chainlesschain 0.166.6 → 0.166.9

package/src/gateways/ws/ws-approval-gate.js

@@ -26,6 +26,32 @@
  */
 
 import { approvalBindingDigest } from "../../lib/agent-authority.js";
+import {
+  APPROVAL_GRANTS_EVENT,
+  ApprovalGrantLedger,
+  approvalPermissionForContext,
+} from "../../lib/approval-grant-ledger.js";
+
+function approvalDecision(value) {
+  const candidate =
+    value?.decision && typeof value.decision === "object"
+      ? value.decision
+      : value;
+  if (
+    candidate &&
+    [
+      "acceptOnce",
+      "acceptForTurn",
+      "acceptForSession",
+      "decline",
+      "cancel",
+    ].includes(candidate.kind)
+  ) {
+    return candidate;
+  }
+  if (value === true) return { kind: "acceptOnce" };
+  return { kind: "decline" };
+}
 
 /**
  * Build the binding-attaching confirmer for one WS session.
@@ -35,9 +61,19 @@ import { approvalBindingDigest } from "../../lib/agent-authority.js";
  * @param {string} opts.sessionId
  * @returns {(ctx?: object) => Promise<boolean>}
  */
-export function buildWsApprovalConfirmer({ interaction, sessionId }) {
+export function buildWsApprovalConfirmer({
+  interaction,
+  sessionId,
+  cwd = null,
+  ledgerState = { ledger: new ApprovalGrantLedger({ sessionId }) },
+  persistApprovalGrants = () => false,
+}) {
   let approvalSeq = 0;
   return async (ctx = {}) => {
+    const requiredPermission = approvalPermissionForContext(ctx, {
+      cwd: cwd || ctx.cwd || null,
+    });
+    if (ledgerState.ledger.allows(requiredPermission)) return true;
     const command = ctx.command ?? ctx.args?.command ?? null;
     const risk = ctx.riskLevel || ctx.risk || "unknown";
     // Bind this approval to the exact call it authorizes (same recipe as the
@@ -51,22 +87,66 @@ export function buildWsApprovalConfirmer({ interaction, sessionId }) {
     const what = ctx.tool || ctx.toolName || "tool";
     const detail = command != null ? `: ${String(command).slice(0, 200)}` : "";
     try {
-      const ok = await interaction.askConfirm(
-        `Approve ${what}${detail}? (risk: ${risk})`,
-        {
-          default: false,
-          binding,
-          // Structured context so UIs can render a proper approval card
-          // instead of parsing the question text.
-          approval: {
-            tool: what,
-            command,
-            risk,
-            rule: ctx.rule || null,
-          },
+      const options = {
+        default: false,
+        binding,
+        // Structured context so UIs can render a proper approval card
+        // instead of parsing the question text. Reusable permissions are
+        // host-issued and exact; the renderer may choose a lifetime but may
+        // never widen this set.
+        approval: {
+          tool: what,
+          command,
+          risk,
+          rule: ctx.rule || null,
+          requestedPermissions: [requiredPermission],
         },
+      };
+      const rawDecision = interaction.askApproval
+        ? await interaction.askApproval(
+            `Approve ${what}${detail}? (risk: ${risk})`,
+            options,
+          )
+        : await interaction.askConfirm(
+            `Approve ${what}${detail}? (risk: ${risk})`,
+            options,
+          );
+      let decision = approvalDecision(rawDecision);
+      const approved = [
+        "acceptOnce",
+        "acceptForTurn",
+        "acceptForSession",
+      ].includes(decision.kind);
+      if (
+        approved &&
+        (decision.kind === "acceptForTurn" ||
+          decision.kind === "acceptForSession")
+      ) {
+        const priorSessionGrants = new Map(ledgerState.ledger.sessionGrants);
+        const priorRevision = ledgerState.ledger.revision;
+        const applied = ledgerState.ledger.applyDecision(
+          decision,
+          requiredPermission,
+          binding,
+        );
+        decision = applied.decision;
+        if (applied.granted.length === 0) return false;
+        if (applied.persistedScope && !persistApprovalGrants()) {
+          ledgerState.ledger.sessionGrants = priorSessionGrants;
+          ledgerState.ledger.revision = priorRevision;
+          // Match the stream-json contract: persistence failure never creates
+          // a phantom session grant, but the exact operation may proceed once.
+          decision = { kind: "acceptOnce" };
+        }
+      }
+      interaction.recordApprovalDecision?.({
+        binding,
+        decision,
+        requiredPermission,
+      });
+      return ["acceptOnce", "acceptForTurn", "acceptForSession"].includes(
+        decision.kind,
       );
-      return ok === true;
     } catch {
       // timeout / disconnect / interrupt → fail closed, never approve
       return false;
@@ -91,6 +171,7 @@ export function buildWsApprovalConfirmer({ interaction, sessionId }) {
 export async function createWsApprovalGate({
   sessionId,
   interaction,
+  cwd = null,
   deps = {},
 }) {
   try {
@@ -104,8 +185,59 @@ export async function createWsApprovalGate({
       loadSessionCore(),
     ]);
     const inner = await singletons.getApprovalGate();
+    const store =
+      deps.sessionStore ||
+      (await import("../../harness/jsonl-session-store.js"));
+    const ledgerState = {
+      ledger: new ApprovalGrantLedger({ sessionId }),
+    };
+    let approvalGrantPersistenceError = null;
+    try {
+      const event = store.findLatestEvent(
+        sessionId,
+        APPROVAL_GRANTS_EVENT,
+        (candidate) => candidate?.data && typeof candidate.data === "object",
+      );
+      if (event) {
+        ledgerState.ledger = ApprovalGrantLedger.fromJSON(event.data, {
+          sessionId,
+        });
+      }
+    } catch (error) {
+      approvalGrantPersistenceError = error;
+      ledgerState.ledger = new ApprovalGrantLedger({ sessionId });
+      interaction.emit?.("recovery-degraded", {
+        component: "approval_grants",
+        error:
+          "Persisted approval grants could not be verified; all grants were discarded",
+      });
+    }
+    const persistApprovalGrants = () => {
+      if (approvalGrantPersistenceError) return false;
+      try {
+        const persisted = store.appendAuthorityEvent(
+          sessionId,
+          APPROVAL_GRANTS_EVENT,
+          ledgerState.ledger.toJSON(),
+        );
+        if (persisted === false) {
+          throw new Error("session store rejected approval grants");
+        }
+        return true;
+      } catch (error) {
+        approvalGrantPersistenceError = error;
+        return false;
+      }
+    };
     const confirmer =
-      deps.confirmer || buildWsApprovalConfirmer({ interaction, sessionId });
+      deps.confirmer ||
+      buildWsApprovalConfirmer({
+        interaction,
+        sessionId,
+        cwd,
+        ledgerState,
+        persistApprovalGrants,
+      });
     const gate = new core.ApprovalGate({
       defaultPolicy: core.APPROVAL_POLICY?.STRICT || "strict",
       confirm: confirmer,
@@ -129,6 +261,39 @@ export async function createWsApprovalGate({
       getSessionPolicy: (sid) => inner.getSessionPolicy(sid || sessionId),
       setSessionPolicy: (sid, policy) =>
         inner.setSessionPolicy(sid || sessionId, policy),
+      beginTurn: (turnId) => ledgerState.ledger.beginTurn(turnId),
+      listGrants: () => ledgerState.ledger.listGrants(),
+      revokeGrant: (grantId) => {
+        const existing = ledgerState.ledger
+          .listGrants()
+          .find((grant) => grant.grantId === String(grantId || ""));
+        if (!existing) {
+          return { success: false, error: "Approval grant was not found" };
+        }
+        if (existing.lifetime === "turn") {
+          const result = ledgerState.ledger.revoke(grantId);
+          return { success: result.revoked, grant: result.grant };
+        }
+
+        const candidate = ApprovalGrantLedger.fromJSON(
+          ledgerState.ledger.toJSON(),
+          { sessionId },
+        );
+        const result = candidate.revoke(grantId);
+        if (!result.revoked) {
+          return { success: false, error: "Approval grant was not found" };
+        }
+        const previous = ledgerState.ledger;
+        ledgerState.ledger = candidate;
+        if (!persistApprovalGrants()) {
+          ledgerState.ledger = previous;
+          return {
+            success: false,
+            error: "Approval grant revocation could not be persisted",
+          };
+        }
+        return { success: true, grant: result.grant };
+      },
     };
   } catch {
     return null; // degrade to the legacy no-gate path

package/src/gateways/ws/ws-server.js

@@ -53,6 +53,8 @@ import {
   handleSessionClose,
   handleSessionInterrupt,
   handleSessionAnswer,
+  handleApprovalGrantsList,
+  handleApprovalGrantRevoke,
   handleHostToolResult,
   handleSubAgentList,
   handleSubAgentGet,
@@ -746,9 +748,8 @@ export class ChainlessChainWSServer extends EventEmitter {
   /** Read the same static + scoped authority used by the Agent Core. */
   async _handlePermissionRulesGet(id, ws) {
     try {
-      const { loadPermissionAuthority } = await import(
-        "../../lib/permission-authority.js"
-      );
+      const { loadPermissionAuthority } =
+        await import("../../lib/permission-authority.js");
       const loaded = loadPermissionAuthority({ cwd: this.projectRoot });
       this._send(ws, {
         id,
@@ -1416,6 +1417,16 @@ export class ChainlessChainWSServer extends EventEmitter {
     return handleSessionAnswer(this, id, ws, message);
   }
 
+  /** @private */
+  _handleApprovalGrantsList(id, ws, message) {
+    return handleApprovalGrantsList(this, id, ws, message);
+  }
+
+  /** @private */
+  _handleApprovalGrantRevoke(id, ws, message) {
+    return handleApprovalGrantRevoke(this, id, ws, message);
+  }
+
   _handleHostToolResult(id, ws, message) {
     return handleHostToolResult(this, id, ws, message);
   }
@@ -1498,9 +1509,8 @@ export class ChainlessChainWSServer extends EventEmitter {
   /** @private — ping/pong heartbeat to detect dead connections */
   async _ensureTaskManager() {
     if (this._taskManager) return this._taskManager;
-    const { BackgroundTaskManager } = await import(
-      "../../harness/background-task-manager.js"
-    );
+    const { BackgroundTaskManager } =
+      await import("../../harness/background-task-manager.js");
     this._taskManager = new BackgroundTaskManager({
       recoverOnStart: true,
       policyCwd: this.projectRoot,

package/src/generated/cc-agent-protocol.schema.json

@@ -16,7 +16,8 @@
       "graph_effect_receipts",
       "deterministic_trace",
       "agent_stream_events",
-      "agent_stream_payloads"
+      "agent_stream_payloads",
+      "unified_policy_decision"
     ]
   },
   "oneOf": [
@@ -1626,6 +1627,26 @@
         }
       }
     },
+    "HumanTaskDecision": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "actorId",
+        "decision",
+        "decidedAt"
+      ],
+      "properties": {
+        "actorId": {
+          "$ref": "#/$defs/Identifier"
+        },
+        "decision": {
+          "$ref": "#/$defs/ApprovalDecision"
+        },
+        "decidedAt": {
+          "$ref": "#/$defs/Timestamp"
+        }
+      }
+    },
     "HumanTask": {
       "type": "object",
       "additionalProperties": false,
@@ -1659,6 +1680,12 @@
         "operationDigest": {
           "$ref": "#/$defs/Digest"
         },
+        "operation": {
+          "$ref": "#/$defs/JsonValue"
+        },
+        "authorityDigest": {
+          "$ref": "#/$defs/Digest"
+        },
         "status": {
           "enum": [
             "open",
@@ -1668,6 +1695,21 @@
             "expired"
           ]
         },
+        "quorum": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 64
+        },
+        "separationOfDuties": {
+          "type": "boolean"
+        },
+        "decisions": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/HumanTaskDecision"
+          }
+        },
         "claimActorId": {
           "anyOf": [
             {
@@ -1688,12 +1730,32 @@
             }
           ]
         },
+        "claimExpiresAt": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Timestamp"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "nonce": {
           "$ref": "#/$defs/Identifier"
         },
         "expiresAt": {
           "$ref": "#/$defs/Timestamp"
         },
+        "createdAt": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "updatedAt": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "reason": {
+          "type": "string",
+          "maxLength": 1024
+        },
         "decision": {
           "anyOf": [
             {
@@ -1822,7 +1884,8 @@
         "token_usage",
         "tool_result",
         "tool_use",
-        "user"
+        "user",
+        "policy_decision"
       ]
     },
     "AgentStreamEventEnvelope": {
@@ -2444,6 +2507,85 @@
         }
       }
     },
+    "AgentPolicyDecisionStreamEvent": {
+      "type": "object",
+      "required": [
+        "type",
+        "schema_version",
+        "decision_id",
+        "source",
+        "decision",
+        "policy_digest"
+      ],
+      "properties": {
+        "type": {
+          "const": "policy_decision"
+        },
+        "schema_version": {
+          "const": 1
+        },
+        "decision_id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 160
+        },
+        "source": {
+          "enum": [
+            "hook",
+            "tool"
+          ]
+        },
+        "decision": {
+          "enum": [
+            "allow",
+            "ask",
+            "deny"
+          ]
+        },
+        "session_id": {
+          "type": "string",
+          "maxLength": 160
+        },
+        "turn_id": {
+          "type": "string",
+          "maxLength": 160
+        },
+        "tool_use_id": {
+          "type": "string",
+          "maxLength": 160
+        },
+        "tool": {
+          "type": "string",
+          "maxLength": 256
+        },
+        "hook_event": {
+          "type": "string",
+          "maxLength": 96
+        },
+        "via": {
+          "type": "string",
+          "maxLength": 120
+        },
+        "rule": {
+          "type": "string",
+          "maxLength": 256
+        },
+        "reason": {
+          "type": "string",
+          "maxLength": 512
+        },
+        "chain": {
+          "type": "array",
+          "maxItems": 8,
+          "items": {
+            "$ref": "#/$defs/JsonValue"
+          }
+        },
+        "policy_digest": {
+          "$ref": "#/$defs/Digest"
+        }
+      }
+    },
     "AgentQuestionRequestStreamEvent": {
       "type": "object",
       "required": [
@@ -3276,6 +3418,9 @@
         },
         {
           "$ref": "#/$defs/AgentUserStreamEvent"
+        },
+        {
+          "$ref": "#/$defs/AgentPolicyDecisionStreamEvent"
         }
       ]
     },
@@ -3390,7 +3535,13 @@
                     "thread/list",
                     "thread/archive",
                     "turn/start",
-                    "turn/interrupt"
+                    "turn/interrupt",
+                    "graph/compile",
+                    "graph/run",
+                    "graph/status",
+                    "graph/history",
+                    "graph/cancel",
+                    "graph/reconcile"
                   ]
                 }
               }