chainlesschain 0.165.6 → 0.165.9

package/src/lib/sync-credentials.js

@@ -21,9 +21,9 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import os from "node:os";
 import crypto from "node:crypto";
 import { withFileLock } from "./with-file-lock.js";
+import { ensureDir, getHomeDir } from "./paths.js";
 
 const SENSITIVE_FIELDS = ["sync.webdav.password", "sync.oss.secretAccessKey"];
 const ALLOWED_PROVIDER_IDS = ["webdav", "oss"];
@@ -37,10 +37,7 @@ let _ccDirOverride = null;
 
 function _ccDir() {
   if (_ccDirOverride) return _ccDirOverride;
-  return (
-    process.env.CHAINLESSCHAIN_HOME ||
-    path.join(os.homedir(), ".chainlesschain")
-  );
+  return getHomeDir();
 }
 
 function _keyPath() {
@@ -53,7 +50,13 @@ function _vaultPath() {
 
 function _ensureDir() {
   const dir = _ccDir();
-  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  // Explicit test-only override keeps the existing isolated fake-filesystem
+  // seam lightweight; production roots always go through owner-only setup.
+  if (_ccDirOverride) {
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    return;
+  }
+  ensureDir(dir);
 }
 
 /**
@@ -217,24 +220,32 @@ function setCredentials(providerId, creds) {
   // Credential metadata is security-critical: never decrypt-modify-encrypt
   // without exclusion, because a lost update can silently restore/revoke the
   // wrong provider credentials.
-  return withFileLock(_vaultPath(), () => {
-    const all = loadAll();
-    if (!all.sync || typeof all.sync !== "object") all.sync = {};
-    all.sync[providerId] = { ...creds };
-    return saveAll(all);
-  }, { failIfUnavailable: true });
+  return withFileLock(
+    _vaultPath(),
+    () => {
+      const all = loadAll();
+      if (!all.sync || typeof all.sync !== "object") all.sync = {};
+      all.sync[providerId] = { ...creds };
+      return saveAll(all);
+    },
+    { failIfUnavailable: true },
+  );
 }
 
 function clearCredentials(providerId) {
   assertProviderId(providerId);
-  return withFileLock(_vaultPath(), () => {
-    const all = loadAll();
-    if (all?.sync?.[providerId]) {
-      delete all.sync[providerId];
-      return saveAll(all);
-    }
-    return true;
-  }, { failIfUnavailable: true });
+  return withFileLock(
+    _vaultPath(),
+    () => {
+      const all = loadAll();
+      if (all?.sync?.[providerId]) {
+        delete all.sync[providerId];
+        return saveAll(all);
+      }
+      return true;
+    },
+    { failIfUnavailable: true },
+  );
 }
 
 /** Test seam: override the resolved chainlesschain dir without env leak. */

package/src/lib/web-fetch.js

@@ -9,6 +9,7 @@ import http from "node:http";
 import https from "node:https";
 import { lookup as dnsLookup } from "node:dns";
 import { URL } from "node:url";
+import { createHash } from "node:crypto";
 
 const DEFAULT_MAX_BYTES = 2_000_000;
 const DEFAULT_TIMEOUT_MS = 15_000;
@@ -140,6 +141,35 @@ function stripTags(html) {
   return String(html).replace(/<[^>]+>/g, "");
 }
 
+function webFetchCacheKey(parsed, { format, maxBytes, maxRedirects, headers }) {
+  // A caller-provided header can carry credentials or change representation.
+  // Keep those requests out of the shared host cache entirely.
+  if (
+    (headers && Object.keys(headers).length > 0) ||
+    parsed.username ||
+    parsed.password
+  ) {
+    return null;
+  }
+  const payload = JSON.stringify({
+    url: parsed.toString(),
+    format,
+    maxBytes,
+    maxRedirects,
+  });
+  // Do not retain a raw URL/query as a long-lived Map key in the host cache.
+  return `web-fetch:${createHash("sha256").update(payload).digest("hex")}`;
+}
+
+function hostBudgetUnavailable(tool, error) {
+  const reason = String(error?.budgetReason || "unavailable").slice(0, 128);
+  return {
+    error: `${tool} unavailable: host resource budget (${reason})`,
+    code: "ERR_HOST_RESOURCE_BUDGET",
+    reason,
+  };
+}
+
 /**
  * A `lookup` for http(s).request that resolves the hostname and REJECTS the
  * connection if any resolved IP is private/loopback/link-local. checkAllowed
@@ -243,6 +273,7 @@ export async function webFetch(url, options = {}) {
     config = {},
     headers = {},
     maxRedirects = 3,
+    hostResourceBudget = null,
   } = options;
 
   const check = checkAllowed(url, config);
@@ -250,53 +281,94 @@ export async function webFetch(url, options = {}) {
     return { error: `web_fetch blocked: ${check.reason}` };
   }
 
-  let parsed = check.url;
-  let redirects = 0;
-  let response;
-  while (true) {
-    response = await _doRequest(parsed, {
-      maxBytes,
-      timeout,
-      headers,
-      allowPrivateHosts: config.allowPrivateHosts,
-    });
-    if (!response.redirect) break;
-    if (++redirects > maxRedirects) {
-      return { error: "too many redirects" };
-    }
-    const next = new URL(response.redirect, parsed);
-    const nextCheck = checkAllowed(next.toString(), config);
-    if (!nextCheck.allowed) {
-      return { error: `redirect blocked: ${nextCheck.reason}` };
+  const cacheKey = webFetchCacheKey(check.url, {
+    format,
+    maxBytes,
+    maxRedirects,
+    headers,
+  });
+  if (cacheKey && hostResourceBudget?.getWebFetch) {
+    try {
+      const cached = hostResourceBudget.getWebFetch(cacheKey);
+      if (cached) return { ...cached, cached: true };
+    } catch (error) {
+      return hostBudgetUnavailable("web_fetch", error);
     }
-    parsed = nextCheck.url;
   }
 
-  const { statusCode, headers: respHeaders, body } = response;
-  const contentType = String(respHeaders["content-type"] || "");
-
-  let output = body;
-  let outputFormat = format;
-  if (format === "markdown") {
-    output = /html/i.test(contentType) ? htmlToMarkdown(body) : body;
-  } else if (format === "text") {
-    output = /html/i.test(contentType) ? stripTags(body) : body;
-  } else if (format === "json") {
+  let toolLease = null;
+  if (hostResourceBudget) {
     try {
-      output = JSON.parse(body);
-    } catch {
-      return { error: "response is not valid JSON", statusCode, body };
+      if (typeof hostResourceBudget.admitTool !== "function") {
+        throw new TypeError(
+          "host resource budget does not provide admitTool()",
+        );
+      }
+      toolLease = hostResourceBudget.admitTool({ kind: "web-fetch" });
+    } catch (error) {
+      return hostBudgetUnavailable("web_fetch", error);
     }
   }
 
-  return {
-    url: parsed.toString(),
-    statusCode,
-    contentType,
-    format: outputFormat,
-    bytes: Buffer.byteLength(body, "utf8"),
-    content: output,
-  };
+  try {
+    let parsed = check.url;
+    let redirects = 0;
+    let response;
+    while (true) {
+      response = await _doRequest(parsed, {
+        maxBytes,
+        timeout,
+        headers,
+        allowPrivateHosts: config.allowPrivateHosts,
+      });
+      if (!response.redirect) break;
+      if (++redirects > maxRedirects) {
+        return { error: "too many redirects" };
+      }
+      const next = new URL(response.redirect, parsed);
+      const nextCheck = checkAllowed(next.toString(), config);
+      if (!nextCheck.allowed) {
+        return { error: `redirect blocked: ${nextCheck.reason}` };
+      }
+      parsed = nextCheck.url;
+    }
+
+    const { statusCode, headers: respHeaders, body } = response;
+    const contentType = String(respHeaders["content-type"] || "");
+
+    let output = body;
+    let outputFormat = format;
+    if (format === "markdown") {
+      output = /html/i.test(contentType) ? htmlToMarkdown(body) : body;
+    } else if (format === "text") {
+      output = /html/i.test(contentType) ? stripTags(body) : body;
+    } else if (format === "json") {
+      try {
+        output = JSON.parse(body);
+      } catch {
+        return { error: "response is not valid JSON", statusCode, body };
+      }
+    }
+
+    const result = {
+      url: parsed.toString(),
+      statusCode,
+      contentType,
+      format: outputFormat,
+      bytes: Buffer.byteLength(body, "utf8"),
+      content: output,
+    };
+    if (cacheKey && hostResourceBudget?.putWebFetch) {
+      try {
+        hostResourceBudget.putWebFetch(cacheKey, result);
+      } catch {
+        // Cache failures never weaken the completed, bounded I/O result.
+      }
+    }
+    return result;
+  } finally {
+    toolLease?.release();
+  }
 }
 
 // `lookup` is injectable so tests can resolve a domain to a private IP without

package/src/lib/web-search.js

@@ -18,6 +18,7 @@ import { URL } from "url";
 const DEFAULT_MAX_BYTES = 2_000_000;
 const DEFAULT_TIMEOUT_MS = 15_000;
 const DEFAULT_MAX_RESULTS = 8;
+export const MAX_WEB_SEARCH_RESULTS = 20;
 
 const KEYED_PROVIDERS = ["tavily", "brave", "bocha", "qianfan"];
 const KEYLESS_PROVIDERS = ["duckduckgo", "searxng", "baidu"];
@@ -38,7 +39,11 @@ export function resolveApiKey(provider, options = {}, config = {}) {
   switch (provider) {
     case "tavily":
       return (
-        options.apiKey || config.tavilyApiKey || config.apiKey || env.TAVILY_API_KEY || ""
+        options.apiKey ||
+        config.tavilyApiKey ||
+        config.apiKey ||
+        env.TAVILY_API_KEY ||
+        ""
       );
     case "brave":
       return (
@@ -51,7 +56,11 @@ export function resolveApiKey(provider, options = {}, config = {}) {
       );
     case "bocha":
       return (
-        options.apiKey || config.bochaApiKey || config.apiKey || env.BOCHA_API_KEY || ""
+        options.apiKey ||
+        config.bochaApiKey ||
+        config.apiKey ||
+        env.BOCHA_API_KEY ||
+        ""
       );
     case "qianfan":
       return (
@@ -82,7 +91,10 @@ export function resolveProvider(options = {}, config = {}) {
   return "duckduckgo";
 }
 
-function _request(urlStr, { method = "GET", headers = {}, body = null, timeout, maxBytes }) {
+function _request(
+  urlStr,
+  { method = "GET", headers = {}, body = null, timeout, maxBytes },
+) {
   const parsed = new URL(urlStr);
   const lib = parsed.protocol === "https:" ? _deps.https : _deps.http;
   return new Promise((resolve, reject) => {
@@ -147,6 +159,22 @@ function _clean(s) {
   return _decodeEntities(_stripTags(s)).replace(/\s+/g, " ").trim();
 }
 
+function normalizeMaxResults(value) {
+  const parsed = Number(value);
+  const requested =
+    Number.isSafeInteger(parsed) && parsed > 0 ? parsed : DEFAULT_MAX_RESULTS;
+  return Math.min(requested, MAX_WEB_SEARCH_RESULTS);
+}
+
+function hostBudgetUnavailable(error) {
+  const reason = String(error?.budgetReason || "unavailable").slice(0, 128);
+  return {
+    error: `web_search unavailable: host resource budget (${reason})`,
+    code: "ERR_HOST_RESOURCE_BUDGET",
+    reason,
+  };
+}
+
 // ---- Provider adapters: each returns { results: [{title,url,snippet}], answer } ----
 
 async function _searchTavily(query, { apiKey, maxResults, timeout, maxBytes }) {
@@ -167,7 +195,9 @@ async function _searchTavily(query, { apiKey, maxResults, timeout, maxBytes }) {
     maxBytes,
   });
   if (res.statusCode >= 400) {
-    return { error: `tavily HTTP ${res.statusCode}: ${res.body.slice(0, 200)}` };
+    return {
+      error: `tavily HTTP ${res.statusCode}: ${res.body.slice(0, 200)}`,
+    };
   }
   let json;
   try {
@@ -326,10 +356,7 @@ async function _searchQianfan(
     url: r.url || "",
     snippet: _clean(r.content || r.web_anchor || ""),
   }));
-  const answer =
-    json.answer ||
-    json.choices?.[0]?.message?.content ||
-    "";
+  const answer = json.answer || json.choices?.[0]?.message?.content || "";
   return { results, answer: typeof answer === "string" ? answer : "" };
 }
 
@@ -362,7 +389,8 @@ async function _searchBaidu(query, { maxResults, timeout, maxBytes }) {
   // Markup-agnostic: anchor each result on its <h3 class="t|c-title"> heading,
   // pull the URL from the anchor inside it (a baidu.com/link?url= redirect that
   // web_fetch resolves), and take the text up to the next heading as snippet.
-  const h3re = /<h3[^>]*class="[^"]*\b(?:t|c-title)\b[^"]*"[^>]*>([\s\S]*?)<\/h3>/gi;
+  const h3re =
+    /<h3[^>]*class="[^"]*\b(?:t|c-title)\b[^"]*"[^>]*>([\s\S]*?)<\/h3>/gi;
   const marks = [];
   let m;
   while ((m = h3re.exec(html)) !== null) {
@@ -381,7 +409,10 @@ async function _searchBaidu(query, { maxResults, timeout, maxBytes }) {
   return { results, answer: "" };
 }
 
-async function _searchSearxng(query, { instanceUrl, maxResults, timeout, maxBytes }) {
+async function _searchSearxng(
+  query,
+  { instanceUrl, maxResults, timeout, maxBytes },
+) {
   if (!instanceUrl) return { error: "searxng: missing instanceUrl" };
   const base = instanceUrl.replace(/\/+$/, "");
   const url = `${base}/search?q=${encodeURIComponent(query)}&format=json`;
@@ -398,7 +429,9 @@ async function _searchSearxng(query, { instanceUrl, maxResults, timeout, maxByte
   try {
     json = JSON.parse(res.body);
   } catch {
-    return { error: "searxng: invalid JSON response (is json format enabled?)" };
+    return {
+      error: "searxng: invalid JSON response (is json format enabled?)",
+    };
   }
   const results = (json.results || []).slice(0, maxResults).map((r) => ({
     title: _clean(r.title || ""),
@@ -419,10 +452,7 @@ export async function webSearch(query, options = {}) {
 
   const config = options.config || {};
   const provider = resolveProvider(options, config);
-  const maxResults =
-    Number(options.maxResults) ||
-    Number(config.maxResults) ||
-    DEFAULT_MAX_RESULTS;
+  let maxResults = normalizeMaxResults(options.maxResults ?? config.maxResults);
   const timeout = Number(options.timeout) || DEFAULT_TIMEOUT_MS;
   const maxBytes = Number(options.maxBytes) || DEFAULT_MAX_BYTES;
 
@@ -432,56 +462,92 @@ export async function webSearch(query, options = {}) {
     };
   }
 
-  const apiKey = resolveApiKey(provider, options, config);
-  const common = { apiKey, maxResults, timeout, maxBytes };
+  const hostResourceBudget = options.hostResourceBudget || null;
+  if (hostResourceBudget?.capWebSearchResults) {
+    try {
+      maxResults = normalizeMaxResults(
+        hostResourceBudget.capWebSearchResults(maxResults),
+      );
+    } catch (error) {
+      return hostBudgetUnavailable(error);
+    }
+  }
 
-  let out;
-  try {
-    switch (provider) {
-      case "tavily":
-        out = await _searchTavily(q, common);
-        break;
-      case "brave":
-        out = await _searchBrave(q, common);
-        break;
-      case "bocha":
-        out = await _searchBocha(q, common);
-        break;
-      case "qianfan":
-        out = await _searchQianfan(q, {
-          ...common,
-          endpoint: options.qianfanUrl || config.qianfanUrl,
-        });
-        break;
-      case "searxng":
-        out = await _searchSearxng(q, {
-          instanceUrl: options.instanceUrl || config.instanceUrl,
-          maxResults,
-          timeout,
-          maxBytes,
-        });
-        break;
-      case "baidu":
-        out = await _searchBaidu(q, { maxResults, timeout, maxBytes });
-        break;
-      case "duckduckgo":
-      default:
-        out = await _searchDuckDuckGo(q, { maxResults, timeout, maxBytes });
-        break;
+  let toolLease = null;
+  if (hostResourceBudget) {
+    try {
+      if (typeof hostResourceBudget.admitTool !== "function") {
+        throw new TypeError(
+          "host resource budget does not provide admitTool()",
+        );
+      }
+      toolLease = hostResourceBudget.admitTool({ kind: "web-search" });
+    } catch (error) {
+      return hostBudgetUnavailable(error);
     }
-  } catch (err) {
-    return { error: `web_search (${provider}) failed: ${err.message}`, provider };
   }
 
-  if (out && out.error) return { ...out, provider };
-  const results = (out && out.results) || [];
-  return {
-    query: q,
-    provider,
-    count: results.length,
-    results,
-    answer: (out && out.answer) || "",
-  };
+  try {
+    const apiKey = resolveApiKey(provider, options, config);
+    const common = { apiKey, maxResults, timeout, maxBytes };
+
+    let out;
+    try {
+      switch (provider) {
+        case "tavily":
+          out = await _searchTavily(q, common);
+          break;
+        case "brave":
+          out = await _searchBrave(q, common);
+          break;
+        case "bocha":
+          out = await _searchBocha(q, common);
+          break;
+        case "qianfan":
+          out = await _searchQianfan(q, {
+            ...common,
+            endpoint: options.qianfanUrl || config.qianfanUrl,
+          });
+          break;
+        case "searxng":
+          out = await _searchSearxng(q, {
+            instanceUrl: options.instanceUrl || config.instanceUrl,
+            maxResults,
+            timeout,
+            maxBytes,
+          });
+          break;
+        case "baidu":
+          out = await _searchBaidu(q, { maxResults, timeout, maxBytes });
+          break;
+        case "duckduckgo":
+        default:
+          out = await _searchDuckDuckGo(q, {
+            maxResults,
+            timeout,
+            maxBytes,
+          });
+          break;
+      }
+    } catch (err) {
+      return {
+        error: `web_search (${provider}) failed: ${err.message}`,
+        provider,
+      };
+    }
+
+    if (out && out.error) return { ...out, provider };
+    const results = (out && out.results) || [];
+    return {
+      query: q,
+      provider,
+      count: results.length,
+      results,
+      answer: (out && out.answer) || "",
+    };
+  } finally {
+    toolLease?.release();
+  }
 }
 
 export const _deps = { http, https };

package/src/lib/workflow-engine.js

@@ -5,6 +5,12 @@
  */
 
 import crypto from "crypto";
+import runtimeClaimsContract from "@chainlesschain/session-core/runtime-claims";
+
+const { RUNTIME_MODE, createRuntimeClaims } = runtimeClaimsContract;
+const WORKFLOW_SIMULATION_CLAIMS = createRuntimeClaims({
+  mode: RUNTIME_MODE.SIMULATED,
+});
 
 // ─── Frozen enums (Phase 82 spec) ─────────────────────────────
 
@@ -14,6 +20,7 @@ export const WORKFLOW_STATUS = Object.freeze({
   RUNNING: "running",
   PAUSED: "paused",
   COMPLETED: "completed",
+  SIMULATED: "simulated",
   FAILED: "failed",
   ROLLING_BACK: "rolling_back",
   ROLLED_BACK: "rolled_back",
@@ -24,6 +31,7 @@ export const NODE_STATUS = Object.freeze({
   PENDING: "pending",
   RUNNING: "running",
   COMPLETED: "completed",
+  SIMULATED: "simulated",
   FAILED: "failed",
   SKIPPED: "skipped",
   WAITING_APPROVAL: "waiting_approval",
@@ -228,7 +236,10 @@ export function deleteWorkflow(db, workflowId) {
 }
 
 /**
- * Execute a workflow, running through stages in topological order.
+ * Simulate a workflow by traversing stages in topological order.
+ *
+ * This legacy designer has no action executor. It must never report a
+ * production completion until an execution adapter is explicitly supplied.
  * @returns {{ id, workflowId, status, log }}
  */
 export function executeWorkflow(db, workflowId, input = {}) {
@@ -251,14 +262,14 @@ export function executeWorkflow(db, workflowId, input = {}) {
   // Topological sort for execution order
   const order = topologicalSort(stages);
 
-  // Execute each stage
+  // Plan each stage. No action or approval handler is invoked here.
   for (const stageId of order) {
     const stage = stages.find((s) => s.id === stageId);
     log.push({
       stageId: stage.id,
       stageName: stage.name,
       type: stage.type || "action",
-      status: "completed",
+      status: "simulated",
       timestamp: new Date().toISOString(),
     });
   }
@@ -271,7 +282,7 @@ export function executeWorkflow(db, workflowId, input = {}) {
   ).run(
     execId,
     workflowId,
-    "completed",
+    "simulated",
     JSON.stringify(input),
     JSON.stringify(log),
     order[order.length - 1] || null,
@@ -279,7 +290,14 @@ export function executeWorkflow(db, workflowId, input = {}) {
     now,
   );
 
-  return { id: execId, workflowId, status: "completed", log };
+  return {
+    id: execId,
+    workflowId,
+    status: "simulated",
+    log,
+    runtimeClaims: WORKFLOW_SIMULATION_CLAIMS,
+    terminalEvidence: [],
+  };
 }
 
 /**
@@ -332,7 +350,7 @@ export function pauseExecution(db, executionId) {
   if (
     exec.status !== "running" &&
     exec.status !== "pending" &&
-    exec.status !== "completed"
+    exec.status !== "simulated"
   ) {
     throw new Error(`Cannot pause execution in status: ${exec.status}`);
   }
@@ -352,11 +370,15 @@ export function pauseExecution(db, executionId) {
     executionId,
   );
 
-  return { id: executionId, status: "paused" };
+  return {
+    id: executionId,
+    status: "paused",
+    runtimeClaims: WORKFLOW_SIMULATION_CLAIMS,
+  };
 }
 
 /**
- * Resume a paused execution.
+ * Resume a paused simulation.
  */
 export function resumeExecution(db, executionId) {
   ensureWorkflowTables(db);
@@ -371,13 +393,13 @@ export function resumeExecution(db, executionId) {
   }
 
   db.prepare("UPDATE workflow_executions SET status = ? WHERE id = ?").run(
-    "running",
+    "simulated",
     executionId,
   );
 
   const log = _safeParse(exec.log, []);
   log.push({
-    action: "resumed",
+    action: "simulation-resumed",
     timestamp: new Date().toISOString(),
   });
   db.prepare("UPDATE workflow_executions SET log = ? WHERE id = ?").run(
@@ -385,7 +407,11 @@ export function resumeExecution(db, executionId) {
     executionId,
   );
 
-  return { id: executionId, status: "running" };
+  return {
+    id: executionId,
+    status: "simulated",
+    runtimeClaims: WORKFLOW_SIMULATION_CLAIMS,
+  };
 }
 
 /**
@@ -439,6 +465,11 @@ export function getExecutionLog(db, executionId) {
     log: _safeParse(exec.log, []),
     startedAt: exec.started_at,
     completedAt: exec.completed_at,
+    runtimeClaims:
+      exec.status === "simulated" || exec.status === "paused"
+        ? WORKFLOW_SIMULATION_CLAIMS
+        : undefined,
+    terminalEvidence: [],
   };
 }