chainlesschain 0.165.6 → 0.165.9

package/src/harness/session-index.js

@@ -20,7 +20,8 @@
 import { existsSync, readdirSync, statSync } from "node:fs";
 import { join, basename } from "node:path";
 import { createRequire } from "node:module";
-import { getHomeDir } from "../lib/paths.js";
+import { ensureClaudeProjectStorageTree, getHomeDir } from "../lib/paths.js";
+import { resolveClaudeProjectStorageDir } from "../lib/claude-project-storage-layout.js";
 import { ensurePrivateDirectory, ensurePrivateFile } from "../lib/secure-fs.js";
 import { readVerifiedProjection } from "./jsonl-session-store.js";
 
@@ -39,12 +40,22 @@ export const _deps = {
 };
 
 function sessionsDir() {
-  return join(getHomeDir(), "sessions");
+  const homeDir = getHomeDir();
+  return resolveClaudeProjectStorageDir(homeDir) || join(homeDir, "sessions");
 }
 
 function indexPath() {
-  const dir = getHomeDir();
-  ensurePrivateDirectory(dir);
+  const homeDir = getHomeDir();
+  const projectDir = resolveClaudeProjectStorageDir(homeDir);
+  if (projectDir) {
+    ensureClaudeProjectStorageTree(homeDir, projectDir);
+  }
+  const dir = projectDir || homeDir;
+  if (!projectDir) ensurePrivateDirectory(dir);
+  // Keep the long-standing global cache path for legacy sessions. A
+  // Claude-compatible project layout must not make one project's index scan
+  // another project's transcripts, so its derived index lives beside those
+  // project-local JSONL files.
   return join(dir, "session-index.db");
 }
 

package/src/lib/agent-network.js

@@ -14,6 +14,38 @@
  */
 
 import crypto from "crypto";
+import { createSecretStore } from "./secret-store.js";
+
+let configuredAgentNetworkSecretStore = null;
+
+export function setAgentNetworkSecretStore(secretStore) {
+  if (
+    !secretStore ||
+    typeof secretStore.set !== "function" ||
+    typeof secretStore.get !== "function" ||
+    typeof secretStore.delete !== "function"
+  ) {
+    throw new TypeError("Agent Network requires a SecretStore");
+  }
+  configuredAgentNetworkSecretStore = secretStore;
+}
+
+function getAgentNetworkSecretStore() {
+  if (!configuredAgentNetworkSecretStore) {
+    configuredAgentNetworkSecretStore = createSecretStore({
+      service: "chainlesschain-agent-network",
+    });
+  }
+  return configuredAgentNetworkSecretStore;
+}
+
+function didPrivateKeyRef(did) {
+  return `agent-network/did/${crypto.createHash("sha256").update(did).digest("hex")}`;
+}
+
+function authTokenHash(token) {
+  return crypto.createHash("sha256").update(String(token)).digest("hex");
+}
 
 /* ── Constants ───────────────────────────────────────────── */
 
@@ -77,7 +109,8 @@ export function ensureAgentNetworkTables(db) {
     CREATE TABLE IF NOT EXISTS agent_dids (
       did TEXT PRIMARY KEY,
       public_key TEXT NOT NULL,
-      private_key TEXT NOT NULL,
+      private_key TEXT NOT NULL DEFAULT '',
+      private_key_ref TEXT NOT NULL,
       did_document TEXT NOT NULL,
       metadata TEXT,
       status TEXT NOT NULL,
@@ -124,7 +157,8 @@ export function ensureAgentNetworkTables(db) {
     CREATE TABLE IF NOT EXISTS agent_auth_sessions (
       session_id TEXT PRIMARY KEY,
       agent_did TEXT NOT NULL,
-      token TEXT NOT NULL,
+      token TEXT NOT NULL DEFAULT '',
+      token_hash TEXT NOT NULL,
       challenge TEXT NOT NULL,
       status TEXT NOT NULL,
       expires_at INTEGER NOT NULL,
@@ -161,6 +195,81 @@ export function ensureAgentNetworkTables(db) {
       completed_at INTEGER
     )
   `);
+
+  for (const [table, column, definition] of [
+    ["agent_dids", "private_key_ref", "TEXT"],
+    ["agent_auth_sessions", "token_hash", "TEXT"],
+  ]) {
+    const columns = db.prepare(`PRAGMA table_info(${table})`).all();
+    if (columns.length > 0 && !columns.some((entry) => entry.name === column)) {
+      db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
+    }
+  }
+
+  migrateAgentNetworkSecrets(db);
+}
+
+export function migrateAgentNetworkSecrets(db, { dryRun = false } = {}) {
+  db.exec("PRAGMA secure_delete = ON");
+  const didRows = db
+    .prepare("SELECT did, private_key, private_key_ref FROM agent_dids")
+    .all()
+    .filter((row) => row.private_key && !row.private_key_ref);
+  const authRows = db
+    .prepare("SELECT session_id, token, token_hash FROM agent_auth_sessions")
+    .all()
+    .filter((row) => row.token && !row.token_hash);
+
+  if (dryRun) {
+    return {
+      pendingPrivateKeys: didRows.length,
+      pendingTokens: authRows.length,
+      migratedPrivateKeys: 0,
+      migratedTokens: 0,
+      dryRun: true,
+    };
+  }
+
+  if (
+    (didRows.length > 0 || authRows.length > 0) &&
+    typeof db.transaction !== "function"
+  ) {
+    throw new Error(
+      "Agent Network secret migration requires transactional database support",
+    );
+  }
+
+  const secretStore = didRows.length > 0 ? getAgentNetworkSecretStore() : null;
+  const stagedKeyRefs = [];
+  try {
+    for (const row of didRows) {
+      const keyRef = didPrivateKeyRef(row.did);
+      secretStore.set(keyRef, row.private_key);
+      stagedKeyRefs.push(keyRef);
+    }
+
+    const applyMigration = db.transaction(() => {
+      for (const row of didRows) {
+        const keyRef = didPrivateKeyRef(row.did);
+        db.prepare(
+          "UPDATE agent_dids SET private_key = ?, private_key_ref = ? WHERE did = ?",
+        ).run("", keyRef, row.did);
+      }
+      for (const row of authRows) {
+        db.prepare(
+          "UPDATE agent_auth_sessions SET token = ?, token_hash = ? WHERE session_id = ?",
+        ).run("", authTokenHash(row.token), row.session_id);
+      }
+    });
+    applyMigration();
+  } catch (error) {
+    for (const keyRef of stagedKeyRefs) secretStore.delete(keyRef);
+    throw error;
+  }
+  return {
+    migratedPrivateKeys: didRows.length,
+    migratedTokens: authRows.length,
+  };
 }
 
 /* ── Helpers ─────────────────────────────────────────────── */
@@ -258,6 +367,7 @@ export function createAgentDID(db, { displayName, metadata = {} } = {}) {
     .slice(0, 32);
   const did = `did:chainless:${idHash}`;
   const now = _now();
+  const privateKeyRef = didPrivateKeyRef(did);
 
   const didDocument = {
     "@context": ["https://www.w3.org/ns/did/v1"],
@@ -284,20 +394,28 @@ export function createAgentDID(db, { displayName, metadata = {} } = {}) {
       : [],
   };
 
-  db.prepare(
-    `INSERT INTO agent_dids
-      (did, public_key, private_key, did_document, metadata, status, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
-  ).run(
-    did,
-    publicKey,
-    privateKey,
-    JSON.stringify(didDocument),
-    _json({ displayName, ...metadata }),
-    DID_STATUS.ACTIVE,
-    now,
-    now,
-  );
+  const secretStore = getAgentNetworkSecretStore();
+  secretStore.set(privateKeyRef, privateKey);
+  try {
+    db.prepare(
+      `INSERT INTO agent_dids
+        (did, public_key, private_key, private_key_ref, did_document, metadata, status, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    ).run(
+      did,
+      publicKey,
+      "",
+      privateKeyRef,
+      JSON.stringify(didDocument),
+      _json({ displayName, ...metadata }),
+      DID_STATUS.ACTIVE,
+      now,
+      now,
+    );
+  } catch (error) {
+    secretStore.delete(privateKeyRef);
+    throw error;
+  }
 
   return { did, publicKey, didDocument };
 }
@@ -351,12 +469,19 @@ export function deactivateAgentDID(db, did) {
 
 export function signWithAgent(db, did, data) {
   const row = db
-    .prepare(`SELECT private_key, status FROM agent_dids WHERE did = ?`)
+    .prepare(`SELECT private_key_ref, status FROM agent_dids WHERE did = ?`)
     .get(did);
   if (!row) throw new Error(`Unknown agent DID: ${did}`);
   if (row.status !== DID_STATUS.ACTIVE)
     throw new Error(`Agent DID is not active: ${did}`);
-  return _signEd25519(row.private_key, data);
+  if (!row.private_key_ref) {
+    throw new Error(`Agent DID private key reference is missing: ${did}`);
+  }
+  const privateKey = getAgentNetworkSecretStore().get(row.private_key_ref);
+  if (!privateKey) {
+    throw new Error(`Agent DID private key is unavailable: ${did}`);
+  }
+  return _signEd25519(privateKey, data);
 }
 
 export function verifyWithAgent(db, did, data, signature) {
@@ -557,14 +682,13 @@ export function startAuth(db, did) {
     throw new Error(`Agent DID not active: ${did}`);
   const sessionId = _uuid();
   const challenge = _hex(crypto.randomBytes(32));
-  const token = _hex(crypto.randomBytes(24));
   const now = _now();
   const expires = now + SESSION_TTL_MS;
   db.prepare(
     `INSERT INTO agent_auth_sessions
-       (session_id, agent_did, token, challenge, status, expires_at, created_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`,
-  ).run(sessionId, did, token, challenge, AUTH_STATUS.PENDING, expires, now);
+       (session_id, agent_did, token, token_hash, challenge, status, expires_at, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+  ).run(sessionId, did, "", "", challenge, AUTH_STATUS.PENDING, expires, now);
   return { sessionId, challenge, expiresAt: expires };
 }
 
@@ -584,21 +708,23 @@ export function completeAuth(db, sessionId, signatureHex) {
   }
   const ok = verifyWithAgent(db, row.agent_did, row.challenge, signatureHex);
   if (!ok) throw new Error(`Signature verification failed`);
+  const token = _hex(crypto.randomBytes(24));
   db.prepare(
-    `UPDATE agent_auth_sessions SET status = ? WHERE session_id = ?`,
-  ).run(AUTH_STATUS.ACTIVE, sessionId);
+    `UPDATE agent_auth_sessions SET status = ?, token = ?, token_hash = ? WHERE session_id = ?`,
+  ).run(AUTH_STATUS.ACTIVE, "", authTokenHash(token), sessionId);
   return {
     sessionId,
-    token: row.token,
+    token,
     agentDid: row.agent_did,
     expiresAt: row.expires_at,
   };
 }
 
 export function validateSession(db, token) {
+  if (typeof token !== "string" || token.length === 0) return null;
   const row = db
-    .prepare(`SELECT * FROM agent_auth_sessions WHERE token = ?`)
-    .get(token);
+    .prepare(`SELECT * FROM agent_auth_sessions WHERE token_hash = ?`)
+    .get(authTokenHash(token));
   if (!row) return null;
   const now = _now();
   if (row.status !== AUTH_STATUS.ACTIVE) return null;
@@ -659,13 +785,24 @@ export function issueCredential(
   if (!issuerDid) throw new Error("issuerDid is required");
   if (!subjectDid) throw new Error("subjectDid is required");
   const issuer = db
-    .prepare(`SELECT private_key, status FROM agent_dids WHERE did = ?`)
+    .prepare(`SELECT private_key_ref, status FROM agent_dids WHERE did = ?`)
     .get(issuerDid);
   if (!issuer) throw new Error(`Unknown issuer DID: ${issuerDid}`);
   if (issuer.status !== DID_STATUS.ACTIVE)
     throw new Error(`Issuer DID not active: ${issuerDid}`);
   const subject = resolveAgentDID(db, subjectDid);
   if (!subject) throw new Error(`Unknown subject DID: ${subjectDid}`);
+  if (!issuer.private_key_ref) {
+    throw new Error(
+      `Issuer DID private key reference is missing: ${issuerDid}`,
+    );
+  }
+  const issuerPrivateKey = getAgentNetworkSecretStore().get(
+    issuer.private_key_ref,
+  );
+  if (!issuerPrivateKey) {
+    throw new Error(`Issuer DID private key is unavailable: ${issuerDid}`);
+  }
   const now = _now();
   const id = `vc:${_uuid()}`;
   const payload = {
@@ -677,7 +814,7 @@ export function issueCredential(
     issuedAt: now,
     expiresAt,
   };
-  const proof = _credentialProof(issuer.private_key, payload);
+  const proof = _credentialProof(issuerPrivateKey, payload);
   db.prepare(
     `INSERT INTO agent_credentials
        (id, issuer_did, subject_did, type, claims, proof, status, issued_at, expires_at)

package/src/lib/agent-router.js

@@ -3,7 +3,7 @@
  *
  * Routes coding subtasks across multiple agent backends in parallel:
  *   - claude     (Claude Code CLI — best for complex reasoning)
- *   - codex      (GitHub Copilot CLI — good for repo context)
+ *   - codex      (OpenAI Codex CLI — good for repo context)
  *   - gemini     (Google Gemini via ChainlessChain LLM provider)
  *   - openai     (GPT-4o via ChainlessChain LLM provider)
  *   - ollama     (Local LLM — offline / private)
@@ -32,6 +32,12 @@ import {
   detectCodex,
 } from "./claude-code-bridge.js";
 import { createChatFn } from "./cowork-adapter.js";
+import runtimeClaimsContract from "@chainlesschain/session-core/runtime-claims";
+
+const { RUNTIME_MODE, createRuntimeClaims } = runtimeClaimsContract;
+const SIMULATED_API_CLAIMS = createRuntimeClaims({
+  mode: RUNTIME_MODE.SIMULATED,
+});
 
 // ─── Backend type constants ───────────────────────────────────────
 export const BACKEND_TYPE = {
@@ -70,6 +76,37 @@ const TYPE_KEYWORDS = {
   research: ["research", "investigate", "explore", "compare"],
 };
 
+export const AGENT_ROUTER_ERROR = Object.freeze({
+  WRITE_ISOLATION_REQUIRED: "AGENT_ROUTER_WRITE_ISOLATION_REQUIRED",
+});
+
+function normalizedScopes(task) {
+  if (!Array.isArray(task?.scopePaths) || task.scopePaths.length === 0) {
+    return null;
+  }
+  return task.scopePaths.map(
+    (scope) => String(scope).replace(/\\/g, "/").replace(/\/+$/u, "") + "/",
+  );
+}
+
+export function assignmentsHaveDisjointWrites(assignments) {
+  if (assignments.every(({ task }) => task?.effects === "read-only")) {
+    return true;
+  }
+  const scopes = assignments.map(({ task }) => normalizedScopes(task));
+  if (scopes.some((scope) => scope === null)) return false;
+  for (let i = 0; i < scopes.length; i += 1) {
+    for (let j = i + 1; j < scopes.length; j += 1) {
+      for (const left of scopes[i]) {
+        for (const right of scopes[j]) {
+          if (left.startsWith(right) || right.startsWith(left)) return false;
+        }
+      }
+    }
+  }
+  return true;
+}
+
 function detectTaskType(description) {
   const lower = description.toLowerCase();
   for (const [type, keywords] of Object.entries(TYPE_KEYWORDS)) {
@@ -116,20 +153,26 @@ async function executeViaAPI(task, options) {
     ]);
 
     return {
-      success: true,
+      success: false,
+      status: "simulated",
       output,
       exitCode: 0,
       duration: Date.now() - startTime,
       agentId: `api-${provider}`,
+      runtimeClaims: SIMULATED_API_CLAIMS,
+      terminalEvidence: [],
     };
   } catch (err) {
     return {
       success: false,
+      status: "failed",
       output: "",
       exitCode: -1,
       duration: Date.now() - startTime,
       agentId: `api-${provider}`,
       error: err.message,
+      runtimeClaims: SIMULATED_API_CLAIMS,
+      terminalEvidence: [],
     };
   }
 }
@@ -257,6 +300,13 @@ export class AgentRouter extends EventEmitter {
 
   /** Parallel-all: run every task on ALL backends; return best result per task. */
   async _dispatchParallelAll(subtasks, { cwd }) {
+    if (this._backends.length > 1) {
+      const error = new Error(
+        "parallel-all requires per-attempt worktrees and accepted-winner merge",
+      );
+      error.code = AGENT_ROUTER_ERROR.WRITE_ISOLATION_REQUIRED;
+      throw error;
+    }
     const results = [];
     for (const task of subtasks) {
       const allResults = await Promise.all(
@@ -276,10 +326,15 @@ export class AgentRouter extends EventEmitter {
 
   async _runAssignments(assignments, { cwd }) {
     const results = new Array(assignments.length);
-
-    // Process in parallel batches
-    for (let i = 0; i < assignments.length; i += this.maxParallel) {
-      const batch = assignments.slice(i, i + this.maxParallel);
+    const concurrency = assignmentsHaveDisjointWrites(assignments)
+      ? this.maxParallel
+      : 1;
+
+    // Shared writable cwd tasks are serialized unless their declared write
+    // scopes are statically disjoint. Candidate fan-out is rejected above
+    // until it has per-attempt worktrees and winner-only merge semantics.
+    for (let i = 0; i < assignments.length; i += concurrency) {
+      const batch = assignments.slice(i, i + concurrency);
       const batchResults = await Promise.all(
         batch.map(({ task, backend }) =>
           this._runSingleTask(task, backend, { cwd }),
@@ -332,6 +387,7 @@ export class AgentRouter extends EventEmitter {
           maxParallel: 1,
           cliCommand: type === BACKEND_TYPE.CODEX ? "codex" : "claude",
           model: cfg.model || null,
+          sandbox: cfg.sandbox || null,
         });
         pool.on("agent:output", (ev) => this.emit("agent:output", ev));
         return {

package/src/lib/agent-sandbox.js

@@ -259,7 +259,13 @@ export function normalizeAgentSandbox(value, options = {}) {
  */
 export function normalizeAgentSandboxMode(mode, value, options = {}) {
   if (mode == null || mode === "") {
-    return normalizeAgentSandbox(value, options);
+    // Public agent execution defaults to a real, fail-closed workspace
+    // sandbox. Bare-host execution remains available only through the
+    // explicit `off` mode below, where managed policy can prohibit it.
+    return normalizeAgentSandboxMode("workspace-write", value || true, {
+      ...options,
+      network: false,
+    });
   }
   if (!AGENT_SANDBOX_MODES.includes(mode)) {
     const error = new Error(

package/src/lib/agent-worktree.js

@@ -244,7 +244,14 @@ export function finishAgentWorktree(info, { deps = _deps } = {}) {
   let headSha = null;
   let readable = false;
   try {
-    dirty = git(["status", "--porcelain"], info.path, deps).trim().length > 0;
+    // Do not inherit status.showUntrackedFiles=no from repository/user config:
+    // an untracked agent output is still work that finalize must preserve.
+    dirty =
+      git(
+        ["status", "--porcelain=v1", "--untracked-files=all"],
+        info.path,
+        deps,
+      ).trim().length > 0;
     headSha = git(["rev-parse", "HEAD"], info.path, deps).trim();
     readable = true;
   } catch {

package/src/lib/auto-mode-safety-classifier.js

@@ -20,6 +20,7 @@ import {
   isSecretEnvName,
 } from "./credential-guard.js";
 import { containsSecret } from "./secret-scan.js";
+import { normalizePermissionRequest } from "./permission-request.js";
 
 const require_ = createRequire(import.meta.url);
 const shellPolicy = require_("../runtime/coding-agent-shell-policy.cjs");
@@ -459,21 +460,6 @@ function canonicalShellKeyword(token) {
     .replace(/\\(.)/g, "$1");
 }
 
-function inputCommand(input) {
-  const command = input?.args?.command;
-  if (typeof command === "string") return command;
-  const argv = input?.args?.argv;
-  return Array.isArray(argv)
-    ? argv
-        .map((value) => {
-          const token = String(value);
-          if (token && !/[\s|;&"'\\]/.test(token)) return token;
-          return `"${token.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-        })
-        .join(" ")
-    : "";
-}
-
 function workspaceRoots(context = {}) {
   const roots = [];
   if (Array.isArray(context.workspaceRoots)) {
@@ -1817,7 +1803,7 @@ export function classifyAutoModeSafety(input = {}) {
   const args = input.args && typeof input.args === "object" ? input.args : {};
   const context =
     input.context && typeof input.context === "object" ? input.context : {};
-  const command = inputCommand({ args });
+  const command = normalizePermissionRequest({ tool, args }).command;
   const segments = collectCommandSegments(command);
   const argsText = stableSerialize(args);
   const baseRiskLevel = normalizeRisk(input.baseRiskLevel, "medium");
@@ -2000,7 +1986,7 @@ export function evaluateAutoModeSafety(input = {}, opts = {}) {
       : classifyAutoModeSafety;
   const classification = classifier(input);
   const tool = String(input?.tool || "unknown").toLowerCase();
-  const command = inputCommand(input);
+  const command = normalizePermissionRequest(input).command;
   let policy = null;
   if (tool === "run_shell") {
     const result = evaluateShellCommandPolicy(command, {

package/src/lib/background-agent-keeper-protocol.js

@@ -257,12 +257,16 @@ export function prepareBackgroundAgentLocalPipePath(
   { platform = process.platform } = {},
 ) {
   if (platform === "win32") return pipePath;
-  const directory = fallbackLocalPipeDirectory(pipePath);
-  if (!directory) return pipePath;
-  try {
-    mkdirSync(directory, { mode: 0o700 });
-  } catch (error) {
-    if (error?.code !== "EEXIST") throw error;
+  const normalizedPipePath = posix.resolve(
+    String(pipePath || "").replaceAll("\\", "/"),
+  );
+  const directory = posix.dirname(normalizedPipePath);
+  if (fallbackLocalPipeDirectory(pipePath)) {
+    try {
+      mkdirSync(directory, { mode: 0o700 });
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+    }
   }
   const stat = lstatSync(directory);
   const uid = typeof process.getuid === "function" ? process.getuid() : null;
@@ -274,6 +278,22 @@ export function prepareBackgroundAgentLocalPipePath(
   ) {
     throw new Error("background agent socket directory is not private");
   }
+
+  let socketStat = null;
+  try {
+    socketStat = lstatSync(normalizedPipePath);
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+  if (socketStat) {
+    if (
+      socketStat.isSymbolicLink() ||
+      !socketStat.isSocket() ||
+      (uid !== null && socketStat.uid !== uid)
+    ) {
+      throw new Error("background agent socket path is not an owned socket");
+    }
+  }
   return pipePath;
 }
 

package/src/lib/background-agent-supervisor.js

@@ -1,6 +1,8 @@
 import {
+  chmodSync,
   closeSync,
   existsSync,
+  lstatSync,
   mkdirSync,
   openSync,
   readFileSync,
@@ -651,7 +653,21 @@ export function backgroundAgentsDir() {
   const dir =
     process.env.CC_BACKGROUND_AGENTS_DIR ||
     join(getHomeDir(), "background-agents");
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
+  if (process.platform !== "win32") {
+    const stat = lstatSync(dir);
+    const uid = typeof process.getuid === "function" ? process.getuid() : null;
+    if (
+      !stat.isDirectory() ||
+      stat.isSymbolicLink() ||
+      (uid !== null && stat.uid !== uid)
+    ) {
+      throw new Error(
+        "background agent state directory is not owner-controlled",
+      );
+    }
+    chmodSync(dir, 0o700);
+  }
   return dir;
 }