chainlesschain 0.165.6 → 0.165.9

package/src/lib/mcp-oauth.js

@@ -484,7 +484,23 @@ export function loadTokenStore() {
 }
 
 export function getStoredToken(serverUrl) {
-  return loadTokenStore()[serverKey(serverUrl)] || null;
+  const record = loadTokenStore()[serverKey(serverUrl)] || null;
+  return record?.revoked === true ? null : record;
+}
+
+function tokenRecordRevision(record) {
+  return Number.isSafeInteger(record?.credential_revision) &&
+    record.credential_revision >= 0
+    ? record.credential_revision
+    : 0;
+}
+
+function tokenRevisionConflict(serverUrl) {
+  const error = new Error(
+    `MCP OAuth credential changed while it was being refreshed: ${serverKey(serverUrl)}`,
+  );
+  error.code = "MCP_TOKEN_STORE_REVISION_CONFLICT";
+  return error;
 }
 
 // The store holds OAuth access + refresh tokens, so it must not be world-
@@ -642,7 +658,7 @@ export function withStoreLock(file, fn) {
   }
 }
 
-export function saveStoredToken(serverUrl, record) {
+export function saveStoredToken(serverUrl, record, options = {}) {
   const file = tokenStorePath();
   return _deps.withStoreLock(file, () => {
     const r = _readStore(file); // re-read inside the lock (latest state)
@@ -654,24 +670,56 @@ export function saveStoredToken(serverUrl, record) {
       _warnCorruptStoreOnce(file, r.err, archived);
     }
     const store = r.store;
-    store[serverKey(serverUrl)] = { server: serverKey(serverUrl), ...record };
+    const key = serverKey(serverUrl);
+    const current = store[key] || null;
+    if (
+      options.expectedRevision != null &&
+      (tokenRecordRevision(current) !== options.expectedRevision ||
+        current?.revoked === true)
+    ) {
+      throw tokenRevisionConflict(serverUrl);
+    }
+    store[key] = {
+      ...record,
+      server: key,
+      credential_revision: tokenRecordRevision(current) + 1,
+      revoked: false,
+    };
     _writeStoreSecure(file, store);
-    return store[serverKey(serverUrl)];
+    return store[key];
   });
 }
 
-export function deleteStoredToken(serverUrl) {
+function revokeStoredToken(serverUrl, { expectedRevision = null } = {}) {
   const file = tokenStorePath();
   return _deps.withStoreLock(file, () => {
     const store = loadTokenStore(); // re-read inside the lock (latest state)
     const key = serverKey(serverUrl);
-    if (!(key in store)) return false;
-    delete store[key];
+    const current = store[key];
+    if (!current || current.revoked === true) return false;
+    if (
+      expectedRevision != null &&
+      tokenRecordRevision(current) !== expectedRevision
+    ) {
+      return false;
+    }
+    // Keep a revision-only tombstone. An in-flight refresh that read the old
+    // credential must not resurrect it after explicit logout/revocation.
+    store[key] = {
+      server: key,
+      credential_revision: tokenRecordRevision(current) + 1,
+      revoked: true,
+      revoked_at: _deps.now(),
+    };
     _writeStoreSecure(file, store);
     return true;
   });
 }
 
+export function deleteStoredToken(serverUrl) {
+  return revokeStoredToken(serverUrl);
+}
+
 /** True when a record's access token is missing or within `skewMs` of expiry. */
 export function isTokenExpired(record, { skewMs = 60_000 } = {}) {
   if (!record || !record.access_token) return true;
@@ -692,6 +740,8 @@ export function isTokenExpired(record, { skewMs = 60_000 } = {}) {
  * @param {string} serverUrl
  * @param {{ forceRefresh?: boolean }} [opts]
  */
+const tokenRefreshFlights = new Map();
+
 export async function ensureValidToken(
   serverUrl,
   { forceRefresh = false } = {},
@@ -700,21 +750,52 @@ export async function ensureValidToken(
   if (!record) return null;
   if (!forceRefresh && !isTokenExpired(record)) return record.access_token;
   if (!record.refresh_token || !record.endpoints?.token_endpoint) {
-    // Can't refresh. On a forced refresh the cached token is known-rejected, so
-    // hand back null (caller should stop retrying and prompt re-login); on the
-    // proactive path keep the existing behaviour of using what we have.
-    return forceRefresh ? null : record.access_token || null;
+    // Reaching this branch means the cached access token is expired (including
+    // the safety skew) or the server already rejected it. Reusing it would
+    // create a deterministic 401/403 loop, so every caller fails closed.
+    return null;
   }
-  try {
-    const tok = await refreshAccessToken(
-      { token_endpoint: record.endpoints.token_endpoint },
-      { refreshToken: record.refresh_token, clientId: record.client_id },
-    );
-    const updated = saveStoredToken(serverUrl, { ...record, ...tok });
-    return updated.access_token;
-  } catch {
-    return forceRefresh ? null : record.access_token || null;
+  const key = serverKey(serverUrl);
+  let refresh = tokenRefreshFlights.get(key);
+  if (!refresh) {
+    refresh = (async () => {
+      try {
+        const tok = await refreshAccessToken(
+          { token_endpoint: record.endpoints.token_endpoint },
+          { refreshToken: record.refresh_token, clientId: record.client_id },
+        );
+        const updated = saveStoredToken(
+          serverUrl,
+          { ...record, ...tok },
+          { expectedRevision: tokenRecordRevision(record) },
+        );
+        return { status: "refreshed", accessToken: updated.access_token };
+      } catch (error) {
+        if ([400, 401, 403].includes(error?.status)) {
+          const revoked = revokeStoredToken(serverUrl, {
+            expectedRevision: tokenRecordRevision(record),
+          });
+          return { status: revoked ? "revoked" : "conflict" };
+        }
+        return {
+          status:
+            error?.code === "MCP_TOKEN_STORE_REVISION_CONFLICT"
+              ? "conflict"
+              : "failed",
+        };
+      } finally {
+        tokenRefreshFlights.delete(key);
+      }
+    })();
+    tokenRefreshFlights.set(key, refresh);
+  }
+  const outcome = await refresh;
+  if (outcome.status === "refreshed") return outcome.accessToken;
+  if (outcome.status === "revoked") return null;
+  if (outcome.status === "conflict") {
+    return getStoredToken(serverUrl)?.access_token || null;
   }
+  return null;
 }
 
 // ── interactive orchestrator ──────────────────────────────────────────────

package/src/lib/mcp-tls.js

@@ -2,11 +2,24 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import { createHash } from "node:crypto";
+import { createHash, X509Certificate } from "node:crypto";
+import { createSecureContext } from "node:tls";
 import { isProxy } from "node:util/types";
 import { Agent } from "undici";
 
 export const MCP_TLS_MAX_FILE_BYTES = 1024 * 1024;
+export const MCP_TLS_MANAGED_SOURCE_REQUIRED_CODE =
+  "CC_MCP_TLS_MANAGED_SOURCE_REQUIRED";
+export const MCP_TLS_MANAGED_SOURCE_REQUIRED_MESSAGE =
+  "MCP TLS configuration is restricted to managed provisioned sources";
+
+// TLS file paths are a privileged configuration capability: merely marking a
+// JSON object as `configScope: "managed"` must never let a project, user, or
+// headless config read certificate material. Keep the provisioned snapshot in
+// a module-private WeakMap so it cannot be recreated by JSON, object spread,
+// or a lookalike field supplied by an MCP config source.
+const MANAGED_MCP_TLS_PROVENANCE = new WeakMap();
+const MANAGED_MCP_TLS_SCOPE = "managed";
 
 const TLS_KEYS = new Set([
   "certFile",
@@ -22,6 +35,16 @@ function tlsError(code, message, cause = undefined) {
   return error;
 }
 
+function managedTlsSourceRequiredError() {
+  // Do not include the claimed scope, source file, certificate path, or any
+  // TLS configuration field here. This error is surfaced by headless and MCP
+  // connection diagnostics, where config values are not safe to disclose.
+  return tlsError(
+    MCP_TLS_MANAGED_SOURCE_REQUIRED_CODE,
+    MCP_TLS_MANAGED_SOURCE_REQUIRED_MESSAGE,
+  );
+}
+
 function plainTlsObject(value) {
   if (
     !value ||
@@ -129,6 +152,47 @@ export function normalizeMcpTlsConfig(value) {
   };
 }
 
+/**
+ * Convert TLS settings from the organization-managed MCP loader into an
+ * immutable, non-forgeable configuration capability.
+ *
+ * This is deliberately separate from `normalizeMcpTlsConfig`: normalization
+ * validates data, while provisioning records the trusted source provenance
+ * that is required before a certificate/key/CA file can be opened.
+ */
+export function provisionManagedMcpTlsConfig(value) {
+  const config = normalizeMcpTlsConfig(value);
+  if (!config) return null;
+  const provisioned = Object.freeze({ ...config });
+  MANAGED_MCP_TLS_PROVENANCE.set(
+    provisioned,
+    Object.freeze({ configScope: MANAGED_MCP_TLS_SCOPE }),
+  );
+  return provisioned;
+}
+
+/**
+ * Enforce the managed source boundary before any TLS path is normalized or
+ * opened. The private provenance association survives normal config-object
+ * spreads because the provisioned `tls` value itself is preserved, but a
+ * caller cannot manufacture it from JSON or by setting `configScope`.
+ */
+export function assertManagedMcpTlsConfig(value, { configScope } = {}) {
+  if (value == null) return null;
+  const provenance =
+    value && typeof value === "object"
+      ? MANAGED_MCP_TLS_PROVENANCE.get(value)
+      : null;
+  if (
+    !provenance ||
+    configScope !== MANAGED_MCP_TLS_SCOPE ||
+    provenance.configScope !== MANAGED_MCP_TLS_SCOPE
+  ) {
+    throw managedTlsSourceRequiredError();
+  }
+  return value;
+}
+
 function readTlsFile(filePath, label, fsImpl) {
   if (!filePath) return null;
   let descriptor = null;
@@ -194,8 +258,29 @@ function updateDigestPart(hash, value) {
   hash.update(length).update(bytes);
 }
 
-export function loadMcpTlsMaterial(value, { fsImpl = fs } = {}) {
-  const config = normalizeMcpTlsConfig(value);
+function validateCertificateBytes(bytes) {
+  if (!bytes) return;
+  const text = bytes.toString("utf8");
+  const pemCertificates = text.match(
+    /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/gu,
+  );
+  if (pemCertificates?.length) {
+    for (const certificate of pemCertificates) new X509Certificate(certificate);
+    return;
+  }
+  new X509Certificate(bytes);
+}
+
+export function loadMcpTlsMaterial(
+  value,
+  {
+    configScope,
+    fsImpl = fs,
+    createSecureContextImpl = createSecureContext,
+    validateCertificateImpl = validateCertificateBytes,
+  } = {},
+) {
+  const config = assertManagedMcpTlsConfig(value, { configScope });
   if (!config) return null;
   const cert = readTlsFile(config.certFile, "certFile", fsImpl);
   const key = readTlsFile(config.keyFile, "keyFile", fsImpl);
@@ -207,6 +292,21 @@ export function loadMcpTlsMaterial(value, { fsImpl = fs } = {}) {
     ...(config.serverName ? { servername: config.serverName } : {}),
     rejectUnauthorized: config.rejectUnauthorized,
   };
+  try {
+    // Parse certificates and verify the client cert/key pair before creating a
+    // dispatcher or issuing any outbound request. Node/Undici would otherwise
+    // discover malformed or mismatched material only during a network dial.
+    validateCertificateImpl(cert);
+    validateCertificateImpl(ca);
+    createSecureContextImpl(connectOptions);
+  } catch {
+    // TLS parser diagnostics may quote attacker-controlled PEM text or paths.
+    // Keep the product error fixed and do not retain the parser error as cause.
+    throw tlsError(
+      "CC_MCP_TLS_MATERIAL_INVALID",
+      "MCP TLS certificate material is invalid or the client key does not match",
+    );
+  }
   const identityHash = createHash("sha256");
   updateDigestPart(identityHash, cert);
   updateDigestPart(identityHash, key);

package/src/lib/orchestrator.js

@@ -28,6 +28,17 @@ import { NotificationManager } from "./notifiers/index.js";
 import { createChatFn } from "./cowork-adapter.js";
 import { firstBalancedJson } from "./json-schema-output.js";
 import executionBroker from "./process-execution-broker/index.js";
+import runtimeClaimsContract from "@chainlesschain/session-core/runtime-claims";
+
+const { RUNTIME_MODE, createRuntimeClaims, hasTerminalSuccessEvidence } =
+  runtimeClaimsContract;
+
+const ORCHESTRATOR_RUNTIME_CLAIMS = createRuntimeClaims({
+  mode: RUNTIME_MODE.REAL_EXECUTION,
+  durable: false,
+  crashSafe: false,
+  isolatedWrites: false,
+});
 
 /* ---------- _deps injection (Vitest CJS mock pattern) ---------- */
 export const _deps = {
@@ -160,6 +171,8 @@ export class Orchestrator extends EventEmitter {
       ciErrors: [],
       createdAt: new Date().toISOString(),
       completedAt: null,
+      runtimeClaims: ORCHESTRATOR_RUNTIME_CLAIMS,
+      terminalEvidence: [],
     };
 
     this._tasks.set(task.id, task);
@@ -192,6 +205,8 @@ export class Orchestrator extends EventEmitter {
       source: t.source,
       retries: t.retries,
       createdAt: t.createdAt,
+      runtimeClaims: t.runtimeClaims,
+      terminalEvidence: t.terminalEvidence,
     }));
     return {
       tasks,
@@ -228,6 +243,7 @@ export class Orchestrator extends EventEmitter {
 
       // Step 2: Dispatch to Claude Code agents
       task.agentResults = await this._dispatch(task);
+      this._assertSuccessfulAgentResults(task);
 
       // Step 3: CI/CD check
       if (task.runCI) {
@@ -368,6 +384,7 @@ export class Orchestrator extends EventEmitter {
       task.agentResults = await this._router.dispatch(fixSubtasks, {
         cwd: task.cwd,
       });
+      this._assertSuccessfulAgentResults(task);
       this.emit("agents:complete", { task, results: task.agentResults });
     }
 
@@ -409,6 +426,36 @@ export class Orchestrator extends EventEmitter {
     }
   }
 
+  _assertSuccessfulAgentResults(task) {
+    if (!Array.isArray(task.agentResults) || task.agentResults.length === 0) {
+      throw new Error("Agent dispatch produced no terminal results");
+    }
+
+    const failed = [];
+    const evidence = [];
+    for (let index = 0; index < task.agentResults.length; index += 1) {
+      const result = task.agentResults[index];
+      const valid =
+        result?.success === true &&
+        hasTerminalSuccessEvidence(
+          result.runtimeClaims,
+          result.terminalEvidence,
+        );
+      if (!valid) {
+        failed.push(
+          `${result?.taskId || `result-${index}`}: ${result?.error || result?.status || "missing terminal evidence"}`,
+        );
+      } else {
+        evidence.push(...result.terminalEvidence);
+      }
+    }
+
+    if (failed.length > 0) {
+      throw new Error(`Agent execution did not succeed: ${failed.join("; ")}`);
+    }
+    task.terminalEvidence = evidence;
+  }
+
   /**
    * Bound retained task history to maxTasks. Evicts the oldest TERMINAL tasks
    * first (Map preserves insertion order = FIFO); an in-flight task is never