chainlesschain 0.166.82 → 0.166.83

package/src/lib/evolution/volcengine-function-replay-store.js

@@ -687,37 +687,47 @@ export function captureVolcengineFunctionReplayStore(value) {
       "A branded Volcengine function replay store is required",
     );
   }
+  function readRevocation() {
+    try {
+      const revocation = readRevocationRecord(
+        captured.revocationPath,
+        captured.descriptor,
+      );
+      return Object.freeze({
+        schema: revocation.schema,
+        replayStoreId: revocation.replayStoreId,
+        authorityId: revocation.authorityId,
+        revocationAuthorityId: revocation.revocationAuthorityId,
+        tenantId: revocation.tenantId,
+        handlerArtifactDigest: revocation.handlerArtifactDigest,
+        policyRevision: revocation.policyRevision,
+        revocationId: revocation.revocationId,
+        reasonDigest: revocation.reasonDigest,
+        authorizationRequestDigest: revocation.authorizationRequestDigest,
+        authorizationEvidenceDigest: revocation.authorizationEvidenceDigest,
+        auditEventDigest: revocation.auditEventDigest,
+        durabilityReceiptDigest: revocation.durabilityReceiptDigest,
+        evidenceResolverDigest: revocation.evidenceResolverDigest,
+        evidenceReadbackDigest: revocation.evidenceReadbackDigest,
+        revokedAt: revocation.revokedAt,
+        revocationDigest: revocation.revocationDigest,
+      });
+    } catch (error) {
+      if (error?.code === "ENOENT") return null;
+      throw error;
+    }
+  }
   return Object.freeze({
     descriptor: captured.descriptor,
     readRevocation() {
-      try {
-        const revocation = readRevocationRecord(
-          captured.revocationPath,
-          captured.descriptor,
-        );
-        return Object.freeze({
-          schema: revocation.schema,
-          replayStoreId: revocation.replayStoreId,
-          authorityId: revocation.authorityId,
-          revocationAuthorityId: revocation.revocationAuthorityId,
-          tenantId: revocation.tenantId,
-          handlerArtifactDigest: revocation.handlerArtifactDigest,
-          policyRevision: revocation.policyRevision,
-          revocationId: revocation.revocationId,
-          reasonDigest: revocation.reasonDigest,
-          authorizationRequestDigest: revocation.authorizationRequestDigest,
-          authorizationEvidenceDigest: revocation.authorizationEvidenceDigest,
-          auditEventDigest: revocation.auditEventDigest,
-          durabilityReceiptDigest: revocation.durabilityReceiptDigest,
-          evidenceResolverDigest: revocation.evidenceResolverDigest,
-          evidenceReadbackDigest: revocation.evidenceReadbackDigest,
-          revokedAt: revocation.revokedAt,
-          revocationDigest: revocation.revocationDigest,
-        });
-      } catch (error) {
-        if (error?.code === "ENOENT") return null;
-        throw error;
-      }
+      // A revocation is created exclusively at its final path. Serialize
+      // readback with the official writer so a live publication's partial
+      // bytes cannot masquerade as a corrupt crash record. After a failed or
+      // dead writer releases its lock, incomplete records still fail closed.
+      return withFileLock(captured.lockTarget, readRevocation, {
+        failIfUnavailable: true,
+        timeoutMs: 5_000,
+      });
     },
     revoke(value) {
       const revocation = normalizeRevocation(value, captured.descriptor);

package/src/lib/host-tool-policy-authority.js

@@ -0,0 +1,151 @@
+/** Host-owned policy snapshots and synchronous, irreversible revisions.
+ * Revisions cover commits through this owner in this process. Persisting a
+ * session's latest policy does not make these revisions a durable journal.
+ */
+import { randomUUID } from "node:crypto";
+import { snapshotMcpJsonRpcInput } from "./mcp-call-ledger.js";
+
+const AUTHORITIES = new WeakSet();
+const CHILD_AUTHORITIES = new WeakMap();
+
+function unavailable() {
+  const error = new Error("Host tool policy authority is unavailable");
+  error.code = "CC_HOST_TOOL_POLICY_AUTHORITY_UNAVAILABLE";
+  return error;
+}
+
+function capturePolicy(policy) {
+  if (policy == null) return null;
+  try {
+    const snapshot = snapshotMcpJsonRpcInput(policy);
+    if (typeof snapshot !== "object" || Array.isArray(snapshot))
+      throw unavailable();
+    for (const field of ["tools", "toolPolicies"]) {
+      const policies = snapshot[field];
+      if (policies == null) continue;
+      if (typeof policies !== "object" || Array.isArray(policies))
+        throw unavailable();
+      for (const entry of Object.values(policies)) {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+          throw unavailable();
+        for (const flag of [
+          "allowed",
+          "requiresConfirmation",
+          "requiresPlanApproval",
+          "isReadOnly",
+        ]) {
+          if (entry[flag] !== undefined && typeof entry[flag] !== "boolean")
+            throw unavailable();
+        }
+        if (entry.decision !== undefined && typeof entry.decision !== "string")
+          throw unavailable();
+      }
+    }
+    if (
+      snapshot.toolDefinitions !== undefined &&
+      !Array.isArray(snapshot.toolDefinitions)
+    )
+      throw unavailable();
+    return snapshot;
+  } catch {
+    throw unavailable();
+  }
+}
+
+export function captureHostToolPolicyAuthority(authority) {
+  if (authority == null) return null;
+  if (!AUTHORITIES.has(authority)) throw unavailable();
+  return authority;
+}
+
+/** The host retains the controller; consumers receive only `authority`. */
+export function createHostToolPolicyAuthority(policy = null) {
+  const ownerId = randomUUID();
+  let snapshot = Object.freeze({
+    schema: "chainlesschain.host-tool-policy-authority/v1",
+    ownerId,
+    revision: 0,
+    policy: capturePolicy(policy),
+  });
+  let invalid = false;
+  const listeners = new Set();
+  function publish(nextPolicy) {
+    if (snapshot.revision >= Number.MAX_SAFE_INTEGER) throw unavailable();
+    snapshot = Object.freeze({
+      ...snapshot,
+      revision: snapshot.revision + 1,
+      policy: nextPolicy,
+    });
+    // Commit before notifying. A failing observer cannot hide a revision from
+    // the remaining execution monitors.
+    for (const listener of [...listeners]) {
+      try {
+        listener(snapshot);
+      } catch {
+        // Observer delivery does not roll back committed authority.
+      }
+    }
+    return snapshot;
+  }
+  const authority = Object.freeze({
+    getSnapshot() {
+      if (invalid) throw unavailable();
+      return snapshot;
+    },
+    subscribePolicyRevision(listener) {
+      if (typeof listener !== "function")
+        throw new TypeError("listener required");
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+  });
+  AUTHORITIES.add(authority);
+  return Object.freeze({
+    authority,
+    commit(nextPolicy) {
+      const captured = capturePolicy(nextPolicy);
+      if (
+        !invalid &&
+        JSON.stringify(captured) === JSON.stringify(snapshot.policy)
+      )
+        return snapshot;
+      invalid = false;
+      return publish(captured);
+    },
+    invalidate() {
+      invalid = true;
+      return publish(snapshot.policy);
+    },
+  });
+}
+
+/** Inherit the live ceiling without introducing host definitions into a child. */
+export function hostToolPolicyAuthorityForChild(value) {
+  const parent = captureHostToolPolicyAuthority(value);
+  if (!parent) return null;
+  if (CHILD_AUTHORITIES.has(parent)) return CHILD_AUTHORITIES.get(parent);
+  let previous = null;
+  let projected = null;
+  const child = Object.freeze({
+    getSnapshot() {
+      const current = parent.getSnapshot();
+      if (current !== previous) {
+        projected = Object.freeze({
+          ...current,
+          policy: current.policy
+            ? Object.freeze({
+                ...current.policy,
+                toolDefinitions: Object.freeze([]),
+              })
+            : null,
+        });
+        previous = current;
+      }
+      return projected;
+    },
+    subscribePolicyRevision: parent.subscribePolicyRevision,
+  });
+  AUTHORITIES.add(child);
+  CHILD_AUTHORITIES.set(parent, child);
+  return child;
+}

package/src/lib/permission-authority.js

@@ -1,14 +1,42 @@
 /** Resolve static settings plus CLI-owned workspace-scoped permission rules. */
 
 import settingsLoader from "./settings-loader.cjs";
+import path from "node:path";
 import { ScopedPermissionStore } from "./scoped-permission-store.js";
 
-const { applyManagedPermissionPolicy, loadSettings } = settingsLoader;
+const {
+  applyManagedPermissionPolicy,
+  loadSettings,
+  getSettingsPermissionRevision,
+  subscribeSettingsPermissionRevision,
+} = settingsLoader;
 const KINDS = ["allow", "ask", "deny"];
+const providers = new WeakMap();
+const settingsAuthority = Object.freeze({
+  getSnapshot: getSettingsPermissionRevision,
+  subscribePolicyRevision: subscribeSettingsPermissionRevision,
+});
+
+function freezeSnapshot(value) {
+  if (value && typeof value === "object") {
+    for (const child of Object.values(value)) freezeSnapshot(child);
+    Object.freeze(value);
+  }
+  return value;
+}
 
 function cloneRules(rules) {
   return Object.fromEntries(
-    KINDS.map((kind) => [kind, [...(rules?.[kind] || [])]]),
+    KINDS.map((kind) => {
+      const entries = rules?.[kind] ?? [];
+      if (
+        !Array.isArray(entries) ||
+        entries.some((entry) => typeof entry !== "string")
+      ) {
+        throw new TypeError(`permission ${kind} rules must be a string array`);
+      }
+      return [kind, [...entries]];
+    }),
   );
 }
 
@@ -24,6 +52,7 @@ export function loadPermissionAuthority({
   baseRules = null,
   scopedStore = null,
 } = {}) {
+  const settingsRevision = getSettingsPermissionRevision();
   const loaded = loadSettings({
     cwd,
     settingsFile,
@@ -63,15 +92,48 @@ export function loadPermissionAuthority({
     }
   }
 
-  return {
+  if (getSettingsPermissionRevision() !== settingsRevision) {
+    const error = new Error(
+      "settings changed while permission authority was loading",
+    );
+    error.code = "CC_SETTINGS_PERMISSION_AUTHORITY_CHANGED";
+    throw error;
+  }
+  return freezeSnapshot({
     ...loaded,
     rules,
     sources,
     scoped,
     hasRules: hasRules(rules),
-  };
+    settingsRevision,
+  });
 }
 
 export function createPermissionRulesProvider(options = {}) {
-  return () => loadPermissionAuthority(options);
+  const cwd = path.resolve(options.cwd || process.cwd());
+  const captured = Object.freeze({
+    cwd,
+    settingsFile: options.settingsFile
+      ? path.resolve(cwd, options.settingsFile)
+      : null,
+    managedSettingsFile: options.managedSettingsFile
+      ? path.resolve(options.managedSettingsFile)
+      : null,
+    // Environment kill switches retain live sampling semantics. The source
+    // object cannot be replaced through later changes to the options object.
+    env: options.env || process.env,
+    baseRules: options.baseRules
+      ? freezeSnapshot(cloneRules(options.baseRules))
+      : null,
+    scopedStore: options.scopedStore || null,
+  });
+  const provider = () => loadPermissionAuthority(captured);
+  providers.set(provider, settingsAuthority);
+  return Object.freeze(provider);
+}
+
+// A legacy callback cannot advertise a trusted revision subscription simply
+// by copying properties onto itself. It still receives sampled revalidation.
+export function permissionRulesProviderAuthority(provider) {
+  return providers.get(provider) || null;
 }

package/src/lib/plugin-runtime/settings.js

@@ -17,6 +17,10 @@
 import fs from "fs";
 import { discoverPlugins } from "./scopes.js";
 import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
+import {
+  isPluginAuthorityEnvironmentKey,
+  isValidEnvironmentKey,
+} from "../authority-launch-environment.js";
 
 export const _deps = { readFileSync: fs.readFileSync };
 
@@ -68,7 +72,11 @@ export function collectPluginSettings(opts = {}) {
       !Array.isArray(parsed.env)
     ) {
       for (const [k, v] of Object.entries(parsed.env)) {
-        if (typeof v === "string") {
+        if (
+          typeof v === "string" &&
+          isValidEnvironmentKey(k) &&
+          !isPluginAuthorityEnvironmentKey(k)
+        ) {
           env[k] = v;
           contributed = true;
         }

package/src/lib/sandbox-egress-authority-monitor.js

@@ -1,7 +1,8 @@
 /**
  * Recheck the live shell authority while a Docker egress session exists. This
- * is a bounded poll, not a lossless revision subscription: changes that are
- * reverted between checks cannot be observed.
+ * uses bounded polling as a fallback. Trusted policy owners also call revoke()
+ * synchronously on official revisions; unobserved external changes reverted
+ * between polls remain outside that event guarantee.
  */
 export function createDockerEgressAuthorityMonitor({
   revalidate,

package/src/lib/session-manager.js

@@ -108,7 +108,7 @@ export function saveMessages(db, sessionId, messages, metadata) {
 /**
  * Get a session by ID
  */
-export function getSession(db, sessionId) {
+export function getSession(db, sessionId, { strictMetadata = false } = {}) {
   ensureSessionsTable(db);
 
   // Try exact match first, then prefix match
@@ -127,16 +127,31 @@ export function getSession(db, sessionId) {
 
   if (!session) return null;
 
+  let metadata;
+  if (strictMetadata) {
+    metadata =
+      typeof session.metadata === "string"
+        ? JSON.parse(session.metadata)
+        : (session.metadata ?? {});
+    if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+      const error = new TypeError("Session authority metadata is invalid");
+      error.code = "CC_SESSION_AUTHORITY_METADATA_INVALID";
+      throw error;
+    }
+  } else {
+    metadata =
+      typeof session.metadata === "string"
+        ? safeJsonParse(session.metadata, {})
+        : session.metadata || {};
+  }
+
   return {
     ...session,
     // A single corrupt (non-JSON, non-empty) column must not make the whole
     // session unloadable — that would block resume of the user's own data.
     // Matches the safeJsonParse fallback listSessions already uses.
     messages: safeJsonParse(session.messages, []),
-    metadata:
-      typeof session.metadata === "string"
-        ? safeJsonParse(session.metadata, {})
-        : session.metadata || {},
+    metadata,
   };
 }
 

package/src/lib/settings-loader.cjs

@@ -27,9 +27,83 @@
 const fsDefault = require("node:fs");
 const path = require("node:path");
 const os = require("node:os");
+const { randomUUID } = require("node:crypto");
 const { projectRootBase } = require("./project-root.cjs");
+const { observeSettingsSources } = require("./settings-source-observation.cjs");
+// Node >=22.12 supports synchronous require(ESM). Load these write-only
+// helpers on first use: permission readers should not trigger Node 22.12's
+// native require(ESM) warning just by discovering settings. Official writes
+// remain synchronous and keep the runtime's warning when applicable.
+let securityStoreHelpers;
+let fileLockHelper;
+function securityStore() {
+  return (securityStoreHelpers ??= require("./durable-security-store.js"));
+}
+function lockHelper() {
+  return (fileLockHelper ??= require("./with-file-lock.js").withFileLock);
+}
+
+const _deps = {
+  fs: fsDefault,
+  homedir: () => os.homedir(),
+  readSecurityStore: (...args) => securityStore().readSecurityStore(...args),
+  writeSecurityStore: (...args) => securityStore().writeSecurityStore(...args),
+  withFileLock: (...args) => lockHelper()(...args),
+};
+
+// A process-wide owner deliberately revokes unrelated projects too. Matching
+// only contributing paths misses absent files, parent discovery and aliases.
+// Only this module can advance it; raw edits and other processes are not events.
+const settingsOwnerId = randomUUID();
+let settingsRevision = Object.freeze({
+  ownerId: settingsOwnerId,
+  revision: 0,
+  state: "ready",
+});
+const settingsListeners = new Set();
+
+function getSettingsPermissionRevision() {
+  if (settingsRevision.state !== "ready") {
+    const error = new Error("settings permission authority is unavailable");
+    error.code = "CC_SETTINGS_PERMISSION_AUTHORITY_UNAVAILABLE";
+    throw error;
+  }
+  return settingsRevision;
+}
+
+function subscribeSettingsPermissionRevision(listener) {
+  if (typeof listener !== "function") {
+    throw new TypeError("settings revision listener must be a function");
+  }
+  settingsListeners.add(listener);
+  return () => settingsListeners.delete(listener);
+}
+
+function beginSettingsMutation() {
+  getSettingsPermissionRevision();
+  const next = settingsRevision.revision + 1;
+  settingsRevision = Object.freeze({
+    ownerId: settingsOwnerId,
+    revision: next,
+    state: Number.isSafeInteger(next) ? "mutating" : "invalid",
+  });
+  // Latch before calling observers. Reentrant writers/readers cannot acquire
+  // the lock or obtain authority while an official write is in progress.
+  for (const listener of [...settingsListeners]) {
+    try {
+      listener(settingsRevision);
+    } catch {
+      // An observer cannot prevent another running shell from being revoked.
+    }
+  }
+  if (settingsRevision.state === "invalid") {
+    getSettingsPermissionRevision();
+  }
+}
 
-const _deps = { fs: fsDefault, homedir: () => os.homedir() };
+function finishSettingsMutation(state) {
+  settingsRevision = Object.freeze({ ...settingsRevision, state });
+}
 
 const KINDS = Object.freeze(["allow", "ask", "deny"]);
 
@@ -88,6 +162,27 @@ function settingsPaths(cwd, explicitFile) {
   return list;
 }
 
+/**
+ * Strict, read-only inventory for persistent-authority integration. Includes
+ * every ordered candidate, even absent files and files with no permission
+ * contribution. This does not register an anchor or grant execution authority.
+ */
+function inspectSettingsSources(opts = {}) {
+  const cwd = path.resolve(opts.cwd || process.cwd());
+  const candidates = [
+    ...settingsPaths(cwd, opts.settingsFile),
+    managedSettingsPath(opts),
+  ];
+  return Object.freeze({
+    schema: "chainlesschain.settings-source-observation/v1",
+    cwd,
+    sources: observeSettingsSources(candidates, {
+      fs: _deps.fs,
+      maxBytes: opts.maxBytes,
+    }),
+  });
+}
+
 /** Organization-controlled settings file. This layer is always highest. */
 function managedSettingsPath(opts = {}) {
   if (opts.managedSettingsFile) return path.resolve(opts.managedSettingsFile);
@@ -260,30 +355,88 @@ function scopeFile(cwd, scope) {
  * @throws if the target file exists but is malformed JSON (refuse to clobber).
  */
 function addRule({ cwd = process.cwd(), kind, rule, scope = "project" } = {}) {
+  const entryCwd = process.cwd();
+  const absoluteCwd = path.resolve(entryCwd, cwd);
+  // Check before lock acquisition: notification callbacks may reenter here.
+  getSettingsPermissionRevision();
   if (!KINDS.includes(kind)) {
     throw new Error(`kind must be allow | ask | deny (got "${kind}")`);
   }
-  const file = scopeFile(cwd, scope);
-  let data = {};
-  if (_deps.fs.existsSync(file)) {
-    const text = _deps.fs.readFileSync(file, "utf-8");
-    try {
-      data = JSON.parse(text) || {};
-    } catch (err) {
-      throw new Error(
-        `refusing to overwrite malformed ${file} (${err.message})`,
-      );
-    }
+  if (typeof rule !== "string" || !rule.trim()) {
+    throw new TypeError("permission rule must be a non-empty string");
   }
-  if (!data.permissions || typeof data.permissions !== "object") {
-    data.permissions = {};
+  if (!["project", "local", "user"].includes(scope)) {
+    throw new TypeError("scope must be project | local | user");
   }
-  if (!Array.isArray(data.permissions[kind])) data.permissions[kind] = [];
-  if (data.permissions[kind].includes(rule)) return { file, added: false };
-  data.permissions[kind].push(rule);
+  const file = path.resolve(entryCwd, scopeFile(absoluteCwd, scope));
   _deps.fs.mkdirSync(path.dirname(file), { recursive: true });
-  _deps.fs.writeFileSync(file, JSON.stringify(data, null, 2) + "\n", "utf-8");
-  return { file, added: true };
+  let began = false;
+  let committed = false;
+  try {
+    const result = _deps.withFileLock(
+      file,
+      () => {
+        // Atomic replacement would otherwise replace the link itself after
+        // reading its target. Separate file links also have separate locks.
+        // Directory aliases continue to address the same file and lock.
+        if (
+          _deps.fs.lstatSync(file, { throwIfNoEntry: false })?.isSymbolicLink()
+        ) {
+          throw new TypeError(
+            `refusing to replace a settings file symbolic link: ${file}`,
+          );
+        }
+        const data = _deps.readSecurityStore(file, "settings");
+        if (
+          Object.hasOwn(data, "permissions") &&
+          (!data.permissions ||
+            typeof data.permissions !== "object" ||
+            Array.isArray(data.permissions))
+        ) {
+          throw new TypeError(
+            `refusing to overwrite malformed permissions: ${file}`,
+          );
+        }
+        data.permissions ??= {};
+        // Refuse to hide a damaged rule list, including a different decision.
+        for (const decision of KINDS) {
+          if (
+            Object.hasOwn(data.permissions, decision) &&
+            (!Array.isArray(data.permissions[decision]) ||
+              data.permissions[decision].some(
+                (entry) => typeof entry !== "string",
+              ))
+          ) {
+            throw new TypeError(
+              `refusing to overwrite malformed permission rules: ${file}`,
+            );
+          }
+        }
+        data.permissions[kind] ??= [];
+        if (data.permissions[kind].includes(rule))
+          return { file, added: false };
+        data.permissions[kind].push(rule);
+        beginSettingsMutation();
+        began = true;
+        _deps.writeSecurityStore(file, "settings", data);
+        committed = true;
+        return { file, added: true };
+      },
+      { failIfUnavailable: true },
+    );
+    if (began) finishSettingsMutation("ready");
+    return result;
+  } catch (error) {
+    if (!error.commitState) {
+      error.commitState = committed ? "committed" : "not-committed";
+    }
+    if (began) {
+      finishSettingsMutation(
+        error.commitState === "unknown" ? "invalid" : "ready",
+      );
+    }
+    throw error;
+  }
 }
 
 /**
@@ -508,6 +661,7 @@ function readStringArraySetting(key, opts = {}) {
 }
 
 module.exports = {
+  inspectSettingsSources,
   loadSettings,
   loadSettingsConfig,
   readSettingsFile,
@@ -523,6 +677,8 @@ module.exports = {
   mergeSandboxSettings,
   ruleSource,
   addRule,
+  getSettingsPermissionRevision,
+  subscribeSettingsPermissionRevision,
   scopeFile,
   KINDS,
   _deps,