chainlesschain 0.166.81 → 0.166.83

package/src/lib/host-tool-policy-authority.js

@@ -0,0 +1,151 @@
+/** Host-owned policy snapshots and synchronous, irreversible revisions.
+ * Revisions cover commits through this owner in this process. Persisting a
+ * session's latest policy does not make these revisions a durable journal.
+ */
+import { randomUUID } from "node:crypto";
+import { snapshotMcpJsonRpcInput } from "./mcp-call-ledger.js";
+
+const AUTHORITIES = new WeakSet();
+const CHILD_AUTHORITIES = new WeakMap();
+
+function unavailable() {
+  const error = new Error("Host tool policy authority is unavailable");
+  error.code = "CC_HOST_TOOL_POLICY_AUTHORITY_UNAVAILABLE";
+  return error;
+}
+
+function capturePolicy(policy) {
+  if (policy == null) return null;
+  try {
+    const snapshot = snapshotMcpJsonRpcInput(policy);
+    if (typeof snapshot !== "object" || Array.isArray(snapshot))
+      throw unavailable();
+    for (const field of ["tools", "toolPolicies"]) {
+      const policies = snapshot[field];
+      if (policies == null) continue;
+      if (typeof policies !== "object" || Array.isArray(policies))
+        throw unavailable();
+      for (const entry of Object.values(policies)) {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+          throw unavailable();
+        for (const flag of [
+          "allowed",
+          "requiresConfirmation",
+          "requiresPlanApproval",
+          "isReadOnly",
+        ]) {
+          if (entry[flag] !== undefined && typeof entry[flag] !== "boolean")
+            throw unavailable();
+        }
+        if (entry.decision !== undefined && typeof entry.decision !== "string")
+          throw unavailable();
+      }
+    }
+    if (
+      snapshot.toolDefinitions !== undefined &&
+      !Array.isArray(snapshot.toolDefinitions)
+    )
+      throw unavailable();
+    return snapshot;
+  } catch {
+    throw unavailable();
+  }
+}
+
+export function captureHostToolPolicyAuthority(authority) {
+  if (authority == null) return null;
+  if (!AUTHORITIES.has(authority)) throw unavailable();
+  return authority;
+}
+
+/** The host retains the controller; consumers receive only `authority`. */
+export function createHostToolPolicyAuthority(policy = null) {
+  const ownerId = randomUUID();
+  let snapshot = Object.freeze({
+    schema: "chainlesschain.host-tool-policy-authority/v1",
+    ownerId,
+    revision: 0,
+    policy: capturePolicy(policy),
+  });
+  let invalid = false;
+  const listeners = new Set();
+  function publish(nextPolicy) {
+    if (snapshot.revision >= Number.MAX_SAFE_INTEGER) throw unavailable();
+    snapshot = Object.freeze({
+      ...snapshot,
+      revision: snapshot.revision + 1,
+      policy: nextPolicy,
+    });
+    // Commit before notifying. A failing observer cannot hide a revision from
+    // the remaining execution monitors.
+    for (const listener of [...listeners]) {
+      try {
+        listener(snapshot);
+      } catch {
+        // Observer delivery does not roll back committed authority.
+      }
+    }
+    return snapshot;
+  }
+  const authority = Object.freeze({
+    getSnapshot() {
+      if (invalid) throw unavailable();
+      return snapshot;
+    },
+    subscribePolicyRevision(listener) {
+      if (typeof listener !== "function")
+        throw new TypeError("listener required");
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+  });
+  AUTHORITIES.add(authority);
+  return Object.freeze({
+    authority,
+    commit(nextPolicy) {
+      const captured = capturePolicy(nextPolicy);
+      if (
+        !invalid &&
+        JSON.stringify(captured) === JSON.stringify(snapshot.policy)
+      )
+        return snapshot;
+      invalid = false;
+      return publish(captured);
+    },
+    invalidate() {
+      invalid = true;
+      return publish(snapshot.policy);
+    },
+  });
+}
+
+/** Inherit the live ceiling without introducing host definitions into a child. */
+export function hostToolPolicyAuthorityForChild(value) {
+  const parent = captureHostToolPolicyAuthority(value);
+  if (!parent) return null;
+  if (CHILD_AUTHORITIES.has(parent)) return CHILD_AUTHORITIES.get(parent);
+  let previous = null;
+  let projected = null;
+  const child = Object.freeze({
+    getSnapshot() {
+      const current = parent.getSnapshot();
+      if (current !== previous) {
+        projected = Object.freeze({
+          ...current,
+          policy: current.policy
+            ? Object.freeze({
+                ...current.policy,
+                toolDefinitions: Object.freeze([]),
+              })
+            : null,
+        });
+        previous = current;
+      }
+      return projected;
+    },
+    subscribePolicyRevision: parent.subscribePolicyRevision,
+  });
+  AUTHORITIES.add(child);
+  CHILD_AUTHORITIES.set(parent, child);
+  return child;
+}

package/src/lib/permission-authority.js

@@ -1,14 +1,42 @@
 /** Resolve static settings plus CLI-owned workspace-scoped permission rules. */
 
 import settingsLoader from "./settings-loader.cjs";
+import path from "node:path";
 import { ScopedPermissionStore } from "./scoped-permission-store.js";
 
-const { applyManagedPermissionPolicy, loadSettings } = settingsLoader;
+const {
+  applyManagedPermissionPolicy,
+  loadSettings,
+  getSettingsPermissionRevision,
+  subscribeSettingsPermissionRevision,
+} = settingsLoader;
 const KINDS = ["allow", "ask", "deny"];
+const providers = new WeakMap();
+const settingsAuthority = Object.freeze({
+  getSnapshot: getSettingsPermissionRevision,
+  subscribePolicyRevision: subscribeSettingsPermissionRevision,
+});
+
+function freezeSnapshot(value) {
+  if (value && typeof value === "object") {
+    for (const child of Object.values(value)) freezeSnapshot(child);
+    Object.freeze(value);
+  }
+  return value;
+}
 
 function cloneRules(rules) {
   return Object.fromEntries(
-    KINDS.map((kind) => [kind, [...(rules?.[kind] || [])]]),
+    KINDS.map((kind) => {
+      const entries = rules?.[kind] ?? [];
+      if (
+        !Array.isArray(entries) ||
+        entries.some((entry) => typeof entry !== "string")
+      ) {
+        throw new TypeError(`permission ${kind} rules must be a string array`);
+      }
+      return [kind, [...entries]];
+    }),
   );
 }
 
@@ -24,6 +52,7 @@ export function loadPermissionAuthority({
   baseRules = null,
   scopedStore = null,
 } = {}) {
+  const settingsRevision = getSettingsPermissionRevision();
   const loaded = loadSettings({
     cwd,
     settingsFile,
@@ -63,15 +92,48 @@ export function loadPermissionAuthority({
     }
   }
 
-  return {
+  if (getSettingsPermissionRevision() !== settingsRevision) {
+    const error = new Error(
+      "settings changed while permission authority was loading",
+    );
+    error.code = "CC_SETTINGS_PERMISSION_AUTHORITY_CHANGED";
+    throw error;
+  }
+  return freezeSnapshot({
     ...loaded,
     rules,
     sources,
     scoped,
     hasRules: hasRules(rules),
-  };
+    settingsRevision,
+  });
 }
 
 export function createPermissionRulesProvider(options = {}) {
-  return () => loadPermissionAuthority(options);
+  const cwd = path.resolve(options.cwd || process.cwd());
+  const captured = Object.freeze({
+    cwd,
+    settingsFile: options.settingsFile
+      ? path.resolve(cwd, options.settingsFile)
+      : null,
+    managedSettingsFile: options.managedSettingsFile
+      ? path.resolve(options.managedSettingsFile)
+      : null,
+    // Environment kill switches retain live sampling semantics. The source
+    // object cannot be replaced through later changes to the options object.
+    env: options.env || process.env,
+    baseRules: options.baseRules
+      ? freezeSnapshot(cloneRules(options.baseRules))
+      : null,
+    scopedStore: options.scopedStore || null,
+  });
+  const provider = () => loadPermissionAuthority(captured);
+  providers.set(provider, settingsAuthority);
+  return Object.freeze(provider);
+}
+
+// A legacy callback cannot advertise a trusted revision subscription simply
+// by copying properties onto itself. It still receives sampled revalidation.
+export function permissionRulesProviderAuthority(provider) {
+  return providers.get(provider) || null;
 }

package/src/lib/plugin-runtime/settings.js

@@ -17,6 +17,10 @@
 import fs from "fs";
 import { discoverPlugins } from "./scopes.js";
 import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
+import {
+  isPluginAuthorityEnvironmentKey,
+  isValidEnvironmentKey,
+} from "../authority-launch-environment.js";
 
 export const _deps = { readFileSync: fs.readFileSync };
 
@@ -68,7 +72,11 @@ export function collectPluginSettings(opts = {}) {
       !Array.isArray(parsed.env)
     ) {
       for (const [k, v] of Object.entries(parsed.env)) {
-        if (typeof v === "string") {
+        if (
+          typeof v === "string" &&
+          isValidEnvironmentKey(k) &&
+          !isPluginAuthorityEnvironmentKey(k)
+        ) {
           env[k] = v;
           contributed = true;
         }

package/src/lib/remote-read-loop-guard.js

@@ -18,6 +18,19 @@ function pullRequestTarget(repo, id = "list") {
   return { ...githubTarget(repo, "pulls", id), pullRequest: true };
 }
 
+function issueTarget(repo, id = "list") {
+  return { ...githubTarget(repo, "issues", id), issue: true };
+}
+
+const ISSUE_WORKFLOW_GUIDANCE =
+  "Issue investigation: retain the issue, linked PR and workflow run as separate targets, with verified revisions and observed test outcomes. " +
+  "Use gh issue view for an issue and gh pr view for its linked PR; their numbers need not match. " +
+  "Use gh run view <run-id> for one run; gh run list accepts filters, not a positional run ID. " +
+  "For unknown JSON fields, inspect stderr/help and request supported fields without jq or shell pipelines first. " +
+  "A completed metadata read remains evidence after an unrelated command fails; do not restart the same investigation. " +
+  "Once the failing test and source are known, state a falsifiable hypothesis, run the focused reproduction, then make and validate the authorized fix. " +
+  "A merged PR or a passing diagnostic retry alone does not resolve the reported failure. Perform issue closure only when authorized and supported by the requested resolution evidence. ";
+
 function commandFlag(command, names) {
   return new RegExp(
     `(?:^|\\s)(?:${names})(?:=|\\s+)(?:"([^"]*)"|'([^']*)'|([^\\s;&|]+))`,
@@ -27,13 +40,16 @@ function commandFlag(command, names) {
     .find((value) => value !== undefined);
 }
 
-function pullRequestCommandTarget(command) {
+function discussionCommandTarget(command) {
   const match =
-    /(?:^|[\s;&|])gh(?:\.exe)?\s+pr\s+(list|view|diff)\b([^;&|\r\n]*)/i.exec(
+    /(?:^|[\s;&|])gh(?:\.exe)?\s+(pr|issue)\s+(list|view|diff)\b([^;&|\r\n]*)/i.exec(
       command,
     );
   if (!match) return null;
-  const fields = commandFlag(match[2], "--json")?.split(",");
+  const target =
+    match[1].toLowerCase() === "issue" ? issueTarget : pullRequestTarget;
+  const tail = match[3];
+  const fields = commandFlag(tail, "--json")?.split(",");
   // Lightweight status polling is intentional waiting, not repeated review.
   if (
     fields?.length &&
@@ -44,18 +60,20 @@ function pullRequestCommandTarget(command) {
     )
   )
     return null;
-  const repo = commandFlag(match[2], "--repo|-R") || "current-repo";
-  if (match[1].toLowerCase() === "list") return pullRequestTarget(repo);
+  const repo = commandFlag(tail, "--repo|-R") || "current-repo";
+  if (match[2].toLowerCase() === "list") return target(repo);
   const prUrl =
-    /https:\/\/github\.com\/([^/\s]+\/[^/\s]+)\/pull\/(\d+)\b/i.exec(match[2]);
-  if (prUrl) return pullRequestTarget(prUrl[1], prUrl[2]);
+    /https:\/\/github\.com\/([^/\s]+\/[^/\s]+)\/(?:pull|issues)\/(\d+)\b/i.exec(
+      tail,
+    );
+  if (prUrl) return target(prUrl[1], prUrl[2]);
   // Remove flags that consume values before finding the positional PR number.
-  const positional = match[2].replace(
+  const positional = tail.replace(
     /(?:^|\s)(?:--repo|-R|--json|--jq|-q|--template|-t|--color)(?:=|\s+)(?:"[^"]*"|'[^']*'|[^\s]+)/g,
     " ",
   );
   const number = /(?:^|\s)["']?(\d+)["']?(?=\s|$)/.exec(positional)?.[1];
-  return number ? pullRequestTarget(repo, number) : null;
+  return number ? target(repo, number) : null;
 }
 
 function urlTarget(value) {
@@ -69,6 +87,10 @@ function urlTarget(value) {
     };
   }
   if (url.hostname === "github.com") {
+    const issue = /^\/([^/]+\/[^/]+)\/issues(?:\/(\d+))?\/?$/.exec(
+      url.pathname,
+    );
+    if (issue) return issueTarget(issue[1], issue[2]);
     const pr =
       /^\/([^/]+\/[^/]+)\/(?:pulls\/?|pull\/(\d+)(?:\/(?:files|commits|checks))?\/?|pull\/(\d+)\.(?:diff|patch))$/.exec(
         url.pathname,
@@ -87,6 +109,11 @@ function urlTarget(value) {
       );
   }
   if (url.hostname === "api.github.com") {
+    const issue =
+      /^\/repos\/([^/]+\/[^/]+)\/issues(?:\/(\d+)(?:\/(?:comments|events|timeline))?)?\/?$/.exec(
+        url.pathname,
+      );
+    if (issue) return issueTarget(issue[1], issue[2]);
     const pr =
       /^\/repos\/([^/]+\/[^/]+)\/pulls(?:\/(\d+)(?:\/(?:files|commits|reviews|comments))?)?\/?$/.exec(
         url.pathname,
@@ -144,8 +171,8 @@ export function remoteReadTarget(tool, args = {}) {
   }
   if (tool !== "run_shell") return null;
   const command = typeof args.command === "string" ? args.command : "";
-  const pr = pullRequestCommandTarget(command);
-  if (pr) return pr;
+  const discussion = discussionCommandTarget(command);
+  if (discussion) return discussion;
   const view = /(?:^|[\s;&|])gh(?:\.exe)?\s+run\s+view\s+([^;&|\r\n]+)/i.exec(
     command,
   );
@@ -172,6 +199,11 @@ export function remoteReadTarget(tool, args = {}) {
       /(?:^|\s)(?:(?:--field|--raw-field|--input)(?:=|\s)|-[fF])/.test(command)
     )
       return null;
+    const issueApi =
+      /(?:https:\/\/api\.github\.com\/)?\/?repos\/([\w.-]+\/[\w.-]+)\/issues(?:\/(\d+)(?:\/(?:comments|events|timeline))?)?(?=[?\s"']|$)/.exec(
+        command,
+      );
+    if (issueApi) return issueTarget(issueApi[1], issueApi[2]);
     const prApi =
       /(?:https:\/\/api\.github\.com\/)?\/?repos\/([\w.-]+\/[\w.-]+)\/pulls(?:\/(\d+)(?:\/(?:files|commits|reviews|comments))?)?(?=[?\s"']|$)/.exec(
         command,
@@ -369,6 +401,14 @@ export class RemoteReadLoopGuard {
   get recoveryHint() {
     if (!(this.targets.get(this.activeKey)?.repeats >= RECOVERY_AFTER))
       return null;
+    if (this.targets.get(this.activeKey)?.issue) {
+      return (
+        "Remote-read loop recovery: repeated issue reads returned failures or already-seen evidence. " +
+        "Use the retained observations; identify the exact missing fact before a new focused read. " +
+        ISSUE_WORKFLOW_GUIDANCE +
+        DIAGNOSTIC_WORKFLOW_GUIDANCE
+      );
+    }
     if (this.targets.get(this.activeKey)?.shellPolicy) {
       return (
         "Tool-policy loop recovery: the same execution policy keeps rejecting commands, even when their arguments change. " +
@@ -449,6 +489,8 @@ export class RemoteReadLoopGuard {
   }
 
   get workflowHint() {
+    if (this.targets.get(this.activeKey)?.issue)
+      return ISSUE_WORKFLOW_GUIDANCE + DIAGNOSTIC_WORKFLOW_GUIDANCE;
     const active = this.targets.get(this.activeKey);
     if (active?.github && !active.pullRequest) {
       return (
@@ -505,6 +547,7 @@ export class RemoteReadLoopGuard {
         page,
         localLog,
         pullRequest,
+        issue,
         shellPolicy,
         gitRepository,
       }) => ({
@@ -515,9 +558,11 @@ export class RemoteReadLoopGuard {
             : github
               ? pullRequest
                 ? "GitHub pull requests"
-                : localLog
-                  ? "saved GitHub Actions log"
-                  : "GitHub Actions logs"
+                : issue
+                  ? "GitHub issues"
+                  : localLog
+                    ? "saved GitHub Actions log"
+                    : "GitHub Actions logs"
               : tool === "web_search"
                 ? "web_search"
                 : "web_fetch",

package/src/lib/sandbox-egress-authority-monitor.js

@@ -1,7 +1,8 @@
 /**
  * Recheck the live shell authority while a Docker egress session exists. This
- * is a bounded poll, not a lossless revision subscription: changes that are
- * reverted between checks cannot be observed.
+ * uses bounded polling as a fallback. Trusted policy owners also call revoke()
+ * synchronously on official revisions; unobserved external changes reverted
+ * between polls remain outside that event guarantee.
  */
 export function createDockerEgressAuthorityMonitor({
   revalidate,

package/src/lib/session-manager.js

@@ -108,7 +108,7 @@ export function saveMessages(db, sessionId, messages, metadata) {
 /**
  * Get a session by ID
  */
-export function getSession(db, sessionId) {
+export function getSession(db, sessionId, { strictMetadata = false } = {}) {
   ensureSessionsTable(db);
 
   // Try exact match first, then prefix match
@@ -127,16 +127,31 @@ export function getSession(db, sessionId) {
 
   if (!session) return null;
 
+  let metadata;
+  if (strictMetadata) {
+    metadata =
+      typeof session.metadata === "string"
+        ? JSON.parse(session.metadata)
+        : (session.metadata ?? {});
+    if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+      const error = new TypeError("Session authority metadata is invalid");
+      error.code = "CC_SESSION_AUTHORITY_METADATA_INVALID";
+      throw error;
+    }
+  } else {
+    metadata =
+      typeof session.metadata === "string"
+        ? safeJsonParse(session.metadata, {})
+        : session.metadata || {};
+  }
+
   return {
     ...session,
     // A single corrupt (non-JSON, non-empty) column must not make the whole
     // session unloadable — that would block resume of the user's own data.
     // Matches the safeJsonParse fallback listSessions already uses.
     messages: safeJsonParse(session.messages, []),
-    metadata:
-      typeof session.metadata === "string"
-        ? safeJsonParse(session.metadata, {})
-        : session.metadata || {},
+    metadata,
   };
 }