chainlesschain 0.166.79 → 0.166.81

package/src/runtime/agent-core.js

@@ -2443,12 +2443,16 @@ function selectedHostToolPolicy(hostAuthority, tool) {
 function snapshotPlanToolAuthority(planManager, tool, args) {
   const active = planManager?.isActive?.() === true;
   return {
+    revision:
+      Number.isSafeInteger(planManager?.revision) && planManager.revision >= 0
+        ? planManager.revision
+        : null,
     active,
     executionLockActive: planManager?.executionLock != null,
     toolAllowed:
       !active || (tool === "git" && isReadOnlyGitCommand(args?.command))
         ? true
-        : planManager?.isToolAllowed?.(tool) === true,
+        : planManager?.isToolAllowed?.(tool, { recordBlocked: false }) === true,
   };
 }
 
@@ -2546,6 +2550,10 @@ function snapshotApprovalPolicyAuthority(approvalGate, sessionId) {
  */
 export async function executeTool(name, args, context = {}) {
   const liveExecutionContext = context;
+  let admittedApprovalGate = null;
+  let admittedApprovalPolicyDigest = null;
+  let entryPlanManager = null;
+  let entryPlanPolicyDigest = null;
   // run_shell can cross several asynchronous permission/hook boundaries before
   // reaching executeToolInner. Capture its declared tuple and working directory
   // before any of them so an in-process caller cannot swap the approved command
@@ -2599,6 +2607,31 @@ export async function executeTool(name, args, context = {}) {
       };
     }
   }
+  if (name === "run_shell") {
+    try {
+      admittedApprovalGate = context.approvalGate || null;
+      admittedApprovalPolicyDigest = digestPolicyAuthority(
+        snapshotApprovalPolicyAuthority(
+          admittedApprovalGate,
+          context.sessionId || null,
+        ),
+      );
+      entryPlanManager = context.planManager || getPlanModeManager();
+      entryPlanPolicyDigest = digestPolicyAuthority(
+        snapshotPlanToolAuthority(entryPlanManager, name, args),
+      );
+    } catch (error) {
+      return {
+        error:
+          "[Shell Dispatch] The initial shell policy authority could not be bound. No command side effect was started.",
+        policy: {
+          decision: "blocked",
+          via: "shell-policy-authority",
+          code: error?.code || "CC_SHELL_POLICY_AUTHORITY_UNAVAILABLE",
+        },
+      };
+    }
+  }
   if (name === "run_code") {
     try {
       const entryProcessCwd = process.cwd();
@@ -3019,9 +3052,20 @@ export async function executeTool(name, args, context = {}) {
   let admittedPlanPolicyDigest = null;
   if (name === "run_shell") {
     try {
-      admittedPlanPolicyDigest = digestPolicyAuthority(
+      const currentPlanPolicyDigest = digestPolicyAuthority(
         snapshotPlanToolAuthority(planManager, name, args),
       );
+      if (
+        planManager !== entryPlanManager ||
+        currentPlanPolicyDigest !== entryPlanPolicyDigest
+      ) {
+        const error = new Error(
+          "Plan authority changed during initial permission resolution",
+        );
+        error.code = "CC_SHELL_POLICY_AUTHORITY_CHANGED";
+        throw error;
+      }
+      admittedPlanPolicyDigest = currentPlanPolicyDigest;
     } catch (error) {
       return {
         error:
@@ -3380,6 +3424,9 @@ export async function executeTool(name, args, context = {}) {
         classifyAllShell: context.classifyAllShell === true,
       };
       if (
+        approvalGate !== admittedApprovalGate ||
+        digestPolicyAuthority(initialProjection.approval) !==
+          admittedApprovalPolicyDigest ||
         digestPolicyAuthority(initialProjection.permission) !==
           admittedPermissionPolicyDigest ||
         digestPolicyAuthority(initialProjection.host) !==
@@ -3398,8 +3445,23 @@ export async function executeTool(name, args, context = {}) {
         throw error;
       }
       const initialDigest = digestPolicyAuthority(initialProjection);
+      const dockerSandboxDigest =
+        context.sandbox?.engine === "docker-egress"
+          ? digestPolicyAuthority(context.sandbox)
+          : null;
       shellDispatchPolicyAuthority = Object.freeze({
         policyVersion: `cc-shell-policy-authority/v1:${initialDigest}`,
+        revalidateDockerSandbox() {
+          if (
+            !dockerSandboxDigest ||
+            digestPolicyAuthority(liveExecutionContext.sandbox || null) !==
+              dockerSandboxDigest
+          ) {
+            const error = new Error("Docker egress sandbox authority changed");
+            error.code = "CC_SHELL_POLICY_AUTHORITY_CHANGED";
+            throw error;
+          }
+        },
         async revalidate() {
           try {
             if (
@@ -6643,9 +6705,8 @@ async function executeToolInner(
           executeSandboxedShell,
           sandboxSummary,
         } = await import("../lib/agent-sandbox.js");
-        // Keep the proxy on a separate event loop: the legacy sandbox dispatch
-        // below is synchronous. The sandbox still refuses domain-restricted
-        // execution until a non-bypassable network backend is available.
+        // Keep the proxy on a separate event loop for legacy synchronous
+        // dispatch. The Docker egress route uses an asynchronous session.
         const sboxPolicy = shellSandbox.policy || {};
         const needsEgress =
           shellSandbox.network === true &&
@@ -6658,6 +6719,9 @@ async function executeToolInner(
         let privateSocketDir = null;
         let dockerEgressSession = null;
         let proxyFailed = false;
+        let authorityMonitor = null;
+        let removePlanAuthorityListener = null;
+        let removeApprovalAuthorityListener = null;
         if (needsEgress) {
           try {
             const { startEgressProxyWorker } =
@@ -6681,7 +6745,11 @@ async function executeToolInner(
                   : {}),
                 onFailure() {
                   proxyFailed = true;
-                  void dockerEgressSession?.close().catch(() => {});
+                  authorityMonitor?.revoke(
+                    Object.assign(new Error("Docker egress broker failed"), {
+                      code: "CC_DOCKER_EGRESS_BROKER_FAILED",
+                    }),
+                  );
                 },
               },
             );
@@ -6696,10 +6764,74 @@ async function executeToolInner(
         let result;
         try {
           // Proxy startup and dynamic imports are asynchronous. Re-read the
-          // live authority once more after they settle and immediately before
-          // the synchronous sandbox dispatch.
-          await shellDispatchPolicyAuthority?.revalidate?.();
-          refreshPluginExecutionAuthority();
+          // live authority after they settle and before sandbox dispatch.
+          if (dockerEgress && proxyHandle?.socketPath) {
+            const { createDockerEgressAuthorityMonitor } =
+              await import("../lib/sandbox-egress-authority-monitor.js");
+            authorityMonitor = createDockerEgressAuthorityMonitor({
+              async revalidate() {
+                await shellDispatchPolicyAuthority?.revalidate?.();
+                shellDispatchPolicyAuthority?.revalidateDockerSandbox?.();
+                refreshPluginExecutionAuthority();
+                if (pluginBinSandboxPolicy) {
+                  const error = new Error(
+                    "A plugin sandbox authority appeared while Docker egress was running",
+                  );
+                  error.code = "ERR_PLUGIN_BIN_SANDBOX_ROUTE_CONFLICT";
+                  error.pluginBinFailClosed = true;
+                  throw error;
+                }
+                if (proxyFailed || proxyHandle.revision !== 0) {
+                  const error = new Error(
+                    "Docker egress authority changed during execution",
+                  );
+                  error.code = "CC_DOCKER_EGRESS_AUTHORITY_CHANGED";
+                  throw error;
+                }
+              },
+              abortProxy: () => proxyHandle.abort(),
+            });
+            if (
+              Number.isSafeInteger(planManager?.revision) &&
+              planManager.revision >= 0 &&
+              typeof planManager.on === "function" &&
+              typeof planManager.off === "function"
+            ) {
+              const onPlanMutation = () => {
+                const error = new Error(
+                  "Plan authority changed during Docker egress execution",
+                );
+                error.code = "CC_SHELL_POLICY_AUTHORITY_CHANGED";
+                authorityMonitor.revoke(error);
+              };
+              planManager.on("revision-changed", onPlanMutation);
+              removePlanAuthorityListener = () =>
+                planManager.off("revision-changed", onPlanMutation);
+            }
+            if (
+              sessionId &&
+              typeof approvalGate?.subscribePolicyRevision === "function"
+            ) {
+              removeApprovalAuthorityListener =
+                approvalGate.subscribePolicyRevision(sessionId, () => {
+                  const error = new Error(
+                    "Approval policy changed during Docker egress execution",
+                  );
+                  error.code = "CC_SHELL_POLICY_AUTHORITY_CHANGED";
+                  authorityMonitor.revoke(error);
+                });
+              if (typeof removeApprovalAuthorityListener !== "function") {
+                throw new TypeError(
+                  "approval policy revision subscription must return an unsubscribe function",
+                );
+              }
+            }
+            authorityMonitor.start();
+            await authorityMonitor.checkNow();
+          } else {
+            await shellDispatchPolicyAuthority?.revalidate?.();
+            refreshPluginExecutionAuthority();
+          }
           if (pluginBinSandboxPolicy) {
             const error = new Error(
               "A plugin sandbox authority appeared while the legacy shell sandbox was starting",
@@ -6737,23 +6869,13 @@ async function executeToolInner(
                 auditContext: createShellProcessAuditContext(),
                 onSession(session) {
                   dockerEgressSession = session;
-                  if (proxyFailed) void session.close().catch(() => {});
+                  authorityMonitor.attachSession(session);
                 },
                 async beforeStart() {
-                  await shellDispatchPolicyAuthority?.revalidate?.();
-                  refreshPluginExecutionAuthority();
-                  if (
-                    proxyFailed ||
-                    proxyHandle.revision !== 0 ||
-                    pluginBinSandboxPolicy
-                  ) {
-                    const error = new Error(
-                      "Docker egress authority changed before target start",
-                    );
-                    error.code = "CC_DOCKER_EGRESS_AUTHORITY_CHANGED";
-                    throw error;
-                  }
+                  await authorityMonitor.checkFresh();
+                  authorityMonitor.assertAuthorized();
                 },
+                beforeReceipt: () => authorityMonitor.finish(),
               },
             );
           } else {
@@ -6767,6 +6889,10 @@ async function executeToolInner(
             });
           }
         } finally {
+          removeApprovalAuthorityListener?.();
+          removePlanAuthorityListener?.();
+          authorityMonitor?.stop();
+          await authorityMonitor?.awaitCleanup();
           if (dockerEgressSession) {
             try {
               await dockerEgressSession.close();
@@ -6792,6 +6918,29 @@ async function executeToolInner(
             }
           }
         }
+        if (dockerEgress && authorityMonitor?.revocationError) {
+          const revoked = authorityMonitor.revocationError;
+          result.authorityFailure = {
+            code: revoked.code || "CC_DOCKER_EGRESS_AUTHORITY_CHANGED",
+            ...(revoked.cleanupError ? { cleanupFailed: true } : {}),
+          };
+          if (result.exitCode === 0) {
+            result = {
+              ...result,
+              exitCode: 1,
+              stderr:
+                "Docker egress authority was revoked; execution outcome must not be retried automatically.",
+              executionOutcome: "completed-cleanup-unknown",
+              retrySafe: false,
+              sandboxCapabilities: assessAgentSandboxCapabilities(
+                shellSandbox,
+                {
+                  execution: { attempted: true, outcomeUnknown: true },
+                },
+              ),
+            };
+          }
+        }
         const common = {
           sandbox: sandboxSummary(shellSandbox),
           sandboxCapabilities: result.sandboxCapabilities || null,
@@ -6801,6 +6950,9 @@ async function executeToolInner(
                 retrySafe: result.retrySafe,
               }
             : {}),
+          ...(result.authorityFailure
+            ? { authorityFailure: result.authorityFailure }
+            : {}),
           shellCommandPolicy: shellPolicy,
           approval: approvalOutcome,
           policyTrace: ["shell-policy", "approval", "sandbox"],

package/src/assets/web-panel/assets/ChatBubbleRenderer-hsBsrl31.js

@@ -1 +0,0 @@
-import{I as v,P as m,J as S,U as n,R as a,S as y,K as C,Q as x,V as w,_ as B,b as s}from"./vendor-Bn1JzzAn.js";import{_ as k}from"./index-C7-T-u0L.js";import"./icons-DG5UD-6K.js";const N={__name:"ChatBubbleRenderer",props:{event:{type:Object,required:!0}},setup(c,{expose:d}){d();const t=c,r=s(()=>{const e=t.event.content||{};return e.text||e.body||e.message||e.title||JSON.stringify(e).slice(0,200)}),i=s(()=>{const e=t.event.content||{};return e.from||e.sender||e.senderName||t.event.actor||"(unknown)"}),l=s(()=>{const e=(t.event.actor||"").toLowerCase();return e.includes("self")||e==="me"||e.endsWith("_self")}),o=s(()=>{const e=t.event.source.adapter||"";return e.startsWith("messaging-qq")?"magenta":e==="wechat"?"green":"blue"}),u=s(()=>{if(!t.event.occurredAt)return"";try{const e=new Date(t.event.occurredAt),p=e.getFullYear(),b=String(e.getMonth()+1).padStart(2,"0"),f=String(e.getDate()).padStart(2,"0"),g=String(e.getHours()).padStart(2,"0"),h=String(e.getMinutes()).padStart(2,"0");return`${p}-${b}-${f} ${g}:${h}`}catch{return""}}),_={props:t,messageText:r,actorLabel:i,isMine:l,adapterColor:o,formattedTime:u,computed:s};return Object.defineProperty(_,"__isScriptSetup",{enumerable:!1,value:!0}),_}},R={class:"bubble"},T={class:"meta"},M={class:"actor"},O={class:"time"},V={class:"body"};function q(c,d,t,r,i,l){const o=v("a-tag");return m(),S("div",{class:B(["chat-row",{mine:r.isMine}])},[n("div",R,[n("div",T,[n("span",M,a(r.actorLabel),1),n("span",O,a(r.formattedTime),1)]),n("div",V,a(r.messageText),1),t.event.source.adapter?(m(),y(o,{key:0,class:"src",color:r.adapterColor},{default:C(()=>[x(a(t.event.source.adapter),1)]),_:1},8,["color"])):w("v-if",!0)])],2)}const A=k(N,[["render",q],["__scopeId","data-v-49238629"],["__file","/tmp/cc-web-panel-hbrRmO/repo/packages/web-panel/src/components/pdh/renderers/ChatBubbleRenderer.vue"]]);export{A as default};

package/src/assets/web-panel/assets/devWarning-Bz6vqBGV.js

@@ -1 +0,0 @@
-import{Q as r}from"./index-C7-T-u0L.js";const o=((n,a,e)=>{r(n,`[ant-design-vue: ${a}] ${e}`)});export{o as d};

package/src/assets/web-panel/assets/index-1b7DEw-w.js

@@ -1 +0,0 @@
-import{A as o}from"./Row-B8T2-Qv7.js";import{a0 as t}from"./index-C7-T-u0L.js";import"./vendor-Bn1JzzAn.js";import"./responsiveObserve-B72knbW8.js";import"./useFlexGapSupport-BSSnL3f1.js";import"./styleChecker-DXUyqoWY.js";import"./index-B5gj_uCC.js";import"./icons-DG5UD-6K.js";const l=t(o);export{l as default};

package/src/assets/web-panel/assets/index-CfD4tMuW.js

@@ -1 +0,0 @@
-import{C as o}from"./Col-DrNzLpF6.js";import{a0 as t}from"./index-C7-T-u0L.js";import"./vendor-Bn1JzzAn.js";import"./index-B5gj_uCC.js";import"./icons-DG5UD-6K.js";const s=t(o);export{s as default};