    typeof perOrigin === "object" &&
+    Object.prototype.hasOwnProperty.call(perOrigin, origin)
+  ) {
+    return perOrigin[origin];
+  }
+  return marketplace.headersHelper ?? null;
+}
+
+async function resolveMarketplaceCatalogHeaders(url, opts) {
+  const descriptor = configuredMarketplaceHeadersHelper(url, opts);
+  if (descriptor == null) return null;
+  return runMarketplaceHeadersHelper(descriptor, {
+    platform: opts.platform,
+    spawn: opts.headersHelperSpawn,
+    spawnSync: opts.headersHelperSpawnSync,
+    kill: opts.headersHelperKill,
+  });
+}
+
 async function readBoundedRegistryResponse(response) {
   const contentLength = Number(response?.headers?.get?.("content-length"));
   if (
@@ -584,7 +644,12 @@ function freezeRegistryValue(value) {
   return Object.freeze(value);
 }
 
-function bindFetchedRegistry(result, registryUrl, managedPolicy) {
+function bindFetchedRegistry(
+  result,
+  registryUrl,
+  managedPolicy,
+  marketplaceRequestHeaders = null,
+) {
   const registry = freezeRegistryValue(result.registry);
   fetchedRegistryAuthorities.set(
     registry,
@@ -592,6 +657,11 @@ function bindFetchedRegistry(result, registryUrl, managedPolicy) {
       registryUrl: String(registryUrl),
       documentSha256: result.documentSha256 || null,
       managedPolicy,
+      // Credential values live only in this per-process, opaque binding. They
+      // never enter catalog, cache, provenance, or result JSON.
+      marketplaceRequestHeaders: marketplaceRequestHeaders
+        ? Object.freeze({ ...marketplaceRequestHeaders })
+        : null,
     }),
   );
   return { ...result, registry };
@@ -666,7 +736,7 @@ export function authorizeRegistryPluginEntry(
       cwd,
       kindHint: "git",
     });
-  } else {
+  } else if (normalized.sourceType === "archive") {
     let registryOrigin;
     let archiveOrigin;
     try {
@@ -678,6 +748,8 @@ export function authorizeRegistryPluginEntry(
     if (archiveOrigin !== registryOrigin) {
       throw new Error("registry archive source must use the registry origin");
     }
+  } else if (normalized.sourceType !== "command") {
+    throw new Error("registry package source type is unsupported");
   }
   const authority = Object.freeze({});
   registryResolutionAuthorities.set(
@@ -694,6 +766,9 @@ export function authorizeRegistryPluginEntry(
           : null,
       payloadSha256: null,
       documentSha256: fetched.documentSha256,
+      commandMode:
+        normalized.sourceType === "command" ? normalized.commandSpec.mode : null,
+      marketplaceRequestHeaders: fetched.marketplaceRequestHeaders,
     }),
   );
   return {
@@ -734,6 +809,7 @@ export function listRegistryPlugins(registry) {
             : null,
       sourceType: source.type,
       ref: source.type === "git" ? source.ref : null,
+      ...(source.type === "command" ? { mode: source.mode } : {}),
       description: p.description || "",
       enabled: source.type !== "dynamic-disabled",
       ...(source.type === "dynamic-disabled"
@@ -800,13 +876,20 @@ export async function resolveRemoteSource(url, opts = {}) {
           token,
           registryResolutionAuthority: authorized.registryResolutionAuthority,
         });
-  return {
+  const result = {
     ...resolvedSource,
-    entry,
     fromCache,
     documentSha256,
     ...(networkAuthority ? { networkAuthority } : {}),
   };
+  // Command descriptors can contain local paths or credentials. Retain the
+  // exact registry entry for the immediate authorized materialization flow,
+  // but keep it out of generic result serialization/audit output.
+  Object.defineProperty(result, "entry", {
+    value: entry,
+    enumerable: false,
+  });
+  return result;
 }
 
 /** Inspect one selected entry without fetching any candidate source bytes. */
@@ -822,6 +905,22 @@ export function inspectRegistryEntrySource(entry) {
       archiveSpec: packageSource,
     };
   }
+  if (packageSource.type === "command") {
+    const inspected = {
+      source: null,
+      sourceIdentity: packageSource.identity,
+      sourceType: "command",
+      ref: null,
+      sha256: entry.sha256 || null,
+    };
+    // The descriptor may contain local credentials. It remains available to
+    // the immediate materializer but never spreads into a catalog/result.
+    Object.defineProperty(inspected, "commandSpec", {
+      value: packageSource,
+      enumerable: false,
+    });
+    return inspected;
+  }
   // Preserve the canonical remote Git validation from the registry security
   // boundary rather than accepting the adapter's more general local shape.
   const normalized = normalizeRegistryPluginSource(entry);
@@ -869,6 +968,7 @@ export async function resolveRegistryEntrySource(url, entry, opts = {}) {
       proxyUrl: opts.proxyUrl,
       pacFile: opts.pacFile,
       caFile: opts.caFile,
+      requestHeaders: issued.marketplaceRequestHeaders,
     });
     const materializedAuthority = Object.freeze({});
     registryResolutionAuthorities.set(
@@ -886,6 +986,51 @@ export async function resolveRegistryEntrySource(url, entry, opts = {}) {
       registryResolutionAuthority: materializedAuthority,
     };
   }
+  if (inspected.sourceType === "command") {
+    const command = await runMarketplaceCommandSource(
+      {
+        executable: inspected.commandSpec.executable,
+        args: inspected.commandSpec.args,
+        cwd: inspected.commandSpec.cwd,
+        env: inspected.commandSpec.env,
+        timeoutMs: inspected.commandSpec.timeoutMs,
+        maxOutputBytes: inspected.commandSpec.maxOutputBytes,
+        mode: inspected.commandSpec.mode,
+      },
+      {
+      platform: opts.platform,
+      spawn: opts.commandSpawn,
+      spawnSync: opts.commandSpawnSync,
+      kill: opts.commandKill,
+      },
+    );
+    const materializedAuthority = Object.freeze({});
+    registryResolutionAuthorities.set(
+      materializedAuthority,
+      Object.freeze({
+        ...issued,
+        source: command.source,
+        payloadSha256: command.payloadSha256,
+        commandMode: command.mode,
+        fileCount: command.fileCount,
+        totalBytes: command.totalBytes,
+      }),
+    );
+    return {
+      ...inspected,
+      source: command.source,
+      commandAuthority: Object.freeze({
+        schemaVersion: "cc-plugin-marketplace-command-source/v1",
+        status: "descriptor-executed-and-verified",
+        descriptorIdentity: inspected.sourceIdentity,
+        mode: command.mode,
+        payloadSha256: command.payloadSha256,
+        fileCount: command.fileCount,
+        totalBytes: command.totalBytes,
+      }),
+      registryResolutionAuthority: materializedAuthority,
+    };
+  }
   return {
     ...inspected,
     registryResolutionAuthority: opts.registryResolutionAuthority,

package/src/lib/plugin-runtime/settings.js

@@ -37,7 +37,9 @@ export function collectPluginSettings(opts = {}) {
   } catch {
     return { env: {}, model: null, sources: [] };
   }
-  const { trusted, skipped } = partitionByTrust(plugins);
+  const { trusted, skipped } = partitionByTrust(plugins, {
+    workspaceRoot: opts.cwd,
+  });
   warnUntrustedOnce(
     skipped.filter((p) => p.manifest?.components?.settings).map((p) => p.name),
     "settings",

package/src/lib/plugin-runtime/trust.js

@@ -22,12 +22,21 @@
  */
 
 import path from "path";
+import { createHash } from "node:crypto";
 import { getElectronUserDataDir } from "../paths.js";
 import { withFileLock } from "../with-file-lock.js";
 import {
   mutateSecurityStore,
   readSecurityStore,
 } from "../durable-security-store.js";
+import {
+  checkRecordedWorkspaceTrust,
+  evaluateWorkspaceTrustDecision,
+  projectWorkspaceTrustAudit,
+  recordWorkspaceTrustConsent,
+  resolveCanonicalWorkspaceRepoIdentity,
+  revokeRecordedWorkspaceTrust,
+} from "../workspace-trust.js";
 
 export const _deps = {
   now: () => new Date().toISOString(),
@@ -35,10 +44,16 @@ export const _deps = {
   // Path of the trust store; injectable so unit tests never touch the real
   // user-data dir.
   storePath: () => path.join(getElectronUserDataDir(), "plugin-trust.json"),
+  // Test-only seam. Production uses workspace-trust.js's one shared ledger.
+  workspaceTrustStorePath: () => null,
 };
 
 const AUTO_TRUSTED_SCOPES = new Set(["user", "local"]);
 
+function defaultPluginTrustStorePath() {
+  return path.join(getElectronUserDataDir(), "plugin-trust.json");
+}
+
 export function loadTrustStore() {
   return readSecurityStore(_deps.storePath(), "plugin trust");
 }
@@ -47,26 +62,228 @@ function trustKey(scope, name) {
   return `${scope}:${name}`;
 }
 
+const PLUGIN_WORKSPACE_TRUST_SOURCE = "plugin";
+
+function workspaceTrustStoreOptions(options = {}) {
+  const sourceStore = options.storePath || _deps.storePath();
+  let usesDefaultSourceStore = false;
+  try {
+    usesDefaultSourceStore =
+      path.resolve(sourceStore) === path.resolve(defaultPluginTrustStorePath());
+  } catch {
+    // Let the source-specific mutation/check fail closed later. This helper
+    // must not turn an invalid custom path into the production shared ledger.
+  }
+  const store =
+    options.workspaceTrustStorePath ||
+    process.env.CC_WORKSPACE_TRUST_STORE ||
+    _deps.workspaceTrustStorePath() ||
+    (!usesDefaultSourceStore && typeof sourceStore === "string"
+      ? path.join(path.dirname(sourceStore), "workspace-trust-v1.json")
+      : null);
+  return store ? { storePath: store } : {};
+}
+
+function pluginWorkspaceRoot(plugin, options = {}) {
+  return (
+    options.workspaceRoot ||
+    plugin?.workspaceRoot ||
+    plugin?.projectRoot ||
+    plugin?.cwd ||
+    process.cwd()
+  );
+}
+
+function pluginWorkspaceTrustContext(plugin, options = {}) {
+  const scope = String(plugin?.scope || "");
+  const name = String(plugin?.name || "");
+  const version = String(plugin?.version || "");
+  if (!scope || !name || !version) {
+    throw new Error("plugin trust requires scope, name, and version");
+  }
+  const identity = resolveCanonicalWorkspaceRepoIdentity(
+    pluginWorkspaceRoot(plugin, options),
+  );
+  const subject = `${scope}:${name}`;
+  const fingerprint = createHash("sha256")
+    .update(`${scope}\0${name}\0${version}`, "utf8")
+    .digest("hex");
+  return { identity, subject, fingerprint };
+}
+
+function workspaceTrustKey(plugin, context) {
+  const nameDigest = createHash("sha256")
+    .update(String(plugin.name), "utf8")
+    .digest("hex");
+  return `workspace-v1:${context.identity.workspaceId}:${nameDigest}`;
+}
+
+function pluginDecision(status, context, consent = "explicit") {
+  const decision = evaluateWorkspaceTrustDecision({
+    identity: context.identity,
+    evidence: [
+      {
+        source: PLUGIN_WORKSPACE_TRUST_SOURCE,
+        consent,
+        fingerprint: context.fingerprint,
+        decision:
+          status === "trusted"
+            ? "allow"
+            : status === "first-use"
+              ? "ask"
+              : "deny",
+      },
+    ],
+  });
+  return Object.freeze({
+    status,
+    decision: decision.decision,
+    audit: projectWorkspaceTrustAudit(decision),
+  });
+}
+
 /**
- * May this plugin's code-bearing components run?
- * @param {{ scope, name, version }} plugin
+ * Evaluate one plugin against the shared canonical workspace trust lattice.
+ * User/local scope keeps its established local-install consent model; project
+ * scope requires both the source-specific record and the shared v1 record.
  */
-export function isPluginTrusted(plugin) {
-  if (!plugin || !plugin.name) return false;
-  if (AUTO_TRUSTED_SCOPES.has(plugin.scope)) return true;
+export function checkPluginWorkspaceTrust(plugin, options = {}) {
+  if (!plugin || !plugin.name) {
+    return Object.freeze({
+      status: "changed",
+      decision: "deny",
+      audit: projectWorkspaceTrustAudit(null),
+    });
+  }
+  const scope = String(plugin.scope || "");
   try {
-    const entry = loadTrustStore()[trustKey(plugin.scope, plugin.name)];
-    return Boolean(entry && entry.version === plugin.version);
+    const context = pluginWorkspaceTrustContext(plugin, options);
+    if (AUTO_TRUSTED_SCOPES.has(scope)) {
+      return pluginDecision("trusted", context, "scope-default");
+    }
+    if (scope !== "project") return pluginDecision("changed", context);
+
+    const store = loadTrustStore();
+    const record = store[workspaceTrustKey(plugin, context)];
+    const legacy = store[trustKey(scope, plugin.name)];
+    if (!record || typeof record !== "object" || Array.isArray(record)) {
+      // Old scope:name records have no canonical workspace identity.  They
+      // remain visible to listTrust(), but require explicit re-consent.
+      const shared = checkRecordedWorkspaceTrust({
+        identity: context.identity,
+        source: PLUGIN_WORKSPACE_TRUST_SOURCE,
+        subject: context.subject,
+        evidenceFingerprint: context.fingerprint,
+        ...workspaceTrustStoreOptions(options),
+      });
+      if (shared.status === "changed") {
+        return Object.freeze({
+          status: "changed",
+          decision: shared.decision,
+          audit: shared.audit,
+        });
+      }
+      if (legacy?.version) {
+        // Match the shared migration contract: a legacy allow is downgraded
+        // to `ask`, never silently reused. `isPluginTrusted` still refuses to
+        // run it until trustPlugin writes canonical v1 consent.
+        return Object.freeze({
+          ...pluginDecision("first-use", context, "legacy"),
+          status: "changed",
+        });
+      }
+      return Object.freeze({
+        status: "first-use",
+        decision: shared.decision,
+        audit: shared.audit,
+      });
+    }
+    const binding = record.workspaceTrust;
+    if (
+      record.version !== plugin.version ||
+      !binding ||
+      binding.workspaceId !== context.identity.workspaceId ||
+      binding.repositoryId !== context.identity.repositoryId ||
+      binding.subject !== context.subject
+    ) {
+      return pluginDecision("changed", context);
+    }
+    const shared = checkRecordedWorkspaceTrust({
+      identity: context.identity,
+      source: PLUGIN_WORKSPACE_TRUST_SOURCE,
+      subject: context.subject,
+      evidenceFingerprint: context.fingerprint,
+      ...workspaceTrustStoreOptions(options),
+    });
+    return Object.freeze({
+      status: shared.status === "trusted" ? "trusted" : "changed",
+      decision: shared.decision,
+      audit: shared.audit,
+    });
   } catch {
-    // Project code must stay disabled when the trust store is unavailable.
-    return false;
+    return Object.freeze({
+      status: "changed",
+      decision: "deny",
+      audit: projectWorkspaceTrustAudit(null),
+    });
   }
 }
 
+/**
+ * May this plugin's code-bearing components run?
+ * @param {{ scope, name, version }} plugin
+ */
+export function isPluginTrusted(plugin) {
+  return checkPluginWorkspaceTrust(plugin).decision === "allow";
+}
+
 /** Trust a plugin (records the exact version). */
-export function trustPlugin(name, { scope = "project", version } = {}) {
+export function trustPlugin(
+  name,
+  { scope = "project", version, workspaceRoot, workspaceTrustStorePath } = {},
+) {
   if (!version) throw new Error("trustPlugin requires a version");
   const file = _deps.storePath();
+  const plugin = { scope, name, version, workspaceRoot };
+  if (scope === "project") {
+    const context = pluginWorkspaceTrustContext(plugin, { workspaceRoot });
+    recordWorkspaceTrustConsent({
+      identity: context.identity,
+      source: PLUGIN_WORKSPACE_TRUST_SOURCE,
+      subject: context.subject,
+      evidenceFingerprint: context.fingerprint,
+      consent: "explicit",
+      ...workspaceTrustStoreOptions({
+        workspaceTrustStorePath,
+        storePath: file,
+      }),
+    });
+    return mutateSecurityStore(
+      file,
+      "plugin trust",
+      (store) => {
+        store[workspaceTrustKey(plugin, context)] = {
+          name,
+          scope,
+          version,
+          trustedAt: _deps.now(),
+          workspaceTrust: {
+            schemaVersion: context.identity.schemaVersion,
+            workspaceId: context.identity.workspaceId,
+            repositoryId: context.identity.repositoryId,
+            subject: context.subject,
+          },
+        };
+        return {
+          name,
+          scope,
+          version,
+          workspaceId: context.identity.workspaceId,
+        };
+      },
+      { lock: _deps.withFileLock },
+    );
+  }
   return mutateSecurityStore(
     file,
     "plugin trust",
@@ -79,8 +296,38 @@ export function trustPlugin(name, { scope = "project", version } = {}) {
 }
 
 /** Revoke trust for a plugin at a scope. */
-export function untrustPlugin(name, { scope = "project" } = {}) {
+export function untrustPlugin(
+  name,
+  { scope = "project", workspaceRoot, workspaceTrustStorePath } = {},
+) {
   const file = _deps.storePath();
+  if (scope === "project") {
+    const plugin = { scope, name, version: "trust-revocation", workspaceRoot };
+    const context = pluginWorkspaceTrustContext(plugin, { workspaceRoot });
+    const result = mutateSecurityStore(
+      file,
+      "plugin trust",
+      (store) => {
+        const key = workspaceTrustKey(plugin, context);
+        const existed = Object.prototype.hasOwnProperty.call(store, key);
+        delete store[key];
+        return { name, scope, removed: existed };
+      },
+      { lock: _deps.withFileLock },
+    );
+    // Local removal happens first, so a shared-ledger write failure cannot
+    // leave the code-bearing plugin authorized.
+    revokeRecordedWorkspaceTrust({
+      identity: context.identity,
+      source: PLUGIN_WORKSPACE_TRUST_SOURCE,
+      subject: context.subject,
+      ...workspaceTrustStoreOptions({
+        workspaceTrustStorePath,
+        storePath: file,
+      }),
+    });
+    return result;
+  }
   return mutateSecurityStore(
     file,
     "plugin trust",
@@ -97,12 +344,23 @@ export function untrustPlugin(name, { scope = "project" } = {}) {
 /** All trust entries (for `cc plugin trust --list`). */
 export function listTrust() {
   return Object.entries(loadTrustStore()).map(([key, v]) => {
+    if (key.startsWith("workspace-v1:") && v?.workspaceTrust) {
+      return {
+        scope: "project",
+        name: typeof v.name === "string" ? v.name : null,
+        version: v?.version || null,
+        trustedAt: v?.trustedAt || null,
+        workspaceId: v.workspaceTrust.workspaceId || null,
+        repositoryId: v.workspaceTrust.repositoryId || null,
+      };
+    }
     const idx = key.indexOf(":");
     return {
       scope: key.slice(0, idx),
       name: key.slice(idx + 1),
       version: v?.version || null,
       trustedAt: v?.trustedAt || null,
+      legacy: key.startsWith("project:"),
     };
   });
 }
@@ -111,11 +369,14 @@ export function listTrust() {
  * Split discovered plugins into those whose code may run and those gated out.
  * @returns {{ trusted: any[], skipped: any[] }}
  */
-export function partitionByTrust(plugins) {
+export function partitionByTrust(plugins, options = {}) {
   const trusted = [];
   const skipped = [];
   for (const p of plugins || []) {
-    (isPluginTrusted(p) ? trusted : skipped).push(p);
+    (checkPluginWorkspaceTrust(p, options).decision === "allow"
+      ? trusted
+      : skipped
+    ).push(p);
   }
   return { trusted, skipped };
 }