chainlesschain 0.166.6 → 0.166.9

package/src/lib/legacy-runtime-authority.js

@@ -0,0 +1,160 @@
+import { createRuntimeGraphCutoverAuthorityResolver } from "./graph-kernel/cutover-authority-resolver.js";
+import {
+  graphRuntimeSurfaceEntry,
+  loadGraphRuntimeSurfaceManifest,
+} from "./graph-kernel/runtime-surface-manifest.js";
+
+const AUTHORITY_MODES = new Set(["legacy", "shadow", "canonical"]);
+const ENTRYPOINTS = Object.freeze([
+  ["CLIAutonomousAgent.", "cli-legacy-autonomous"],
+  ["Orchestrator.", "cli-legacy-orchestrate"],
+]);
+const resolverCache = new Map();
+const runtimeManifest = loadGraphRuntimeSurfaceManifest();
+
+function authorityError(code, message, details = {}) {
+  const error = new Error(message);
+  error.name = "CLILegacyRuntimeAuthorityError";
+  error.code = code;
+  Object.assign(error, details);
+  return error;
+}
+
+function fallbackMode(env) {
+  const mode = String(env.CHAINLESSCHAIN_GRAPH_COWORK || "legacy")
+    .trim()
+    .toLowerCase();
+  if (!AUTHORITY_MODES.has(mode)) {
+    throw authorityError(
+      "CC_GRAPH_AUTHORITY_MODE_INVALID",
+      "CHAINLESSCHAIN_GRAPH_COWORK must be legacy, shadow, or canonical",
+    );
+  }
+  return mode;
+}
+
+function entryIdFor(entrypoint) {
+  const value = String(entrypoint || "");
+  return ENTRYPOINTS.find(([prefix]) => value.startsWith(prefix))?.[1];
+}
+
+function retirementContractFor(entryId) {
+  if (!entryId) return null;
+  const entry = graphRuntimeSurfaceEntry(
+    runtimeManifest,
+    "cowork",
+    entryId,
+  ).entry;
+  const replacementTargets = (entry.replacementEntryIds || []).map(
+    (replacementEntryId) => {
+      for (const surface of runtimeManifest.surfaces || []) {
+        const target = (surface.entries || []).find(
+          (candidate) => candidate.id === replacementEntryId,
+        );
+        if (!target) continue;
+        return Object.freeze({
+          entryId: target.id,
+          originSurface: surface.originSurface,
+          rolloutKey: target.rolloutKey,
+          entrypoints: Object.freeze([...(target.entrypoints || [])]),
+          recoveryEntrypoints: Object.freeze([
+            ...(target.recoveryEntrypoints || []),
+          ]),
+        });
+      }
+      return null;
+    },
+  );
+  return Object.freeze({
+    replacementEntrypoint: entry.replacementEntrypoint || null,
+    replacementEntryIds: Object.freeze([...(entry.replacementEntryIds || [])]),
+    historicalReadFunctions: Object.freeze([
+      ...(entry.historicalReadFunctions || []),
+    ]),
+    replacementTargets: Object.freeze(replacementTargets.filter(Boolean)),
+  });
+}
+
+export function cliLegacyRuntimeAuthorityMode(env = process.env, options = {}) {
+  const configured = fallbackMode(env);
+  const entryId = options.entryId;
+  if (!entryId) return configured;
+  let resolver = options.resolver;
+  if (!resolver) {
+    const key = `${entryId}\0${configured}\0${
+      env.CHAINLESSCHAIN_GRAPH_CUTOVER_STATE_DIR || ""
+    }`;
+    resolver = resolverCache.get(key);
+    if (!resolver) {
+      resolver = createRuntimeGraphCutoverAuthorityResolver({
+        env,
+        surface: "cowork",
+        entryId,
+        fallbackMode: configured,
+      });
+      resolverCache.set(key, resolver);
+    }
+  }
+  const resolved =
+    typeof resolver === "function"
+      ? resolver({ runKey: options.runKey, optIn: options.optIn === true })
+      : resolver.resolve({
+          runKey: options.runKey,
+          optIn: options.optIn === true,
+          fallbackMode: configured,
+        });
+  const mode = typeof resolved === "string" ? resolved : resolved?.mode;
+  if (!AUTHORITY_MODES.has(mode)) {
+    throw authorityError(
+      "CC_GRAPH_AUTHORITY_MODE_INVALID",
+      "CLI legacy runtime authority resolver returned an invalid mode",
+    );
+  }
+  return mode;
+}
+
+export function assertCLILegacyMutationAllowed(
+  entrypoint,
+  env = process.env,
+  options = {},
+) {
+  const entryId = options.entryId || entryIdFor(entrypoint);
+  const mode =
+    options.authorityMode ||
+    cliLegacyRuntimeAuthorityMode(env, { ...options, entryId });
+  if (
+    mode !== "canonical" &&
+    String(env.CHAINLESSCHAIN_CLI_LEGACY_READ_ONLY || "") !== "1"
+  ) {
+    return Object.freeze({
+      authorityMode: mode,
+      authoritySource:
+        mode === "shadow" ? "graph_kernel_shadow" : "legacy_runtime",
+      legacyReadOnly: false,
+    });
+  }
+  const retirementContract = retirementContractFor(entryId);
+  const replacementEntrypoint = retirementContract?.replacementEntrypoint;
+  throw authorityError(
+    "CC_CLI_LEGACY_RUNTIME_READ_ONLY",
+    `CLI legacy runtime is read-only; '${entrypoint}' must use ${replacementEntrypoint || "the canonical Graph Kernel entrypoint"}`,
+    {
+      entrypoint: String(entrypoint),
+      entryId,
+      replacementEntrypoint,
+      replacementEntryIds: retirementContract?.replacementEntryIds || [],
+      historicalReadFunctions:
+        retirementContract?.historicalReadFunctions || [],
+      replacementTargets: retirementContract?.replacementTargets || [],
+      authorityMode: "canonical",
+      authoritySource: "graph_kernel",
+    },
+  );
+}
+
+export function cliLegacyRuntimeReadOnly(env = process.env, options = {}) {
+  return (
+    cliLegacyRuntimeAuthorityMode(env, options) === "canonical" ||
+    String(env.CHAINLESSCHAIN_CLI_LEGACY_READ_ONLY || "") === "1"
+  );
+}

package/src/lib/orchestrator.js

@@ -27,6 +27,10 @@ import { AgentRouter } from "./agent-router.js";
 import { NotificationManager } from "./notifiers/index.js";
 import { createChatFn } from "./cowork-adapter.js";
 import { firstBalancedJson } from "./json-schema-output.js";
+import {
+  assertCLILegacyMutationAllowed,
+  cliLegacyRuntimeReadOnly,
+} from "./legacy-runtime-authority.js";
 import executionBroker from "./process-execution-broker/index.js";
 import runtimeClaimsContract from "@chainlesschain/session-core/runtime-claims";
 
@@ -108,6 +112,20 @@ export class Orchestrator extends EventEmitter {
     /** @type {Map<string, object>} taskId → task */
     this._tasks = new Map();
 
+    this._legacyReadOnly = cliLegacyRuntimeReadOnly(process.env, {
+      entryId: "cli-legacy-orchestrate",
+    });
+    if (this._legacyReadOnly) {
+      this._router = new AgentRouter({
+        backends: [],
+        maxParallel: this.maxParallel,
+      });
+      this.notifier = { isConfigured: false };
+      this._chat = null;
+      this._cronTimer = null;
+      return;
+    }
+
     // Multi-path agent router
     this._router =
       options.agentRouter ||
@@ -155,6 +173,7 @@ export class Orchestrator extends EventEmitter {
    * @returns {Promise<object>} Final task record
    */
   async addTask(description, opts = {}) {
+    assertCLILegacyMutationAllowed("Orchestrator.addTask");
     const task = {
       id: generateId("task"),
       description,
@@ -222,12 +241,14 @@ export class Orchestrator extends EventEmitter {
    * @param {number} intervalMs - Poll interval (default 600_000 = 10 min)
    */
   startCronWatch(intervalMs = 600_000) {
+    assertCLILegacyMutationAllowed("Orchestrator.startCronWatch");
     if (this._cronTimer) return;
     this._log(`Cron watch started (every ${Math.round(intervalMs / 60_000)}m)`);
     this._cronTimer = setInterval(() => this._cronTick(), intervalMs);
   }
 
   stopCronWatch() {
+    assertCLILegacyMutationAllowed("Orchestrator.stopCronWatch");
     if (this._cronTimer) {
       clearInterval(this._cronTimer);
       this._cronTimer = null;
@@ -237,6 +258,7 @@ export class Orchestrator extends EventEmitter {
   // ─── Orchestration pipeline ──────────────────────────────────────
 
   async _orchestrate(task) {
+    assertCLILegacyMutationAllowed("Orchestrator._orchestrate");
     try {
       // Step 1: Decompose
       task.subtasks = await this._decompose(task);
@@ -264,6 +286,7 @@ export class Orchestrator extends EventEmitter {
 
   /** LLM-driven task decomposition into coding subtasks. */
   async _decompose(task) {
+    assertCLILegacyMutationAllowed("Orchestrator._decompose");
     task.status = TASK_STATUS.DECOMPOSING;
     this.emit("task:decomposing", task);
 
@@ -306,6 +329,7 @@ export class Orchestrator extends EventEmitter {
 
   /** Dispatch subtasks to the Claude Code pool. */
   async _dispatch(task) {
+    assertCLILegacyMutationAllowed("Orchestrator._dispatch");
     this.emit("agents:dispatched", { task, count: task.subtasks.length });
     this._log(
       `Dispatching ${task.subtasks.length} subtask(s) to ${this._router.summary().length} agent backend(s)`,
@@ -320,6 +344,7 @@ export class Orchestrator extends EventEmitter {
 
   /** Run CI command and retry loop. */
   async _ciLoop(task) {
+    assertCLILegacyMutationAllowed("Orchestrator._ciLoop");
     for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
       task.status = TASK_STATUS.CI_CHECKING;
       this.emit("ci:checking", { task, attempt });
@@ -398,6 +423,7 @@ export class Orchestrator extends EventEmitter {
 
   /** Execute CI command and parse results. */
   _runCI(cwd) {
+    assertCLILegacyMutationAllowed("Orchestrator._runCI");
     try {
       const output = _deps.execSync(this.ciCommand, {
         cwd,
@@ -465,6 +491,7 @@ export class Orchestrator extends EventEmitter {
    * the caller has already seen via task:complete / task:failed events.
    */
   _pruneTasks() {
+    assertCLILegacyMutationAllowed("Orchestrator._pruneTasks");
     if (this._tasks.size <= this.maxTasks) return;
     for (const [id, t] of this._tasks) {
       if (this._tasks.size <= this.maxTasks) break;
@@ -478,6 +505,7 @@ export class Orchestrator extends EventEmitter {
   }
 
   async _cronTick() {
+    assertCLILegacyMutationAllowed("Orchestrator._cronTick");
     this.emit("cron:tick", { at: new Date().toISOString() });
     // Override this method or listen to the event to add input source polling
   }

package/src/lib/policy-decision-event.js

@@ -0,0 +1,149 @@
+import { createHash } from "node:crypto";
+import { redactSecrets } from "./secret-scan.js";
+
+export const POLICY_DECISION_EVENT_VERSION = 1;
+
+const MAX_CHAIN = 8;
+
+function boundedText(value, max) {
+  if (value == null) return null;
+  let text;
+  if (typeof value === "string") {
+    text = value;
+  } else {
+    try {
+      text = JSON.stringify(value);
+    } catch {
+      text = String(value);
+    }
+  }
+  const redacted = redactSecrets(String(text));
+  return redacted.length > max
+    ? `${redacted.slice(0, Math.max(0, max - 1))}…`
+    : redacted;
+}
+
+function stableValue(value) {
+  if (Array.isArray(value)) return value.map(stableValue);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.keys(value)
+      .filter((key) => value[key] !== undefined)
+      .sort()
+      .map((key) => [key, stableValue(value[key])]),
+  );
+}
+
+function digest(value) {
+  return `sha256:${createHash("sha256")
+    .update(JSON.stringify(stableValue(value)))
+    .digest("hex")}`;
+}
+
+function canonicalDecision(
+  value,
+  { blocked = false, requiresApproval = false } = {},
+) {
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
+  if (
+    blocked ||
+    ["block", "blocked", "deny", "denied", "decline", "cancel"].includes(
+      normalized,
+    )
+  ) {
+    return "deny";
+  }
+  if (
+    requiresApproval ||
+    ["ask", "confirm", "approval_required", "require_confirmation"].includes(
+      normalized,
+    )
+  ) {
+    return "ask";
+  }
+  return "allow";
+}
+
+function normalizeChain(value) {
+  if (!Array.isArray(value)) return [];
+  return value.slice(0, MAX_CHAIN).map((candidate) => {
+    const row =
+      candidate && typeof candidate === "object" && !Array.isArray(candidate)
+        ? candidate
+        : {};
+    return {
+      layer: boundedText(row.layer, 80),
+      outcome: boundedText(row.outcome, 80),
+      via: boundedText(row.via || row.source, 120),
+      rule: boundedText(row.rule, 256),
+      reason: boundedText(row.reason, 512),
+    };
+  });
+}
+
+function finalizePolicyDecision(value) {
+  const projection = Object.fromEntries(
+    Object.entries(value).filter(([, entry]) => entry !== undefined),
+  );
+  const policyDigest = digest(projection);
+  return Object.freeze({
+    type: "policy_decision",
+    schema_version: POLICY_DECISION_EVENT_VERSION,
+    decision_id:
+      boundedText(projection.decision_id, 160) ||
+      `policy:${policyDigest.slice("sha256:".length, "sha256:".length + 48)}`,
+    ...projection,
+    policy_digest: policyDigest,
+  });
+}
+
+export function projectHookPolicyDecision(event = {}) {
+  if (event?.type !== "hook_response") return null;
+  return finalizePolicyDecision({
+    source: "hook",
+    decision: canonicalDecision(event.decision, {
+      blocked: event.blocked === true || Boolean(event.error),
+      requiresApproval: event.requires_approval === true,
+    }),
+    session_id: boundedText(event.session_id, 160) || undefined,
+    turn_id: boundedText(event.turn_id, 160) || undefined,
+    tool_use_id: boundedText(event.tool_use_id, 160) || undefined,
+    tool: boundedText(event.tool || event.tool_name, 256) || undefined,
+    hook_event: boundedText(event.hook_event, 96) || undefined,
+    via: boundedText(
+      event.via || (event.hook_event ? `hook:${event.hook_event}` : "hook"),
+      120,
+    ),
+    reason: event.error ? "hook_runtime_error" : undefined,
+  });
+}
+
+export function projectToolPolicyDecision(event = {}, context = {}) {
+  const permission =
+    event?.permission_decision &&
+    typeof event.permission_decision === "object" &&
+    !Array.isArray(event.permission_decision)
+      ? event.permission_decision
+      : null;
+  if (!permission) return null;
+  return finalizePolicyDecision({
+    decision_id:
+      boundedText(permission.id || event.permission_decision_id, 160) ||
+      undefined,
+    source: "tool",
+    decision: canonicalDecision(permission.decision),
+    session_id:
+      boundedText(context.sessionId || event.session_id, 160) || undefined,
+    turn_id: boundedText(context.turnId || event.turn_id, 160) || undefined,
+    tool_use_id:
+      boundedText(context.toolUseId || event.tool_use_id || event.id, 160) ||
+      undefined,
+    tool: boundedText(event.tool || permission.tool, 256) || undefined,
+    via: boundedText(permission.via, 120) || undefined,
+    rule: boundedText(permission.rule, 256) || undefined,
+    reason: boundedText(permission.reason, 512) || undefined,
+    chain: normalizeChain(permission.chain),
+  });
+}

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -2208,7 +2208,7 @@ function cleanupWindowsTemporaryPath(
       }
       if (
         !expectedIdentity ||
-        !sameWindowsFileIdentity(inspected.identity, expectedIdentity)
+        !sameWindowsFileObjectIdentity(inspected.identity, expectedIdentity)
       ) {
         return false;
       }
@@ -2719,6 +2719,20 @@ function sameWindowsFileIdentity(left, right) {
   );
 }
 
+// Cleanup is authorized by the stable file-object identity, not by metadata
+// that Windows may settle after the helper closes its last write handle.  The
+// strict identity above remains authoritative while content is read or
+// attested; this cleanup-only comparison still rejects a same-path replacement
+// because that changes the inode/birth identity.
+function sameWindowsFileObjectIdentity(left, right) {
+  return (
+    left.dev === right.dev &&
+    left.ino === right.ino &&
+    left.mode === right.mode &&
+    left.birthtimeNs === right.birthtimeNs
+  );
+}
+
 function inspectWindowsAdapterAssembly(runtime, assemblyPath) {
   const boundBefore = inspectWindowsAdapterBoundPath(
     runtime,

package/src/lib/record-replay/index.js

@@ -1 +1,2 @@
 export * from "./skill-recorder.js";
+export * from "./playwright-ui-driver.js";