chainlesschain 0.166.76 → 0.166.78

package/src/lib/secure-fs.js

@@ -235,9 +235,62 @@ function assertNoLinkTraversal(
   return target;
 }
 
+// Reapplying an unchanged directory DACL propagates to existing children on
+// Windows and changes their ctime, invalidating otherwise intact session
+// witnesses. Serialize check-and-repair across processes and skip a verified
+// owner-only ACL. Keep the post-repair inspection and all traversal guards.
+const WINDOWS_ACL_IDEMPOTENT_REPAIR = String.raw`
+function Test-CcOwnerOnlySecurity($item, $security) {
+  $owner = $security.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+  $rules = @($security.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))
+  if ($owner -ne $sid.Value -or $rules.Count -ne 1 -or ($item.PSIsContainer -and -not $security.AreAccessRulesProtected)) { return $false }
+  $rule = $rules[0]
+  $inheritance = [System.Security.AccessControl.InheritanceFlags]::None
+  if ($item.PSIsContainer) {
+    $inheritance = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
+  }
+  return ($rule.IdentityReference.Value -eq $sid.Value -and
+    $rule.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow -and
+    (-not $item.PSIsContainer -or -not $rule.IsInherited) -and
+    $rule.InheritanceFlags -eq $inheritance -and
+    $rule.PropagationFlags -eq [System.Security.AccessControl.PropagationFlags]::None -and
+    ($rule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -eq [System.Security.AccessControl.FileSystemRights]::FullControl)
+}
+function Write-CcOwnerOnlyAcl($item, [string]$path) {
+  $script:ccAclStage = 'repair-lock'
+  [Console]::Error.WriteLine('CC_WINDOWS_ACL_STAGE=repair-lock')
+  $digest = [System.Security.Cryptography.SHA256]::Create()
+  try {
+    $key = [System.BitConverter]::ToString($digest.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($sid.Value + ':' + [System.IO.Path]::GetFullPath($path).ToUpperInvariant()))).Replace('-', '')
+  } finally { $digest.Dispose() }
+  $mutex = [System.Threading.Mutex]::new($false, ('Global\ChainlessChain.PrivateAcl.' + $key))
+  $held = $false
+  try {
+    try { $held = $mutex.WaitOne(10000) }
+    catch [System.Threading.AbandonedMutexException] { $held = $true }
+    if (-not $held) { throw 'Timed out waiting for owner-only ACL repair' }
+    Assert-CcNoReparseTraversal $path
+    $script:ccAclStage = 'repair-inspect'
+    [Console]::Error.WriteLine('CC_WINDOWS_ACL_STAGE=repair-inspect')
+    $current = Get-Item -LiteralPath $path -Force
+    $security = Read-CcAcl $path
+    if (Test-CcOwnerOnlySecurity $current $security) { return }
+    $script:ccAclStage = 'repair-write'
+    [Console]::Error.WriteLine('CC_WINDOWS_ACL_STAGE=repair-write')
+    Write-CcOwnerOnlyAclImpl $current $path
+  } finally {
+    if ($held) { $mutex.ReleaseMutex() }
+    $mutex.Dispose()
+  }
+}
+`;
+
 const WINDOWS_ACL_SCRIPT = String.raw`
 param([string]$target, [string]$operation)
 $ErrorActionPreference = 'Stop'
+$script:ccAclStage = 'initialize'
+try {
+[Console]::Error.WriteLine('CC_WINDOWS_ACL_STAGE=initialize')
 $utf8 = [System.Text.UTF8Encoding]::new($false)
 [Console]::OutputEncoding = $utf8
 $sections =
@@ -263,7 +316,11 @@ function Assert-CcNoReparseTraversal([string]$path) {
   }
 }
 
+$script:ccAclStage = 'traversal'
+[Console]::Error.WriteLine('CC_WINDOWS_ACL_STAGE=traversal')
 Assert-CcNoReparseTraversal $target
+$script:ccAclStage = 'lookup'
+[Console]::Error.WriteLine('CC_WINDOWS_ACL_STAGE=lookup')
 $item = Get-Item -LiteralPath $target -Force
 
 function Read-CcAcl([string]$path) {
@@ -273,7 +330,8 @@ function Read-CcAcl([string]$path) {
   return [System.Security.AccessControl.FileSecurity]::new($path, $sections)
 }
 
-function Write-CcOwnerOnlyAcl($item, [string]$path) {
+${WINDOWS_ACL_IDEMPOTENT_REPAIR}
+function Write-CcOwnerOnlyAclImpl($item, [string]$path) {
   $security = Read-CcAcl $path
   $owner = $security.GetOwner([System.Security.Principal.SecurityIdentifier])
   if ($owner.Value -ne $sid.Value) {
@@ -322,6 +380,8 @@ if ($operation -eq 'repair') {
   Write-CcOwnerOnlyAcl $item $target
 }
 
+$script:ccAclStage = 'verify'
+[Console]::Error.WriteLine('CC_WINDOWS_ACL_STAGE=verify')
 $acl = Read-CcAcl $target
 $owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
 $rules = @($acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))
@@ -366,6 +426,18 @@ if ($ownerOnly) {
   aceCount = $rules.Count
 } | ConvertTo-Json -Compress
 if (-not $ownerOnly) { exit 4 }
+} catch {
+  # Emit only a fixed stage and the deepest native HRESULT. Never emit the
+  # exception message, target path or arbitrary PowerShell error record.
+  $failure = $_.Exception
+  while ($null -ne $failure.InnerException) { $failure = $failure.InnerException }
+  [pscustomobject]@{
+    ownerOnly = $false
+    failureStage = $script:ccAclStage
+    hresult = ('0x{0:X8}' -f $failure.HResult)
+  } | ConvertTo-Json -Compress
+  exit 5
+}
 `;
 
 const WINDOWS_ACL_BATCH_SCRIPT = String.raw`
@@ -481,7 +553,8 @@ function Read-CcAcl([string]$path) {
   return [System.Security.AccessControl.FileSecurity]::new($path, $sections)
 }
 
-function Write-CcOwnerOnlyAcl($item, [string]$path) {
+${WINDOWS_ACL_IDEMPOTENT_REPAIR}
+function Write-CcOwnerOnlyAclImpl($item, [string]$path) {
   $security = Read-CcAcl $path
   $owner = $security.GetOwner([System.Security.Principal.SecurityIdentifier])
   if ($owner.Value -ne $sid.Value) {
@@ -614,19 +687,48 @@ export const _deps = {
 };
 
 // ACL repair starts a short PowerShell process on Windows. Cache successful
-// production repairs by path for this process; explicit injected-dependency
+// production repairs by path and filesystem identity for this process; injected-dependency
 // tests and repairPrivatePath() always execute and verify the operation.
-const securedWindowsPaths = new Set();
+const securedWindowsPaths = new Map();
+
+function windowsPathIdentity(target, deps) {
+  try {
+    const entry = deps.fs.lstatSync(target, { bigint: true });
+    if (entry.isSymbolicLink() || !entry.ino) return null;
+    return `${entry.dev}:${entry.ino}:${entry.birthtimeNs}`;
+  } catch {
+    // An unreliable Node stat must take the native verification path again.
+    return null;
+  }
+}
+
+function rememberSecuredWindowsPath(target, deps) {
+  const identity = windowsPathIdentity(target, deps);
+  if (identity) securedWindowsPaths.set(target, identity);
+  else securedWindowsPaths.delete(target);
+}
+
+function isSecuredWindowsPath(target, deps) {
+  const cached = securedWindowsPaths.get(target);
+  return Boolean(cached && cached === windowsPathIdentity(target, deps));
+}
 const WINDOWS_ACL_BATCH_SIZE = 500;
 const WINDOWS_ACL_TIMEOUT_ENV = "CC_SECURE_FS_WINDOWS_ACL_TIMEOUT_MS";
 const MAX_WINDOWS_ACL_TIMEOUT_MS = 5 * 60_000;
-const WINDOWS_ACL_TIMEOUT_RETRY_LIMIT = 1;
 
 export function _windowsAclWorkingDirectory(
   environment = process.env,
   filesystem = fs,
 ) {
-  if (!isFormalQualityHermeticRuntime(environment)) return null;
+  // Isolated profiles can make Windows PowerShell first-use caches relative
+  // to cwd. Contain those writes in application state, never the source tree.
+  const isolatedLocalTarget =
+    typeof environment.CC_EXECUTION_LOCATION_RUNNER_ID === "string" &&
+    environment.CC_EXECUTION_LOCATION_RUNNER_ID.length > 0 &&
+    typeof environment.CHAINLESSCHAIN_HOME === "string" &&
+    isNativeAbsolute(environment.CHAINLESSCHAIN_HOME);
+  if (!isFormalQualityHermeticRuntime(environment) && !isolatedLocalTarget)
+    return null;
   const configuredHome = resolve(String(environment.CHAINLESSCHAIN_HOME));
   try {
     const entry = filesystem.lstatSync(configuredHome);
@@ -654,44 +756,25 @@ export function _resolveWindowsAclTimeout(
   );
 }
 
-// A timed-out spawn has already been terminated by Node. Retrying that one
-// transient runner-startup failure is safe: preflight is read-only and ACL
-// repair is idempotent. Both attempts share the caller's original timeout
-// budget so a busy Windows runner cannot multiply synchronous blocking time.
-// Every other failure remains fail-closed so this never treats a script, parse,
-// or permission failure as a transient condition.
+// Give one cold PowerShell process the full bounded operation budget. Splitting
+// it into two shorter spawns repeatedly kills a slow startup before it can
+// finish (and can leave less time than the native mutex's 10-second wait).
+// A process that exhausts the budget remains a failure; never start another
+// process with a fresh budget or accept an unverified ACL after a timeout.
 function runWindowsAclCommand(deps, args, options) {
-  const totalTimeoutMs = Math.max(1, Math.floor(Number(options?.timeout) || 1));
-  const retryTimeoutMs = Math.max(
-    1,
-    Math.floor(totalTimeoutMs / (WINDOWS_ACL_TIMEOUT_RETRY_LIMIT + 1)),
-  );
-  const firstTimeoutMs = Math.max(1, totalTimeoutMs - retryTimeoutMs);
-  let result = deps.spawnSync("powershell.exe", args, {
+  return deps.spawnSync("powershell.exe", args, {
     ...options,
-    timeout: firstTimeoutMs,
+    timeout: Math.max(1, Math.floor(Number(options?.timeout) || 1)),
   });
-  for (
-    let attempt = 0;
-    result?.error?.code === "ETIMEDOUT" &&
-    attempt < WINDOWS_ACL_TIMEOUT_RETRY_LIMIT;
-    attempt += 1
-  ) {
-    result = deps.spawnSync("powershell.exe", args, {
-      ...options,
-      timeout: retryTimeoutMs,
-    });
-  }
-  return result;
 }
 
 function repairWindowsAclOnce(target, deps, options) {
   const cacheable = !options.deps;
-  if (cacheable && securedWindowsPaths.has(target)) {
+  if (cacheable && isSecuredWindowsPath(target, deps)) {
     return { ok: true, platform: "win32", cached: true };
   }
   const result = windowsAcl(target, "repair", deps);
-  if (result.ok && cacheable) securedWindowsPaths.add(target);
+  if (result.ok && cacheable) rememberSecuredWindowsPath(target, deps);
   return result;
 }
 
@@ -724,21 +807,54 @@ function windowsAcl(target, operation, deps) {
     details = null;
   }
   if (result?.error) {
-    return { ok: false, platform: "win32", error: result.error.message };
+    const progress =
+      [
+        ...String(result.stderr || "")
+          .slice(0, 8192)
+          .matchAll(
+            /^CC_WINDOWS_ACL_STAGE=(initialize|traversal|lookup|repair-lock|repair-inspect|repair-write|verify)\r?$/gmu,
+          ),
+      ].at(-1)?.[1] || "startup";
+    const stage =
+      result.error.code === "ETIMEDOUT" ? `timeout-${progress}` : "spawn";
+    return {
+      ok: false,
+      platform: "win32",
+      error: `owner-only ACL process failed [windows-acl:${stage}]`,
+    };
   }
   if (result?.status !== 0 || details?.ownerOnly !== true) {
     return {
       ok: false,
       platform: "win32",
-      error:
-        String(result?.stderr || "").trim() ||
-        `owner-only ACL verification exited ${result?.status}`,
+      error: `owner-only ACL verification failed ${windowsAclFailureMarker(details)}`,
       details,
     };
   }
   return { ok: true, platform: "win32", details };
 }
 
+function windowsAclFailureMarker(details) {
+  const allowedStages = new Set([
+    "initialize",
+    "traversal",
+    "lookup",
+    "repair-lock",
+    "repair-inspect",
+    "repair-write",
+    "verify",
+  ]);
+  if (
+    allowedStages.has(details?.failureStage) &&
+    /^0x[0-9a-f]{8}$/iu.test(details?.hresult || "")
+  ) {
+    return `[windows-acl:${details.failureStage}:${details.hresult.toLowerCase()}]`;
+  }
+  return details?.ownerOnly === false
+    ? "[windows-acl:verify]"
+    : "[windows-acl:output]";
+}
+
 function windowsAclBatch(targets, operation, deps, expectedKind = null) {
   if (targets.length === 0) return [];
   const workingDirectory = _windowsAclWorkingDirectory(process.env, deps.fs);
@@ -999,7 +1115,7 @@ export function repairPrivatePaths(targets, options = {}) {
     if (!options.deps) {
       for (const result of results) {
         if (result.ok && result.exists !== false) {
-          securedWindowsPaths.add(result.target);
+          rememberSecuredWindowsPath(result.target, deps);
         }
       }
     }
@@ -1064,7 +1180,7 @@ function repairPrivatePathAfterPreflight(target, options, deps) {
     const result = windowsAcl(target, "repair", deps);
     if (!result.ok)
       throw new Error(result.error || "owner-only ACL repair failed");
-    if (!options.deps) securedWindowsPaths.add(target);
+    if (!options.deps) rememberSecuredWindowsPath(target, deps);
     return result;
   }
   const stat = deps.fs.lstatSync(target);
@@ -1183,7 +1299,7 @@ export function ensurePrivateFile(target, options = {}) {
     }
   } else if (
     options.applyWindowsAcl === true &&
-    (options.deps || !securedWindowsPaths.has(target))
+    (options.deps || !isSecuredWindowsPath(target, deps))
   ) {
     const [result] = windowsAclBatch([String(target)], "repair", deps, "file");
     if (result.errorCode === "EXPECTED_KIND_MISMATCH") {
@@ -1192,7 +1308,7 @@ export function ensurePrivateFile(target, options = {}) {
     if (!result.ok && result.exists !== false && options.failIfUnavailable) {
       throw new Error(result.error || `Could not secure ${target}`);
     }
-    if (result.ok && !options.deps) securedWindowsPaths.add(target);
+    if (result.ok && !options.deps) rememberSecuredWindowsPath(target, deps);
   }
   return target;
 }

package/src/lib/session-branch-history.js

@@ -0,0 +1,240 @@
+import { canonicalDigest } from "@chainlesschain/context-memory-kernel";
+import { createHash } from "node:crypto";
+import { SESSION_GENERATION_AUTHORITY_FIELD } from "../harness/session-list-index.js";
+import {
+  encodePersistedMessage,
+  decodeVerifiedPersistedMessage,
+  getDurableSystemMessageProvenance,
+  projectCanonicalResumeMessages,
+} from "./session-message-provenance.js";
+
+export const BRANCH_HISTORY_SCHEMA = "chainlesschain.session-branch-history/v1";
+export const BRANCH_HISTORY_SYSTEM_ORIGINS_SCHEMA =
+  "chainlesschain.session-branch-history/v2";
+export const BRANCH_HISTORY_MESSAGE = "session_history_message";
+export const BRANCH_HISTORY_ORIGIN = "session_history_origin";
+const capabilities = new WeakMap();
+
+export const branchContextDigest = (messages) =>
+  canonicalDigest(
+    projectCanonicalResumeMessages(messages, { strict: true }).map(
+      encodePersistedMessage,
+    ),
+    "chainlesschain.branch-history-context/v1",
+  );
+export const branchMessageDigest = (message) =>
+  canonicalDigest(message, "chainlesschain.branch-history-message/v1");
+
+// A caller cannot smuggle JSON-shaped history into a new authority chain. The
+// capability exists only inside a verified source projection's synchronous lock.
+export function withSessionBranchHistory(plan, task) {
+  if (typeof task !== "function" || task.constructor?.name === "AsyncFunction")
+    throw new TypeError("Branch history consumer must be synchronous");
+  const capability = Object.freeze({});
+  capabilities.set(capability, plan);
+  try {
+    const result = task(capability);
+    if (result && typeof result.then === "function")
+      throw new TypeError("Branch history consumer must be synchronous");
+    return result;
+  } finally {
+    capabilities.delete(capability);
+  }
+}
+
+export function resolveSessionBranchHistory(
+  capability,
+  parentSessionId,
+  messages,
+) {
+  if (capability == null) return null;
+  const plan = capabilities.get(capability);
+  if (
+    !plan ||
+    plan.parentSessionId !== parentSessionId ||
+    plan.contextDigest !== branchContextDigest(messages)
+  ) {
+    throw new Error(
+      "Branch history capability is expired or does not match the branch",
+    );
+  }
+  return plan;
+}
+
+export function createBranchHistoryImport() {
+  let start = null;
+  let index = 0;
+  let active = null;
+  const hash = (value) =>
+    typeof value === "string" && /^[a-f0-9]{64}$/u.test(value);
+  const integer = (value) => Number.isSafeInteger(value) && value >= 0;
+  const invalid = () => {
+    const error = new Error(
+      "Branch display history is incomplete or inconsistent",
+    );
+    error.code = "SESSION_BRANCH_HISTORY_INVALID";
+    throw error;
+  };
+  const require = (condition) => {
+    if (!condition) invalid();
+  };
+  return {
+    accept(event) {
+      index += 1;
+      if (index === 1 && event.type === "session_start") {
+        const data = { ...event.data };
+        delete data[SESSION_GENERATION_AUTHORITY_FIELD];
+        start = { type: event.type, data };
+      }
+      if (event.type === "session_branch" && event.data?.history != null) {
+        const descriptor = event.data.history;
+        require(
+          index === 2 &&
+            start &&
+            !active &&
+            [
+              BRANCH_HISTORY_SCHEMA,
+              BRANCH_HISTORY_SYSTEM_ORIGINS_SCHEMA,
+            ].includes(descriptor.schema) &&
+            hash(descriptor.sourceGeneration) &&
+            integer(descriptor.totalMessages) &&
+            integer(descriptor.contextMessageCount) &&
+            descriptor.contextMessageCount <= 32768,
+        );
+        const coverage = descriptor.coverage;
+        require(
+          coverage?.kind === "from-origin"
+            ? coverage.boundaryEvent === null && coverage.reason === null
+            : coverage?.kind === "snapshot-boundary" &&
+                hash(coverage.boundaryEvent) &&
+                [
+                  "timeline-replacement",
+                  "context-snapshot",
+                  "branch-snapshot",
+                ].includes(coverage.reason),
+        );
+        const digest = createHash("sha256").update(
+          `[${JSON.stringify(start)},${JSON.stringify({ type: event.type, data: event.data })}`,
+        );
+        active = {
+          descriptor,
+          digest,
+          rows: 0,
+          contexts: 0,
+          pending: null,
+          textParts: [],
+          textBytes: 0,
+          textIdentity: null,
+          contextStarted: false,
+        };
+        return { kind: "start", coverage };
+      }
+      if (!active) {
+        if (
+          [BRANCH_HISTORY_MESSAGE, BRANCH_HISTORY_ORIGIN].includes(
+            event.type,
+          ) ||
+          (event.type === "session_branch_complete" &&
+            event.data?.schemaVersion === 2)
+        )
+          invalid();
+        return null;
+      }
+      const state = active;
+      if (event.type === "session_branch_complete") {
+        require(
+          !state.pending &&
+            state.textParts.length === 0 &&
+            state.rows === state.descriptor.totalMessages &&
+            state.contexts === state.descriptor.contextMessageCount &&
+            event.data?.schemaVersion === 2 &&
+            event.data.messageCount === state.contexts &&
+            event.data.inputDigest ===
+              `sha256:${state.digest.update("]").digest("hex")}`,
+        );
+        active = null;
+        return { kind: "complete" };
+      }
+      state.digest.update(
+        `,${JSON.stringify({ type: event.type, data: event.data })}`,
+      );
+      if (event.type === BRANCH_HISTORY_MESSAGE) {
+        const row = event.data;
+        require(
+          !state.contextStarted &&
+            state.rows < state.descriptor.totalMessages &&
+            ["user", "assistant", "tool"].includes(row?.role) &&
+            typeof row.text === "string" &&
+            row.text.length <= 128 * 1024 &&
+            row.part === state.textParts.length &&
+            typeof row.last === "boolean" &&
+            hash(row.sourceEventId) &&
+            integer(row.sourceItemIndex),
+        );
+        const identity = `${row.role}:${row.sourceEventId}:${row.sourceItemIndex}`;
+        require(state.textIdentity === null || state.textIdentity === identity);
+        state.textIdentity = identity;
+        state.textBytes += Buffer.byteLength(row.text);
+        require(
+          state.textBytes <= 16 * 1024 * 1024 && state.textParts.length < 256,
+        );
+        state.textParts.push(row.text);
+        if (!row.last) return { kind: "archive-part" };
+        const message = { role: row.role, content: state.textParts.join("") };
+        state.textParts = [];
+        state.textBytes = 0;
+        state.textIdentity = null;
+        state.rows += 1;
+        return { kind: "archive", message };
+      }
+      if (
+        ["user_message", "assistant_message", "system"].includes(event.type)
+      ) {
+        require(
+          !state.pending &&
+            state.textParts.length === 0 &&
+            state.rows === state.descriptor.totalMessages &&
+            state.contexts < state.descriptor.contextMessageCount &&
+            event.data?.role ===
+              {
+                user_message: "user",
+                assistant_message: "assistant",
+                system: "system",
+              }[event.type],
+        );
+        state.contextStarted = true;
+        state.pending = event.data;
+        return { kind: "context" };
+      }
+      if (event.type === BRANCH_HISTORY_ORIGIN) {
+        const message = state.pending;
+        const origin = event.data?.origin;
+        require(
+          message && event.data.messageDigest === branchMessageDigest(message),
+        );
+        require(
+          origin === null
+            ? message.role === "system"
+            : origin &&
+                integer(origin.first) &&
+                integer(origin.last) &&
+                origin.first <= origin.last &&
+                origin.last < state.rows &&
+                (message.role !== "system" ||
+                  (state.descriptor.schema ===
+                    BRANCH_HISTORY_SYSTEM_ORIGINS_SCHEMA &&
+                    getDurableSystemMessageProvenance(
+                      decodeVerifiedPersistedMessage(message),
+                    ))),
+        );
+        state.contexts += 1;
+        state.pending = null;
+        return { kind: "origin", message, origin };
+      }
+      invalid();
+    },
+    finish() {
+      if (active) invalid();
+    },
+  };
+}