chainlesschain 0.165.6 → 0.165.9

package/src/lib/paths.js

@@ -1,49 +1,277 @@
+import { existsSync, lstatSync } from "node:fs";
 import { homedir } from "node:os";
-import { isAbsolute, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { CONFIG_DIR_NAME } from "../constants.js";
 import { getPlatform } from "./platform.js";
+import {
+  CLAUDE_CONFIG_DIR_ENV,
+  resolveClaudeProjectStorageDir,
+  usesClaudeConfigDirectory,
+} from "./claude-project-storage-layout.js";
 import {
   assertSafeOwnerOnlyPath,
   ensurePrivateDirectory,
   repairPrivatePaths,
 } from "./secure-fs.js";
 
+const securedClaudeProjectStorageEntries = new Map();
+
+function pathContains(parent, candidate) {
+  const relation = relative(parent, candidate);
+  return (
+    relation === "" ||
+    (!relation.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) &&
+      relation !== ".." &&
+      !isAbsolute(relation))
+  );
+}
+
+function nearestGitWorktreeRoot(cwd) {
+  let current = resolve(cwd);
+  for (;;) {
+    if (existsSync(join(current, ".git"))) return current;
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
+function configHomeError(message) {
+  const error = new Error(message);
+  error.code = "CONFIG_HOME_UNSAFE";
+  return error;
+}
+
+function isBroadSharedConfigRoot(resolvedHome, env) {
+  const platform = getPlatform();
+  const candidates =
+    platform === "win32"
+      ? [
+          "C:\\Users",
+          "C:\\Users\\Public",
+          "C:\\Windows",
+          "C:\\ProgramData",
+          "C:\\Program Files",
+          "C:\\Program Files (x86)",
+          env?.PUBLIC,
+          env?.ProgramData,
+          env?.PROGRAMDATA,
+          env?.SystemRoot,
+          env?.WINDIR,
+        ]
+      : [
+          "/tmp",
+          "/var/tmp",
+          "/usr",
+          "/etc",
+          "/var",
+          "/home",
+          "/root",
+          "/run",
+          "/opt",
+          "/srv",
+          "/mnt",
+          "/media",
+        ];
+  return candidates.some((candidate) => {
+    if (typeof candidate !== "string" || !candidate) return false;
+    try {
+      const normalized = resolve(candidate);
+      return platform === "win32"
+        ? normalized.toLowerCase() === resolvedHome.toLowerCase()
+        : normalized === resolvedHome;
+    } catch {
+      return false;
+    }
+  });
+}
+
+/**
+ * Reject broad shared directories before any owner-only chmod/DACL repair.
+ * Unlike the generic secure-fs guard, config/data roots are high-value and
+ * must never target a shared system parent such as C:\\Users or /home.
+ */
+export function assertSafeConfigDataRoot(dirPath, options = {}) {
+  const resolvedPath = resolve(dirPath);
+  if (isBroadSharedConfigRoot(resolvedPath, options.env || process.env)) {
+    throw configHomeError(
+      "Config/data root must not be a broad shared system directory",
+    );
+  }
+  assertSafeOwnerOnlyPath(resolvedPath);
+  return resolvedPath;
+}
+
+function resolveConfiguredHome(configured, variableName, cwd, env) {
+  const windowsLiteral = configured.replaceAll("/", "\\");
+  if (
+    windowsLiteral.startsWith("\\\\?\\") ||
+    windowsLiteral.startsWith("\\\\.\\")
+  ) {
+    throw configHomeError(
+      `${variableName} must not use a Windows device namespace`,
+    );
+  }
+  if (!isAbsolute(configured)) {
+    throw configHomeError(
+      `${variableName} must be an absolute path for owner-only storage`,
+    );
+  }
+  const resolvedHome = resolve(configured);
+  try {
+    assertSafeConfigDataRoot(resolvedHome, { env });
+  } catch (error) {
+    if (error?.code === "CONFIG_HOME_UNSAFE") throw error;
+    throw configHomeError(
+      `${variableName} must not be a broad shared system directory`,
+    );
+  }
+  const resolvedCwd = resolve(cwd);
+  const worktreeRoot = nearestGitWorktreeRoot(resolvedCwd);
+  if (
+    pathContains(resolvedHome, resolvedCwd) ||
+    pathContains(resolvedCwd, resolvedHome) ||
+    (worktreeRoot &&
+      (pathContains(worktreeRoot, resolvedHome) ||
+        pathContains(resolvedHome, worktreeRoot)))
+  ) {
+    throw configHomeError(
+      `${variableName} must not be the current working directory, its worktree, or any nested/ancestor path`,
+    );
+  }
+  // This is deliberately a no-IO validation. Directory creation/ACL repair
+  // remains in ensureHomeDir(), but broad roots and device aliases are refused
+  // before any caller can ask the secure-fs layer to mutate them.
+  return resolvedHome;
+}
+
+/**
+ * Resolve the CLI's authoritative config/data root. CHAINLESSCHAIN_HOME is a
+ * native explicit override and takes precedence over CLAUDE_CONFIG_DIR; the
+ * latter is only a compatible fallback for an otherwise unconfigured CLI.
+ */
+export function resolveConfigDataRoot(options = {}) {
+  const env = options.env || process.env;
+  const cwd = options.cwd || process.cwd();
+  const nativeHome = env.CHAINLESSCHAIN_HOME;
+  if (nativeHome) {
+    return Object.freeze({
+      path: resolveConfiguredHome(nativeHome, "CHAINLESSCHAIN_HOME", cwd, env),
+      source: "chainlesschain",
+    });
+  }
+  if (usesClaudeConfigDirectory(env)) {
+    const configured = env[CLAUDE_CONFIG_DIR_ENV].trim();
+    return Object.freeze({
+      path: resolveConfiguredHome(configured, CLAUDE_CONFIG_DIR_ENV, cwd, env),
+      source: "claude",
+    });
+  }
+  return Object.freeze({
+    path: join(homedir(), CONFIG_DIR_NAME),
+    source: "default",
+  });
+}
+
 export function getHomeDir() {
-  const configured = process.env.CHAINLESSCHAIN_HOME;
-  if (configured) {
-    const windowsLiteral = configured.replaceAll("/", "\\");
-    if (
-      windowsLiteral.startsWith("\\\\?\\") ||
-      windowsLiteral.startsWith("\\\\.\\")
-    ) {
-      const error = new Error(
-        "CHAINLESSCHAIN_HOME must not use a Windows device namespace",
-      );
-      error.code = "CONFIG_HOME_UNSAFE";
-      throw error;
+  return resolveConfigDataRoot().path;
+}
+
+/**
+ * Claude-compatible session storage is opt-in and only activates when the
+ * launcher supplied both CLAUDE_CONFIG_DIR and a safe project directory name.
+ * Legacy callers continue to use `<home>/sessions`.
+ */
+export function getClaudeProjectStorageDir(options = {}) {
+  const env = options.env || process.env;
+  const root = resolveConfigDataRoot({ ...options, env });
+  if (root.source !== "claude") return null;
+  return resolveClaudeProjectStorageDir(root.path, { env });
+}
+
+export function getSessionStoreDir(options = {}) {
+  return (
+    getClaudeProjectStorageDir(options) ||
+    join(resolveConfigDataRoot(options).path, "sessions")
+  );
+}
+
+/**
+ * Secure a Claude-compatible project storage tree without trusting inherited
+ * Windows ACLs on pre-existing descendants.  The config root is repaired
+ * first, then every child is created below that verified boundary and repaired
+ * together in one Windows ACL batch.  This keeps the security invariant while
+ * avoiding a PowerShell process for every storage subdirectory.
+ */
+export function ensureClaudeProjectStorageTree(
+  homeDir,
+  projectDir,
+  options = {},
+) {
+  const home = resolve(homeDir);
+  const projectsDir = join(home, "projects");
+  const project = resolve(projectDir);
+  const extraDirectories = Array.isArray(options.extraDirectories)
+    ? options.extraDirectories.map((entry) => resolve(entry))
+    : [];
+  if (!pathContains(projectsDir, project) || project === projectsDir) {
+    throw configHomeError(
+      "Claude project storage path must remain below projects",
+    );
+  }
+  if (extraDirectories.some((entry) => !pathContains(project, entry))) {
+    throw configHomeError(
+      "Claude project storage descendants must remain below the project root",
+    );
+  }
+
+  ensurePrivateDirectory(home, {
+    applyWindowsAcl: true,
+    failIfUnavailable: true,
+  });
+  const descendants = [projectsDir, project, ...extraDirectories];
+  if (getPlatform() === "win32") {
+    const repairTargets = [];
+    for (const directory of descendants) {
+      ensurePrivateDirectory(directory, {
+        applyWindowsAcl: false,
+        failIfUnavailable: true,
+      });
+      let current = null;
+      try {
+        const entry = lstatSync(directory);
+        current = `${entry.dev}:${entry.ino}`;
+      } catch {
+        // ensurePrivateDirectory above either created the directory or threw;
+        // retain a fail-closed repair target if a filesystem race removed it.
+      }
+      // The secure-fs layer caches verified Windows ACLs per path. Keep a
+      // matching tree cache so repeated session writes do not re-run a batch,
+      // but force a repair whenever this helper first observes a descendant.
+      if (securedClaudeProjectStorageEntries.get(directory) !== current) {
+        repairTargets.push(directory);
+      }
     }
-    if (!isAbsolute(configured)) {
-      const error = new Error(
-        "CHAINLESSCHAIN_HOME must be an absolute path for owner-only storage",
-      );
-      error.code = "CONFIG_HOME_UNSAFE";
-      throw error;
+    if (repairTargets.length > 0) {
+      // A private parent is not proof that an older child has no broad explicit
+      // ACE. Repair all newly observed descendants in one fail-closed batch.
+      repairPrivatePaths(repairTargets, { platform: "win32" });
+      for (const directory of repairTargets) {
+        securedClaudeProjectStorageEntries.set(
+          directory,
+          (() => {
+            const entry = lstatSync(directory);
+            return `${entry.dev}:${entry.ino}`;
+          })(),
+        );
+      }
     }
-    const resolvedHome = resolve(configured);
-    const relativeCwd = relative(resolvedHome, resolve(process.cwd()));
-    if (
-      relativeCwd === "" ||
-      (!relativeCwd.startsWith("..") && !isAbsolute(relativeCwd))
-    ) {
-      const error = new Error(
-        "CHAINLESSCHAIN_HOME must not be the current working directory or one of its ancestors",
-      );
-      error.code = "CONFIG_HOME_UNSAFE";
-      throw error;
+  } else {
+    for (const directory of descendants) {
+      ensurePrivateDirectory(directory, { failIfUnavailable: true });
     }
-    return configured;
   }
-  return join(homedir(), CONFIG_DIR_NAME);
+  return project;
 }
 
 export function getBinDir() {

package/src/lib/permission-request.js

@@ -0,0 +1,48 @@
+/**
+ * Canonicalize the part of a tool request that is classified and shown to the
+ * user for approval. Keeping this in one place prevents the safety classifier
+ * and the permission prompt from silently reasoning about different inputs.
+ */
+
+function quoteArgvToken(value) {
+  const token = String(value);
+  if (token && !/[\s|;&"'\\]/u.test(token)) return token;
+  return `"${token.replace(/\\/gu, "\\\\").replace(/"/gu, '\\"')}"`;
+}
+
+export function normalizePermissionRequest({ tool, args } = {}) {
+  const normalizedArgs = args && typeof args === "object" ? args : {};
+  const command =
+    typeof normalizedArgs.command === "string"
+      ? normalizedArgs.command
+      : Array.isArray(normalizedArgs.argv)
+        ? normalizedArgs.argv.map(quoteArgvToken).join(" ")
+        : "";
+  const source = String(
+    normalizedArgs.path ??
+      normalizedArgs.file_path ??
+      normalizedArgs.source ??
+      normalizedArgs.from ??
+      "",
+  );
+  const destination = String(
+    normalizedArgs.destination ??
+      normalizedArgs.new_path ??
+      normalizedArgs.to ??
+      "",
+  );
+  const detail =
+    command ||
+    (source && destination
+      ? `${source} -> ${destination}`
+      : source || destination);
+
+  return Object.freeze({
+    tool: String(tool || "unknown").trim() || "unknown",
+    args: normalizedArgs,
+    command,
+    source,
+    destination,
+    detail,
+  });
+}

package/src/lib/plugin-runtime/bin.js

@@ -81,7 +81,9 @@ export function collectPluginBinCommands(opts = {}) {
     }
     return [];
   }
-  const { trusted, skipped } = partitionByTrust(plugins);
+  const { trusted, skipped } = partitionByTrust(plugins, {
+    workspaceRoot: opts.cwd,
+  });
   warnUntrustedOnce(
     skipped
       .filter((p) => p.manifest?.components?.bin?.length)

package/src/lib/plugin-runtime/hooks.js

@@ -215,7 +215,9 @@ export function collectPluginHooks(opts = {}) {
   }
   // A hook runs a shell command — gate it behind trust so a cloned repo's
   // project plugin can't run commands the moment the agent starts.
-  const { trusted, skipped } = partitionByTrust(plugins);
+  const { trusted, skipped } = partitionByTrust(plugins, {
+    workspaceRoot: opts.cwd,
+  });
   warnUntrustedOnce(
     skipped.filter((p) => p.manifest?.components?.hooks).map((p) => p.name),
     "hooks",

package/src/lib/plugin-runtime/install.js

@@ -326,6 +326,10 @@ export function installFromDirectory(srcDir, opts = {}) {
     // and may ship its own `.plugin-lock.json` or provenance metadata.
     _deps.rmSync(path.join(staged, LOCK_FILENAME), { force: true });
     _deps.rmSync(path.join(staged, SOURCE_METADATA_FILENAME), { force: true });
+    assertStagedRegistryCommandPayload(
+      staged,
+      opts[SOURCE_POLICY_PREFLIGHT]?.registryAuthority,
+    );
 
     const remoteSbomPayloadComparison = buildRemoteSbomPayloadComparison({
       remoteArtifactEvidence:
@@ -657,6 +661,19 @@ function preflightManagedSource(source, opts, action, options = {}) {
         );
       }
     }
+    if (registryAuthority.sourceType === "command") {
+      const command = opts.sourceMetadata.catalogAuthority?.commandSource;
+      if (
+        !command ||
+        command.descriptorIdentity !== registryAuthority.declaredSource ||
+        command.payloadSha256 !== registryAuthority.payloadSha256 ||
+        command.mode !== registryAuthority.commandMode
+      ) {
+        throw new Error(
+          "registry source authority does not match command source authority",
+        );
+      }
+    }
   }
   // Resolve managed identity before exists/clone/cache/process work. The
   // manifest name is checked again by installFromDirectory after materializing
@@ -693,6 +710,7 @@ function preflightManagedSource(source, opts, action, options = {}) {
     decision,
     materialized,
     sourceAuthority,
+    registryAuthority,
   };
   const boundSourceMetadata = opts.sourceMetadata
     ? bindSourcePolicyAuthority(opts.sourceMetadata, {
@@ -3638,7 +3656,16 @@ function normalizeSourceMetadata(value) {
             value.resolvedSource,
             catalogAuthority.archiveSource,
           )
-        : pluginSourceAuthorityDigest(value.resolvedSource, "git", value.ref)
+        : catalogAuthority?.commandSource
+          ? commandSourceAuthorityDigest(
+              value.resolvedSource,
+              catalogAuthority.commandSource,
+            )
+          : pluginSourceAuthorityDigest(
+              value.resolvedSource,
+              "git",
+              value.ref,
+            )
       : null);
   const policyDigest = normalizeSourceAuthorityDigest(value.policyDigest);
   if (resolvedSourceDigest) {
@@ -3650,6 +3677,7 @@ function normalizeSourceMetadata(value) {
   if (catalogAuthority) metadata.catalogAuthority = catalogAuthority;
   assertCatalogRemoteArtifactBindings(metadata);
   assertCatalogArchiveSourceBindings(metadata);
+  assertCatalogCommandSourceBindings(metadata);
   return metadata;
 }
 
@@ -3681,6 +3709,20 @@ function assertCatalogArchiveSourceBindings(metadata) {
   }
 }
 
+function assertCatalogCommandSourceBindings(metadata) {
+  const command = metadata.catalogAuthority?.commandSource;
+  if (!command) return;
+  if (
+    metadata.type !== "registry" ||
+    !metadata.registry ||
+    metadata.resolvedSource !== command.descriptorIdentity
+  ) {
+    throw new Error(
+      "marketplace command authority requires matching registry source metadata",
+    );
+  }
+}
+
 function normalizeSourceAuthorityDigest(value) {
   const normalized = cleanBounded(value, 64)?.toLowerCase() || null;
   return normalized && /^[a-f0-9]{64}$/u.test(normalized) ? normalized : null;
@@ -3718,11 +3760,28 @@ function archiveSourceAuthorityDigest(source, archive) {
     .digest("hex");
 }
 
+function commandSourceAuthorityDigest(source, command) {
+  return crypto
+    .createHash("sha256")
+    .update(
+      canonicalJson({
+        kind: "command",
+        descriptorIdentity: sanitizeSource(source),
+        mode: command.mode || command.commandMode || null,
+        payloadSha256: command.payloadSha256 || null,
+      }),
+    )
+    .digest("hex");
+}
+
 function registryResolvedSourceAuthorityDigest(authority) {
   if (!authority) return null;
   if (authority.sourceType === "archive") {
     return archiveSourceAuthorityDigest(authority.declaredSource, authority);
   }
+  if (authority.sourceType === "command") {
+    return commandSourceAuthorityDigest(authority.declaredSource, authority);
+  }
   return pluginSourceAuthorityDigest(
     authority.declaredSource,
     "git",
@@ -4030,6 +4089,12 @@ function normalizeCatalogAuthority(value) {
     value.remoteArtifactEvidence,
   );
   const archiveSource = normalizeArchiveSourceAuthority(value.archiveSource);
+  const commandSource = normalizeCommandSourceAuthority(value.commandSource);
+  if (archiveSource && commandSource) {
+    throw new Error(
+      "catalogAuthority cannot combine archive and command source authority",
+    );
+  }
   const remoteSbomPayloadComparison = assertRemoteSbomPayloadComparison(
     value.remoteSbomPayloadComparison,
     {
@@ -4137,6 +4202,7 @@ function normalizeCatalogAuthority(value) {
     ...(artifactExpectations ? { artifactExpectations } : {}),
     ...(remoteArtifactEvidence ? { remoteArtifactEvidence } : {}),
     ...(archiveSource ? { archiveSource } : {}),
+    ...(commandSource ? { commandSource } : {}),
     ...(remoteSbomPayloadComparison ? { remoteSbomPayloadComparison } : {}),
     ...(publisherDeclaration ? { publisherDeclaration } : {}),
     ...(publisherAuthority ? { publisherAuthority } : {}),
@@ -4213,6 +4279,42 @@ function normalizeArchiveSourceAuthority(value) {
   };
 }
 
+function normalizeCommandSourceAuthority(value) {
+  if (value == null) return null;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("catalogAuthority.commandSource must be an object");
+  }
+  const descriptorIdentity = cleanBounded(value.descriptorIdentity, 128);
+  const payloadSha256 = cleanBounded(value.payloadSha256, 64)?.toLowerCase();
+  const mode = value.mode;
+  const fileCount = Number(value.fileCount);
+  const totalBytes = Number(value.totalBytes);
+  if (
+    value.schemaVersion !== "cc-plugin-marketplace-command-source/v1" ||
+    value.status !== "descriptor-executed-and-verified" ||
+    !/^command:[a-f0-9]{32}$/u.test(descriptorIdentity || "") ||
+    !/^[a-f0-9]{64}$/u.test(payloadSha256 || "") ||
+    !["copy", "link"].includes(mode) ||
+    !Number.isSafeInteger(fileCount) ||
+    fileCount <= 0 ||
+    fileCount > 10_000 ||
+    !Number.isSafeInteger(totalBytes) ||
+    totalBytes <= 0 ||
+    totalBytes > 256 * 1024 * 1024
+  ) {
+    throw new Error("catalogAuthority.commandSource authority is invalid");
+  }
+  return {
+    schemaVersion: value.schemaVersion,
+    status: value.status,
+    descriptorIdentity,
+    mode,
+    payloadSha256,
+    fileCount,
+    totalBytes,
+  };
+}
+
 function normalizeArtifactExpectations(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const digest = (candidate, label) => {
@@ -4618,6 +4720,20 @@ function writeDurableFileAtomic(directory, target, value) {
   }
 }
 
+function assertStagedRegistryCommandPayload(staged, authority) {
+  if (authority?.sourceType !== "command") return;
+  const payload = buildMarketplacePayloadSbom(staged);
+  if (
+    payload.digest !== authority.payloadSha256 ||
+    payload.fileCount !== authority.fileCount ||
+    payload.totalBytes !== authority.totalBytes
+  ) {
+    throw new Error(
+      "registry command source payload changed before immutable installation",
+    );
+  }
+}
+
 /**
  * Copy `src` → `dst`, refusing to write outside `root` and skipping symlinks
  * (which could later resolve outside the plugin sandbox). Directories recurse.

package/src/lib/plugin-runtime/lsp.js

@@ -63,7 +63,9 @@ export function ensurePluginLspServers(opts = {}) {
 
   // An LSP server spawns a binary — gate it behind trust. Untrusted project
   // plugins (e.g. from a cloned repo) don't get to launch processes silently.
-  const { trusted, skipped } = partitionByTrust(plugins);
+  const { trusted, skipped } = partitionByTrust(plugins, {
+    workspaceRoot: cwd,
+  });
   warnUntrustedOnce(
     skipped
       .filter((p) => (p.manifest?.components?.lsp || []).length > 0)
@@ -95,9 +97,7 @@ export function ensurePluginLspServers(opts = {}) {
           pluginId: p.name,
           pluginVersion: p.version,
           pluginSource: s.absPath || p.manifest.manifestPath,
-          ...(s.sandboxPolicy
-            ? { sandboxPolicy: s.sandboxPolicy }
-            : {}),
+          ...(s.sandboxPolicy ? { sandboxPolicy: s.sandboxPolicy } : {}),
         });
         registered.push({ plugin: p.name, languageId: s.languageId, id: s.id });
       } catch {