chainlesschain 0.165.6 → 0.165.9

package/src/lib/project-mcp-trust.js

@@ -22,8 +22,20 @@ import {
   mutateSecurityStore,
   readSecurityStore,
 } from "./durable-security-store.js";
+import {
+  checkRecordedWorkspaceTrust,
+  evaluateWorkspaceTrustDecision,
+  projectWorkspaceTrustAudit,
+  recordWorkspaceTrustConsent,
+  resolveCanonicalWorkspaceRepoIdentity,
+  workspaceTrustPathSubject,
+} from "./workspace-trust.js";
 
-export const _deps = { withFileLock };
+export const _deps = {
+  withFileLock,
+  // Test-only seam. Production uses workspace-trust.js's one shared ledger.
+  workspaceTrustStorePath: () => null,
+};
 const workspaceAuthorities = new WeakMap();
 
 function storePath(opts = {}) {
@@ -38,6 +50,62 @@ export function projectMcpFingerprint(content) {
   return createHash("sha256").update(String(content), "utf-8").digest("hex");
 }
 
+const PROJECT_MCP_WORKSPACE_TRUST_SOURCE = "project-mcp";
+
+function workspaceTrustStoreOptions(opts = {}) {
+  const store =
+    opts.workspaceTrustStorePath ||
+    process.env.CC_WORKSPACE_TRUST_STORE ||
+    _deps.workspaceTrustStorePath() ||
+    // Custom source-store callers (notably isolated tests) get an adjacent
+    // shared ledger. Normal CLI calls omit storePath and therefore use the
+    // single workspace-trust.js default shared by all entry points.
+    (opts.storePath
+      ? path.join(path.dirname(opts.storePath), "workspace-trust-v1.json")
+      : null);
+  return store ? { storePath: store } : {};
+}
+
+function projectMcpWorkspaceTrustContext(file, content, opts = {}) {
+  const identity = resolveCanonicalWorkspaceRepoIdentity(
+    opts.workspaceRoot || path.dirname(file),
+  );
+  const subject = workspaceTrustPathSubject(identity, file);
+  const fingerprint = projectMcpFingerprint(content);
+  return { identity, subject, fingerprint };
+}
+
+function projectMcpWorkspaceRecordKey(context) {
+  const subjectDigest = createHash("sha256")
+    .update(context.subject, "utf8")
+    .digest("hex");
+  return `workspace-v1:${context.identity.workspaceId}:${subjectDigest}`;
+}
+
+function projectMcpDecision(status, context) {
+  const decision = evaluateWorkspaceTrustDecision({
+    identity: context.identity,
+    evidence: [
+      {
+        source: PROJECT_MCP_WORKSPACE_TRUST_SOURCE,
+        consent: status === "trusted" ? "explicit" : "missing",
+        fingerprint: context.fingerprint,
+        decision:
+          status === "trusted"
+            ? "allow"
+            : status === "first-use"
+              ? "ask"
+              : "deny",
+      },
+    ],
+  });
+  return {
+    status,
+    fingerprint: context.fingerprint,
+    workspaceTrust: projectWorkspaceTrustAudit(decision),
+  };
+}
+
 /**
  * Issue an in-process authority only after the caller has verified the exact
  * project file fingerprint. Plain config fields cannot forge this token.
@@ -50,7 +118,23 @@ export function issueProjectMcpWorkspaceAuthority({
   config = {},
 }) {
   const canonicalFile = fs.realpathSync.native(path.resolve(file));
-  const canonicalRoot = fs.realpathSync.native(path.resolve(workspaceRoot));
+  const workspaceIdentity =
+    resolveCanonicalWorkspaceRepoIdentity(workspaceRoot);
+  const canonicalRoot = workspaceIdentity.canonicalWorkspaceRoot;
+  const trustDecision = evaluateWorkspaceTrustDecision({
+    identity: workspaceIdentity,
+    evidence: [
+      {
+        source: PROJECT_MCP_WORKSPACE_TRUST_SOURCE,
+        consent: "host-bound",
+        fingerprint: projectMcpFingerprint(content),
+        decision: "allow",
+      },
+    ],
+  });
+  if (trustDecision.decision !== "allow") {
+    throw new Error("project MCP workspace identity is unavailable");
+  }
   const token = Object.freeze({});
   workspaceAuthorities.set(
     token,
@@ -58,6 +142,9 @@ export function issueProjectMcpWorkspaceAuthority({
       file: canonicalFile,
       fingerprint: projectMcpFingerprint(content),
       workspaceRoot: canonicalRoot,
+      workspaceId: workspaceIdentity.workspaceId,
+      repositoryId: workspaceIdentity.repositoryId,
+      workspaceTrust: projectWorkspaceTrustAudit(trustDecision),
       serverName: String(serverName || ""),
       url: typeof config.url === "string" ? config.url : "",
       transport: typeof config.transport === "string" ? config.transport : "",
@@ -100,6 +187,19 @@ export function resolveProjectMcpWorkspaceAuthority(token, expected = {}) {
   ) {
     return null;
   }
+  try {
+    const currentIdentity = resolveCanonicalWorkspaceRepoIdentity(
+      record.workspaceRoot,
+    );
+    if (
+      currentIdentity.workspaceId !== record.workspaceId ||
+      currentIdentity.repositoryId !== record.repositoryId
+    ) {
+      return null;
+    }
+  } catch {
+    return null;
+  }
   return record.workspaceRoot;
 }
 
@@ -112,29 +212,84 @@ function readStore(opts) {
  * @returns {{status:"first-use"|"trusted"|"changed", fingerprint:string}}
  */
 export function checkProjectMcpTrust(file, content, opts = {}) {
-  const fingerprint = projectMcpFingerprint(content);
-  const record = readStore(opts)[path.resolve(file)];
-  if (!record || !record.fingerprint) {
-    return { status: "first-use", fingerprint };
+  const context = projectMcpWorkspaceTrustContext(file, content, opts);
+  const store = readStore(opts);
+  const record = store[projectMcpWorkspaceRecordKey(context)];
+  const legacyRecord = store[path.resolve(file)];
+  if (!record || typeof record !== "object" || Array.isArray(record)) {
+    // A pre-v1 path-keyed grant cannot be shown to bind the current canonical
+    // workspace identity.  Treat it as changed rather than silently widening
+    // it; the existing explicit re-trust path records the v1 intersection.
+    const shared = checkRecordedWorkspaceTrust({
+      identity: context.identity,
+      source: PROJECT_MCP_WORKSPACE_TRUST_SOURCE,
+      subject: context.subject,
+      evidenceFingerprint: context.fingerprint,
+      ...workspaceTrustStoreOptions(opts),
+    });
+    return {
+      status:
+        legacyRecord?.fingerprint || shared.status === "changed"
+          ? "changed"
+          : "first-use",
+      fingerprint: context.fingerprint,
+      workspaceTrust: shared.audit,
+    };
+  }
+  const binding = record.workspaceTrust;
+  if (
+    record.fingerprint !== context.fingerprint ||
+    !binding ||
+    binding.workspaceId !== context.identity.workspaceId ||
+    binding.repositoryId !== context.identity.repositoryId ||
+    binding.subject !== context.subject
+  ) {
+    return projectMcpDecision("changed", context);
   }
+  const shared = checkRecordedWorkspaceTrust({
+    identity: context.identity,
+    source: PROJECT_MCP_WORKSPACE_TRUST_SOURCE,
+    subject: context.subject,
+    evidenceFingerprint: context.fingerprint,
+    ...workspaceTrustStoreOptions(opts),
+  });
   return {
-    status: record.fingerprint === fingerprint ? "trusted" : "changed",
-    fingerprint,
+    status: shared.status === "trusted" ? "trusted" : "changed",
+    fingerprint: context.fingerprint,
+    workspaceTrust: shared.audit,
   };
 }
 
 /** Record (or re-record) the trusted fingerprint for a file. */
 export function recordProjectMcpTrust(file, content, opts = {}) {
   const target = storePath(opts);
+  const context = projectMcpWorkspaceTrustContext(file, content, opts);
+  // Persist the shared record first.  If the legacy/source-specific store
+  // fails afterwards, the checker still requires both records and therefore
+  // cannot accidentally authorize from the shared ledger alone.
+  recordWorkspaceTrustConsent({
+    identity: context.identity,
+    source: PROJECT_MCP_WORKSPACE_TRUST_SOURCE,
+    subject: context.subject,
+    evidenceFingerprint: context.fingerprint,
+    consent: "explicit",
+    ...workspaceTrustStoreOptions(opts),
+  });
   return mutateSecurityStore(
     target,
     "project MCP trust",
     (store) => {
-      store[path.resolve(file)] = {
-        fingerprint: projectMcpFingerprint(content),
+      store[projectMcpWorkspaceRecordKey(context)] = {
+        fingerprint: context.fingerprint,
         trustedAt: new Date(
           typeof opts.now === "number" ? opts.now : Date.now(),
         ).toISOString(),
+        workspaceTrust: {
+          schemaVersion: context.identity.schemaVersion,
+          workspaceId: context.identity.workspaceId,
+          repositoryId: context.identity.repositoryId,
+          subject: context.subject,
+        },
       };
       return true;
     },

package/src/lib/resume-session.js

@@ -6,10 +6,12 @@
 
 import fs from "fs";
 import path from "path";
-import os from "os";
 import { logger } from "./logger.js";
+import { getSessionStoreDir } from "./paths.js";
 
-const SESSION_DIR = path.join(os.homedir(), ".chainlesschain", "sessions");
+function sessionDir() {
+  return getSessionStoreDir();
+}
 
 /**
  * List recent chat sessions
@@ -18,15 +20,16 @@ const SESSION_DIR = path.join(os.homedir(), ".chainlesschain", "sessions");
  */
 export function listSessions(limit = 10) {
   try {
-    if (!fs.existsSync(SESSION_DIR)) {
+    const directory = sessionDir();
+    if (!fs.existsSync(directory)) {
       return [];
     }
 
     const files = fs
-      .readdirSync(SESSION_DIR)
+      .readdirSync(directory)
       .filter((f) => f.endsWith(".json"))
       .map((f) => {
-        const filePath = path.join(SESSION_DIR, f);
+        const filePath = path.join(directory, f);
         const stat = fs.statSync(filePath);
         let summary = "";
         try {
@@ -59,7 +62,7 @@ export function listSessions(limit = 10) {
  */
 export function loadSession(sessionId) {
   try {
-    const filePath = path.join(SESSION_DIR, `${sessionId}.json`);
+    const filePath = path.join(sessionDir(), `${sessionId}.json`);
     if (!fs.existsSync(filePath)) {
       return null;
     }

package/src/lib/session-core-singletons.js

@@ -10,6 +10,10 @@
 import { join } from "node:path";
 import { promises as fsp, existsSync, mkdirSync } from "node:fs";
 import { getHomeDir } from "./paths.js";
+import {
+  ensureTrustedSessionLifecycleScope,
+  resolveTrustedSessionLifecycleScope,
+} from "./session-lifecycle-scope.js";
 import {
   MemoryStore,
   BetaFlags,
@@ -26,7 +30,10 @@ import {
 let _memoryStore = null;
 let _betaFlags = null;
 let _approvalGate = null;
-let _sessionManager = null;
+// SessionManager owns live handles as well as its parked-session sidecar. A
+// Claude project bucket must therefore receive a separate in-process manager
+// even when another project happens to reuse the same session id.
+const _sessionManagersByScope = new Map();
 
 export function getMemoryStorePath() {
   return join(getHomeDir(), "memory-store.json");
@@ -67,12 +74,14 @@ export async function getApprovalGate() {
   return _approvalGate;
 }
 
-export function getParkedSessionsPath() {
-  return join(getHomeDir(), "parked-sessions.json");
+export function getParkedSessionsPath(options = {}) {
+  return resolveTrustedSessionLifecycleScope(options).parkedSessionsPath;
 }
 
-function createParkedSessionsStore(filePath) {
+function createParkedSessionsStore(filePath, options = {}) {
+  const ensureDirectory = options.ensureDirectory || null;
   async function readAll() {
+    ensureDirectory?.();
     try {
       const raw = await fsp.readFile(filePath, "utf8");
       return JSON.parse(raw || "{}");
@@ -81,6 +90,7 @@ function createParkedSessionsStore(filePath) {
     }
   }
   async function writeAll(map) {
+    ensureDirectory?.();
     const dir = join(filePath, "..");
     if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
     await fsp.writeFile(filePath, JSON.stringify(map, null, 2), "utf8");
@@ -106,12 +116,17 @@ function createParkedSessionsStore(filePath) {
   };
 }
 
-export function getSessionManager() {
-  if (_sessionManager) return _sessionManager;
-  const store = createParkedSessionsStore(getParkedSessionsPath());
-  _sessionManager = new SessionManager({ store });
-  _sessionManager._parkedStore = store;
-  return _sessionManager;
+export function getSessionManager(options = {}) {
+  const scope = resolveTrustedSessionLifecycleScope(options);
+  const existing = _sessionManagersByScope.get(scope.key);
+  if (existing) return existing;
+  const store = createParkedSessionsStore(scope.parkedSessionsPath, {
+    ensureDirectory: () => ensureTrustedSessionLifecycleScope(scope),
+  });
+  const manager = new SessionManager({ store });
+  manager._parkedStore = store;
+  _sessionManagersByScope.set(scope.key, manager);
+  return manager;
 }
 
 export function createStreamRouter() {
@@ -122,7 +137,7 @@ export function resetSessionCoreSingletonsForTests() {
   _memoryStore = null;
   _betaFlags = null;
   _approvalGate = null;
-  _sessionManager = null;
+  _sessionManagersByScope.clear();
 }
 
 // =====================================================================

package/src/lib/session-host-lease.js

@@ -12,7 +12,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
-import { getStatePath } from "./paths.js";
+import * as cliPaths from "./paths.js";
 import {
   mutateSecurityStore,
   readSecurityStore,
@@ -291,7 +291,28 @@ function publicRevocation(record, replayed) {
 }
 
 export function getSessionHostLeaseRoot() {
-  return path.join(getStatePath(), "session-host-leases");
+  const projectDir =
+    typeof cliPaths.getClaudeProjectStorageDir === "function"
+      ? cliPaths.getClaudeProjectStorageDir()
+      : null;
+  if (projectDir) {
+    const stateRoot = path.join(projectDir, "session-host-leases");
+    // The caller did not supply this location; it is derived exclusively from
+    // the validated launch environment. Establish the same private project
+    // tree for host leases that JSONL uses for transcripts.
+    if (
+      typeof cliPaths.getHomeDir === "function" &&
+      typeof cliPaths.ensureClaudeProjectStorageTree === "function"
+    ) {
+      cliPaths.ensureClaudeProjectStorageTree(
+        cliPaths.getHomeDir(),
+        projectDir,
+        { extraDirectories: [stateRoot] },
+      );
+    }
+    return stateRoot;
+  }
+  return path.join(cliPaths.getStatePath(), "session-host-leases");
 }
 
 export class SessionHostLeaseAuthority {
@@ -970,14 +991,27 @@ export class SessionHostLeaseAuthority {
   }
 }
 
-const defaultAuthority = new SessionHostLeaseAuthority();
+const scopedAuthorities = new Map();
+
+function authorityFor(options = {}) {
+  const stateRoot = path.resolve(
+    options?.stateRoot || getSessionHostLeaseRoot(),
+  );
+  let authority = scopedAuthorities.get(stateRoot);
+  if (!authority) {
+    authority = new SessionHostLeaseAuthority({ stateRoot });
+    scopedAuthorities.set(stateRoot, authority);
+  }
+  return authority;
+}
 
 export function acquireSessionHostLease(sessionId, options) {
-  return defaultAuthority.acquire(sessionId, options);
+  const { stateRoot = null, ...leaseOptions } = options || {};
+  return authorityFor({ stateRoot }).acquire(sessionId, leaseOptions);
 }
 
-export function withSessionHostWriteAuthority(sessionId, task) {
-  return defaultAuthority.withWriteAuthority(sessionId, task);
+export function withSessionHostWriteAuthority(sessionId, task, options = {}) {
+  return authorityFor(options).withWriteAuthority(sessionId, task);
 }
 
 export function createSessionHostWriteDelegation(lease) {
@@ -990,23 +1024,24 @@ export function withSessionHostDelegatedWriteAuthority(
   task,
   options,
 ) {
-  return defaultAuthority.withDelegatedWriteAuthority(
+  const { stateRoot = null, ...delegationOptions } = options || {};
+  return authorityFor({ stateRoot }).withDelegatedWriteAuthority(
     sessionId,
     delegation,
     task,
-    options,
+    delegationOptions,
   );
 }
 
 export function withSessionHostRecoveryLease(
   sessionId,
   task,
-  { hostKind = "background-recovery" } = {},
+  { hostKind = "background-recovery", stateRoot = null } = {},
 ) {
   if (typeof task !== "function") {
     throw new TypeError("session host recovery callback is required");
   }
-  const lease = acquireSessionHostLease(sessionId, { hostKind });
+  const lease = acquireSessionHostLease(sessionId, { hostKind, stateRoot });
   try {
     const result = task(lease);
     if (result && typeof result.then === "function") {
@@ -1018,17 +1053,18 @@ export function withSessionHostRecoveryLease(
   }
 }
 
-export function assertSessionHostWriteAuthority(sessionId) {
-  return defaultAuthority.withWriteAuthority(
+export function assertSessionHostWriteAuthority(sessionId, options = {}) {
+  return authorityFor(options).withWriteAuthority(
     sessionId,
     (authority) => authority,
   );
 }
 
-export function readSessionHostAuthority(sessionId) {
-  return defaultAuthority.readAuthority(sessionId);
+export function readSessionHostAuthority(sessionId, options = {}) {
+  return authorityFor(options).readAuthority(sessionId);
 }
 
-export function revokeSessionHostAuthority(sessionId, options) {
-  return defaultAuthority.revoke(sessionId, options);
+export function revokeSessionHostAuthority(sessionId, options = {}) {
+  const { stateRoot = null, ...revocationOptions } = options;
+  return authorityFor({ stateRoot }).revoke(sessionId, revocationOptions);
 }

package/src/lib/session-lifecycle-scope.js

@@ -0,0 +1,153 @@
+/**
+ * Trusted storage scope for durable live-session sidecars.
+ *
+ * The session-core parked store, session message fabric, and workbench
+ * authority used to select only `getHomeDir()`.  That is correct for native
+ * and legacy CLI launches, but it lets two Claude-compatible project buckets
+ * under one config root share a same-id sidecar.  This module is deliberately
+ * narrow: it derives storage only from the validated launcher environment and
+ * current working directory.  RPC payloads, settings values, and caller
+ * supplied paths are never part of the scope decision.
+ */
+
+import { createHash } from "node:crypto";
+import { dirname, join, resolve } from "node:path";
+import {
+  ensureClaudeProjectStorageTree,
+  getClaudeProjectStorageDir,
+  resolveConfigDataRoot,
+} from "./paths.js";
+
+const issuedScopes = new WeakSet();
+
+function lifecycleScopeError(
+  message,
+  code = "CC_SESSION_LIFECYCLE_SCOPE_UNSAFE",
+) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function trustedLaunchEnvironment(options) {
+  if (options.launchEnv === undefined || options.launchEnv === null) {
+    return process.env;
+  }
+  if (
+    !options.launchEnv ||
+    typeof options.launchEnv !== "object" ||
+    Array.isArray(options.launchEnv)
+  ) {
+    throw lifecycleScopeError(
+      "Lifecycle launch environment must be an object captured at process startup",
+    );
+  }
+  return options.launchEnv;
+}
+
+function trustedCwd(options) {
+  if (options.cwd === undefined || options.cwd === null) return process.cwd();
+  if (typeof options.cwd !== "string" || !options.cwd.trim()) {
+    throw lifecycleScopeError(
+      "Lifecycle working directory must be a non-empty trusted path",
+    );
+  }
+  return options.cwd;
+}
+
+function opaqueProjectScopeKey(projectStorageDir) {
+  const normalized =
+    process.platform === "win32"
+      ? resolve(projectStorageDir).toLowerCase()
+      : resolve(projectStorageDir);
+  return `claude-project:${createHash("sha256")
+    .update(normalized, "utf8")
+    .digest("hex")}`;
+}
+
+function issue(scope) {
+  const frozen = Object.freeze(scope);
+  issuedScopes.add(frozen);
+  return frozen;
+}
+
+/**
+ * Resolve the only valid lifecycle storage scope for this process boundary.
+ *
+ * `launchEnv` is an internal launch-time snapshot seam used by the agent REPL
+ * and tests.  It is intentionally not a general settings/RPC option: callers
+ * cannot provide a project path, a scope id, or a durable file path here.
+ */
+export function resolveTrustedSessionLifecycleScope(options = {}) {
+  const launchEnv = trustedLaunchEnvironment(options);
+  const cwd = trustedCwd(options);
+  const config = resolveConfigDataRoot({ env: launchEnv, cwd });
+  const projectStorageDir =
+    config.source === "claude"
+      ? getClaudeProjectStorageDir({ env: launchEnv, cwd })
+      : null;
+
+  if (!projectStorageDir) {
+    return issue({
+      kind: "legacy",
+      key: "legacy",
+      configRoot: config.path,
+      projectStorageDir: null,
+      parkedSessionsPath: join(config.path, "parked-sessions.json"),
+      messageFabricStatePath: join(
+        config.path,
+        "session-message-fabric",
+        "state.json",
+      ),
+      workbenchStatePath: join(config.path, "session-workbench.json"),
+    });
+  }
+
+  const projectDir = resolve(projectStorageDir);
+  return issue({
+    kind: "project",
+    key: opaqueProjectScopeKey(projectDir),
+    configRoot: config.path,
+    projectStorageDir: projectDir,
+    parkedSessionsPath: join(projectDir, "parked-sessions.json"),
+    messageFabricStatePath: join(
+      projectDir,
+      "session-message-fabric",
+      "state.json",
+    ),
+    workbenchStatePath: join(projectDir, "session-workbench.json"),
+  });
+}
+
+/**
+ * Establish the owner-only project tree before a default lifecycle sidecar is
+ * read or written.  Only scope objects issued by the resolver are accepted so
+ * an embedding/RPC caller cannot redirect a durable state file with a forged
+ * project directory.
+ */
+export function ensureTrustedSessionLifecycleScope(scope, options = {}) {
+  if (!issuedScopes.has(scope)) {
+    throw lifecycleScopeError(
+      "Lifecycle storage scope was not issued by the trusted resolver",
+    );
+  }
+  if (scope.kind !== "project") return scope;
+
+  const extraDirectories = Array.isArray(options.extraDirectories)
+    ? options.extraDirectories.map((entry) => resolve(entry))
+    : [];
+  ensureClaudeProjectStorageTree(scope.configRoot, scope.projectStorageDir, {
+    extraDirectories,
+  });
+  return scope;
+}
+
+/** Convenience helper for the default message-fabric state directory. */
+export function sessionLifecycleFabricDirectory(scope) {
+  if (!issuedScopes.has(scope)) {
+    throw lifecycleScopeError(
+      "Lifecycle storage scope was not issued by the trusted resolver",
+    );
+  }
+  return dirname(scope.messageFabricStatePath);
+}