chainlesschain 0.166.82 → 0.166.84

package/src/gateways/ws/ws-session-gateway.js

@@ -36,6 +36,7 @@ import {
   deleteSession as dbDeleteSession,
 } from "../../lib/session-manager.js";
 import { buildSystemPrompt } from "../../runtime/agent-core.js";
+import { createHostToolPolicyAuthority } from "../../lib/host-tool-policy-authority.js";
 import { SubAgentRegistry } from "../../lib/sub-agent-registry.js";
 import {
   createWorktree,
@@ -71,7 +72,39 @@ import {
 } from "../../harness/jsonl-session-store.js";
 
 export const WS_SESSION_ROLLOUT_EVENT = "ws_session_state";
-const WS_SESSION_ROLLOUT_SCHEMA = "chainlesschain.ws-session-rollout/v1";
+const WS_SESSION_ROLLOUT_SCHEMA = "chainlesschain.ws-session-rollout/v2";
+const LEGACY_WS_SESSION_ROLLOUT_SCHEMA = "chainlesschain.ws-session-rollout/v1";
+const WS_HOST_POLICY_SCHEMA = "chainlesschain.ws-host-tool-policy/v1";
+const SESSION_HOST_POLICY_CONTROLLERS = new WeakMap();
+
+function bindSessionHostToolPolicy(session, controller) {
+  SESSION_HOST_POLICY_CONTROLLERS.set(session, controller);
+  Object.defineProperties(session, {
+    hostManagedToolPolicyAuthority: { value: controller.authority },
+    hostManagedToolPolicy: {
+      enumerable: true,
+      get: () => controller.authority.getSnapshot().policy,
+    },
+  });
+}
+
+function canonicalHostToolPolicy(journal, fallback = null) {
+  if (!journal || !Object.hasOwn(journal, "hostToolPolicy")) return fallback;
+  const stored = journal.hostToolPolicy;
+  if (
+    !stored ||
+    stored.schema !== WS_HOST_POLICY_SCHEMA ||
+    !Object.hasOwn(stored, "policy")
+  ) {
+    throw canonicalWsStateError(
+      "CC_WS_CANONICAL_STATE_CORRUPT",
+      "Canonical host policy is invalid",
+    );
+  }
+  // Validate known authority fields before restoring any execution capability.
+  return createHostToolPolicyAuthority(stored.policy).authority.getSnapshot()
+    .policy;
+}
 
 function canonicalWsStateError(code, message) {
   const error = new Error(message);
@@ -475,6 +508,9 @@ export class WSSessionManager {
       throw error;
     }
     const type = options.type || "agent";
+    const hostPolicyController = createHostToolPolicyAuthority(
+      options.hostManagedToolPolicy ?? null,
+    );
     const baseProjectRoot = options.projectRoot || this.defaultProjectRoot;
     const hostAuthorizedBaseRoot =
       normalizeHostWorkspaceRoot(baseProjectRoot) ===
@@ -583,7 +619,6 @@ export class WSSessionManager {
       baseUrl,
       mcpClient: this.mcpClient,
       enabledToolNames,
-      hostManagedToolPolicy: options.hostManagedToolPolicy || null,
       sessionBudgetRoot: options.sessionBudgetRoot || null,
       externalToolDefinitions: externalTools.definitions,
       externalToolDescriptors: externalTools.descriptors,
@@ -605,6 +640,7 @@ export class WSSessionManager {
       createdAt: new Date().toISOString(),
       lastActivity: new Date().toISOString(),
     };
+    bindSessionHostToolPolicy(session, hostPolicyController);
     bindCanonicalHostSystemPrefix(session, messages);
     this._bindSessionStateJournal(session, createWsSessionState());
     bindSessionHooksV2Workspace(
@@ -726,14 +762,28 @@ export class WSSessionManager {
     if (!this.db) return null;
 
     try {
-      const dbSession = dbGetSession(this.db, sessionId);
+      const dbSession = dbGetSession(this.db, sessionId, {
+        strictMetadata: true,
+      });
       if (!dbSession) return null;
 
       const messages =
         typeof dbSession.messages === "string"
           ? JSON.parse(dbSession.messages)
           : dbSession.messages || [];
-      const metadata = this._normalizeSessionMetadata(dbSession.metadata);
+      const metadata = this._normalizeSessionMetadata(dbSession.metadata, {
+        strict: true,
+      });
+      const canonicalSessionState =
+        metadata.canonicalJsonlSession === true
+          ? this._readCanonicalSessionState(dbSession.id, { required: true })
+          : null;
+      const hostPolicyController = createHostToolPolicyAuthority(
+        canonicalHostToolPolicy(
+          canonicalSessionState,
+          metadata.hostManagedToolPolicy ?? null,
+        ),
+      );
       const baseProjectRoot =
         metadata.baseProjectRoot ||
         metadata.projectRoot ||
@@ -744,10 +794,6 @@ export class WSSessionManager {
         metadata,
       );
       const planManager = this._hydratePlanManager(metadata.planSnapshot);
-      const canonicalSessionState =
-        metadata.canonicalJsonlSession === true
-          ? this._readCanonicalSessionState(dbSession.id, { required: true })
-          : null;
       const sessionStateJournal = canonicalSessionState
         ? hydrateCanonicalWsSessionState(canonicalSessionState)
         : hydrateWsSessionState(
@@ -806,7 +852,6 @@ export class WSSessionManager {
         enabledToolNames: this._normalizeEnabledToolNames(
           metadata.enabledToolNames,
         ),
-        hostManagedToolPolicy: metadata.hostManagedToolPolicy || null,
         sessionBudgetRoot: metadata.sessionBudgetRoot || null,
         externalToolDefinitions: externalTools.definitions,
         externalToolDescriptors: externalTools.descriptors,
@@ -830,6 +875,7 @@ export class WSSessionManager {
         createdAt: dbSession.created_at,
         lastActivity: new Date().toISOString(),
       };
+      bindSessionHostToolPolicy(session, hostPolicyController);
       if (Array.isArray(metadata.canonicalHostSystemPrefix)) {
         bindCanonicalHostSystemPrefix(
           session,
@@ -875,6 +921,10 @@ export class WSSessionManager {
       : { changed: false };
     const created = this.createSession({
       sessionId,
+      hostManagedToolPolicy: canonicalHostToolPolicy(
+        canonicalSessionState,
+        options.hostManagedToolPolicy ?? null,
+      ),
       type: options.type || "agent",
       provider: options.provider,
       model: options.model,
@@ -1049,9 +1099,27 @@ export class WSSessionManager {
     const session = this.sessions.get(sessionId);
     if (!session) return null;
 
-    session.hostManagedToolPolicy = hostManagedToolPolicy || null;
+    const controller = SESSION_HOST_POLICY_CONTROLLERS.get(session);
+    if (!controller) {
+      const error = new Error("Session host policy authority is unavailable");
+      error.code = "CC_HOST_TOOL_POLICY_AUTHORITY_UNAVAILABLE";
+      throw error;
+    }
+    controller.commit(hostManagedToolPolicy ?? null);
     session.lastActivity = new Date().toISOString();
-    this._persistSessionState(sessionId);
+    try {
+      this._persistCanonicalSessionState(
+        session,
+        this._ensureSessionStateJournal(session),
+      );
+      this._persistSessionState(sessionId, { throwOnError: true });
+    } catch (error) {
+      // Do not acknowledge a failed save or allow further execution from its
+      // uncertain policy. The committed revision has already revoked monitors.
+      controller.invalidate();
+      error.code ||= "CC_WS_SESSION_POLICY_PERSISTENCE_FAILED";
+      throw error;
+    }
     return session;
   }
 
@@ -1707,7 +1775,7 @@ export class WSSessionManager {
     };
   }
 
-  _persistSessionState(sessionId) {
+  _persistSessionState(sessionId, { throwOnError = false } = {}) {
     const session = this.sessions.get(sessionId);
     if (!session || !this.db) return;
 
@@ -1726,13 +1794,21 @@ export class WSSessionManager {
         );
         persistedMessages = [...hostPrefix, ...conversation];
       }
-      dbSaveMessages(
+      const saved = dbSaveMessages(
         this.db,
         sessionId,
         persistedMessages,
         this._serializeSessionMetadata(session),
       );
-    } catch (_err) {
+      if (throwOnError && saved?.updated !== true) {
+        const error = new Error(
+          "Session policy persistence did not update a record",
+        );
+        error.code = "CC_WS_SESSION_POLICY_PERSISTENCE_FAILED";
+        throw error;
+      }
+    } catch (error) {
+      if (throwOnError) throw error;
       // Non-critical
     }
 
@@ -1817,12 +1893,35 @@ export class WSSessionManager {
       }
       return null;
     }
-    if (event.data?.schema !== WS_SESSION_ROLLOUT_SCHEMA) {
+    if (
+      ![WS_SESSION_ROLLOUT_SCHEMA, LEGACY_WS_SESSION_ROLLOUT_SCHEMA].includes(
+        event.data?.schema,
+      )
+    ) {
       throw canonicalWsStateError(
         "CC_WS_CANONICAL_STATE_CORRUPT",
         `canonical WebSocket session state has an invalid schema: ${sessionId}`,
       );
     }
+    if (
+      !event.data.journal ||
+      typeof event.data.journal !== "object" ||
+      Array.isArray(event.data.journal)
+    ) {
+      throw canonicalWsStateError(
+        "CC_WS_CANONICAL_STATE_CORRUPT",
+        "Canonical WebSocket journal is missing or invalid",
+      );
+    }
+    if (event.data.schema === WS_SESSION_ROLLOUT_SCHEMA) {
+      if (!Object.hasOwn(event.data.journal, "hostToolPolicy")) {
+        throw canonicalWsStateError(
+          "CC_WS_CANONICAL_STATE_CORRUPT",
+          "Canonical host policy is missing",
+        );
+      }
+      canonicalHostToolPolicy(event.data.journal);
+    }
     return event.data.journal;
   }
 
@@ -1833,7 +1932,13 @@ export class WSSessionManager {
       WS_SESSION_ROLLOUT_EVENT,
       {
         schema: WS_SESSION_ROLLOUT_SCHEMA,
-        journal: serializeWsSessionState(journal),
+        journal: {
+          ...serializeWsSessionState(journal),
+          hostToolPolicy: {
+            schema: WS_HOST_POLICY_SCHEMA,
+            policy: session.hostManagedToolPolicy,
+          },
+        },
       },
     );
   }
@@ -1914,20 +2019,27 @@ export class WSSessionManager {
     };
   }
 
-  _normalizeSessionMetadata(metadata) {
-    if (!metadata) {
+  _normalizeSessionMetadata(metadata, { strict = false } = {}) {
+    if (metadata == null || (!strict && !metadata)) {
       return {};
     }
 
     if (typeof metadata === "string") {
       try {
-        return JSON.parse(metadata);
-      } catch (_err) {
+        const parsed = JSON.parse(metadata);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+          throw new TypeError("Invalid session metadata");
+        return parsed;
+      } catch (error) {
+        if (strict) throw error;
         return {};
       }
     }
 
-    return typeof metadata === "object" ? metadata : {};
+    if (typeof metadata === "object" && !Array.isArray(metadata))
+      return metadata;
+    if (strict) throw new TypeError("Invalid session metadata");
+    return {};
   }
 
   _hydratePlanManager(snapshot) {

package/src/lib/agent-execution-policy.js

@@ -0,0 +1,177 @@
+import { isProxy } from "node:util/types";
+import { snapshotMcpJsonRpcInput } from "./mcp-call-ledger.js";
+import { captureUnattendedActionPolicy } from "./unattended-action-policy.js";
+
+function invalidPolicy(field) {
+  const error = new TypeError(`Agent execution policy ${field} is invalid`);
+  error.code = "CC_AGENT_EXECUTION_POLICY_INVALID";
+  return error;
+}
+
+function ownValue(options, field) {
+  const descriptor = Object.getOwnPropertyDescriptor(options, field);
+  if (!descriptor) {
+    if (field in options) throw invalidPolicy(field);
+    return undefined;
+  }
+  if (!("value" in descriptor)) throw invalidPolicy(field);
+  return descriptor.value;
+}
+
+function objectSnapshot(value, field) {
+  if (value == null) return null;
+  try {
+    const snapshot = snapshotMcpJsonRpcInput(value);
+    if (!snapshot || typeof snapshot !== "object" || Array.isArray(snapshot))
+      throw invalidPolicy(field);
+    return snapshot;
+  } catch {
+    throw invalidPolicy(field);
+  }
+}
+
+function stringList(value, field) {
+  if (value == null) return null;
+  try {
+    const snapshot = snapshotMcpJsonRpcInput(value);
+    if (
+      !Array.isArray(snapshot) ||
+      snapshot.some((entry) => typeof entry !== "string" || !entry.trim())
+    )
+      throw invalidPolicy(field);
+    return snapshot;
+  } catch {
+    throw invalidPolicy(field);
+  }
+}
+
+function booleanFields(value, fields, label) {
+  for (const field of fields) {
+    if (value[field] !== undefined && typeof value[field] !== "boolean")
+      throw invalidPolicy(`${label}.${field}`);
+  }
+}
+
+function captureSandbox(value) {
+  if (value === false) return null;
+  const sandbox = objectSnapshot(value, "sandbox");
+  if (!sandbox) return null;
+  booleanFields(sandbox, ["network"], "sandbox");
+  if (sandbox.policy !== undefined) {
+    const policy = objectSnapshot(sandbox.policy, "sandbox.policy");
+    if (!policy) throw invalidPolicy("sandbox.policy");
+    booleanFields(
+      policy,
+      ["allowUnsandboxedCommands", "failIfUnavailable"],
+      "sandbox.policy",
+    );
+    for (const field of [
+      "allowRead",
+      "denyRead",
+      "allowWrite",
+      "denyWrite",
+      "allowedDomains",
+      "deniedDomains",
+      "excludedCommands",
+    ]) {
+      if (policy[field] !== undefined)
+        stringList(policy[field], `sandbox.policy.${field}`);
+    }
+  }
+  return sandbox;
+}
+
+function captureToolAdmission(value) {
+  const admission = objectSnapshot(value, "toolAdmission");
+  if (!admission) return null;
+  const flags = [
+    "enforce",
+    "capabilityGranted",
+    "policyAllowed",
+    "permissionGranted",
+    "budgetOk",
+    "uiSupported",
+  ];
+  booleanFields(admission, flags, "toolAdmission");
+  if (admission.tools !== undefined) {
+    const tools = objectSnapshot(admission.tools, "toolAdmission.tools");
+    if (!tools) throw invalidPolicy("toolAdmission.tools");
+    for (const [name, entry] of Object.entries(tools)) {
+      const override = objectSnapshot(entry, `toolAdmission.tools.${name}`);
+      if (!override) throw invalidPolicy(`toolAdmission.tools.${name}`);
+      booleanFields(override, flags, `toolAdmission.tools.${name}`);
+    }
+  }
+  return admission;
+}
+
+/**
+ * Copy startup/turn data before the first await. Live permission providers,
+ * host policy owners, Plan managers and ApprovalGates remain live capabilities.
+ * A later user turn may capture a different tool list; this turn's caller-owned
+ * arrays cannot change its model surface or execution ceiling midway through.
+ */
+export function captureAgentExecutionPolicy(
+  options = {},
+  { hermetic = false } = {},
+) {
+  if (!options || typeof options !== "object" || isProxy(options))
+    throw invalidPolicy("options");
+  const isolated = hermetic && ownValue(options, "hermeticExecution") === true;
+  const policy = {
+    sandbox: captureSandbox(ownValue(options, "sandbox")),
+    toolAdmission: isolated
+      ? null
+      : captureToolAdmission(ownValue(options, "toolAdmission")),
+    unattendedActionPolicy: isolated
+      ? null
+      : captureUnattendedActionPolicy(
+          ownValue(options, "unattendedActionPolicy"),
+        ),
+    shellPolicyOverrides: stringList(
+      ownValue(options, "shellPolicyOverrides"),
+      "shellPolicyOverrides",
+    ),
+  };
+  const classifyAllShell = ownValue(options, "classifyAllShell");
+  if (classifyAllShell != null) {
+    if (typeof classifyAllShell !== "boolean")
+      throw invalidPolicy("classifyAllShell");
+    policy.classifyAllShell = classifyAllShell;
+  }
+  for (const field of [
+    "additionalDirectories",
+    "enabledToolNames",
+    "disabledTools",
+    "allowedTools",
+    "disallowedTools",
+    "effectiveAllowedToolNames",
+  ]) {
+    const value = ownValue(options, field);
+    if (value !== undefined) policy[field] = stringList(value, field);
+  }
+  return Object.freeze(policy);
+}
+
+/** Explicit lists intersect; deny lists always accumulate. [] means no tools. */
+export function resolveAgentToolSelection(policy = {}, ceiling = null) {
+  const lists = [
+    ceiling,
+    policy.allowedTools,
+    policy.enabledToolNames,
+    policy.effectiveAllowedToolNames,
+  ].filter(Array.isArray);
+  const enabledToolNames =
+    lists.length === 0
+      ? null
+      : Object.freeze(
+          lists[0].filter((name) => lists.every((list) => list.includes(name))),
+        );
+  const disabledTools = Object.freeze([
+    ...new Set([
+      ...(policy.disabledTools || []),
+      ...(policy.disallowedTools || []),
+    ]),
+  ]);
+  return Object.freeze({ enabledToolNames, disabledTools });
+}

package/src/lib/authority-launch-environment.js

@@ -0,0 +1,99 @@
+/** Launcher-owned storage locations and permission switches. */
+
+export const STORAGE_AUTHORITY_ENV_KEYS = Object.freeze([
+  "CHAINLESSCHAIN_HOME",
+  "CLAUDE_CONFIG_DIR",
+  "CLAUDE_CODE_PROJECT_DIR_NAME",
+  "CLAUDE_CODE_DISABLE_AUTO_MEMORY",
+  "CC_MANAGED_SETTINGS",
+  "ProgramData",
+  "PROGRAMDATA",
+  "CHAINLESSCHAIN_SECURITY_ANCHOR_HOME",
+  "LOCALAPPDATA",
+  "XDG_STATE_HOME",
+  // os.homedir() uses these launcher values too. Protecting only the explicit
+  // anchor override leaves its default location redirectable via settings env.
+  "HOME",
+  "USERPROFILE",
+  "HOMEDRIVE",
+  "HOMEPATH",
+]);
+
+const PERMISSION_AUTHORITY_ENV_KEYS = Object.freeze([
+  "CC_PERMISSIONS_ALLOW",
+  "CC_PERMISSIONS_ASK",
+  "CC_PERMISSIONS_DENY",
+  "CC_BYPASS_PERMISSIONS",
+]);
+
+function normalizeKey(key, platform) {
+  return platform === "win32" ? key.toUpperCase() : key;
+}
+
+function storageKeys(platform) {
+  return new Map(
+    STORAGE_AUTHORITY_ENV_KEYS.map((key) => [normalizeKey(key, platform), key]),
+  );
+}
+
+/** Native process.env truncates names at NUL; validate before any assignment. */
+export function isValidEnvironmentKey(key) {
+  return (
+    typeof key === "string" &&
+    key.length > 0 &&
+    !key.includes("\0") &&
+    !key.includes("=")
+  );
+}
+
+/** Plugins may supply tool defaults, but cannot select a new authority domain. */
+export function isPluginAuthorityEnvironmentKey(
+  key,
+  { platform = process.platform } = {},
+) {
+  if (typeof key !== "string") return false;
+  const normalized = normalizeKey(key, platform);
+  return [...STORAGE_AUTHORITY_ENV_KEYS, ...PERMISSION_AUTHORITY_ENV_KEYS].some(
+    (candidate) => normalizeKey(candidate, platform) === normalized,
+  );
+}
+
+export function captureStorageAuthorityEnvironment(
+  env = process.env,
+  { platform = process.platform } = {},
+) {
+  const keys = storageKeys(platform);
+  const snapshot = {};
+  for (const [key, value] of Object.entries(env)) {
+    const canonicalKey = keys.get(normalizeKey(key, platform));
+    if (!canonicalKey || typeof value !== "string") continue;
+    if (
+      Object.hasOwn(snapshot, canonicalKey) &&
+      snapshot[canonicalKey] !== value
+    ) {
+      const error = new Error(
+        "Conflicting launcher storage environment aliases",
+      );
+      error.code = "CC_STORAGE_AUTHORITY_ENV_AMBIGUOUS";
+      throw error;
+    }
+    snapshot[canonicalKey] = value;
+  }
+  return Object.freeze(snapshot);
+}
+
+/** Remove newly introduced aliases before restoring the trusted snapshot. */
+export function restoreStorageAuthorityEnvironment(
+  snapshot,
+  env = process.env,
+  { platform = process.platform } = {},
+) {
+  const captured = captureStorageAuthorityEnvironment(snapshot || {}, {
+    platform,
+  });
+  const keys = storageKeys(platform);
+  for (const key of Object.keys(env)) {
+    if (keys.has(normalizeKey(key, platform))) delete env[key];
+  }
+  Object.assign(env, captured);
+}

package/src/lib/claude-project-auto-memory.js

@@ -15,11 +15,12 @@ import {
   realpathSync,
   writeFileSync,
 } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { resolveClaudeProjectStorageDir } from "./claude-project-storage-layout.js";
 import {
-  CLAUDE_CONFIG_DIR_ENV,
-  resolveClaudeProjectStorageDir,
-} from "./claude-project-storage-layout.js";
+  captureStorageAuthorityEnvironment,
+  restoreStorageAuthorityEnvironment,
+} from "./authority-launch-environment.js";
 import {
   assertSafeConfigDataRoot,
   ensureClaudeProjectStorageTree,
@@ -40,29 +41,12 @@ export const CLAUDE_AUTO_MEMORY_MAX_SETTINGS_BYTES = 256 * 1024;
 export const CLAUDE_AUTO_MEMORY_MAX_BINDING_BYTES = 4096;
 export const CLAUDE_AUTO_MEMORY_MAX_EXISTING_FILES = 512;
 
-const LAUNCH_ENV_KEYS = Object.freeze([
-  "CHAINLESSCHAIN_HOME",
-  CLAUDE_CONFIG_DIR_ENV,
-  "CLAUDE_CODE_PROJECT_DIR_NAME",
-  "CLAUDE_CODE_DISABLE_AUTO_MEMORY",
-  "CC_MANAGED_SETTINGS",
-  // Managed settings default path is derived from these trusted launcher
-  // values on Windows; include them so a project settings env map cannot
-  // redirect that authority after the snapshot.
-  "ProgramData",
-  "PROGRAMDATA",
-]);
-
 function autoMemoryError(code, message) {
   const error = new Error(message);
   error.code = code;
   return error;
 }
 
-function owns(object, key) {
-  return Object.prototype.hasOwnProperty.call(object, key);
-}
-
 function pathContains(parent, candidate) {
   const relation = relative(parent, candidate);
   return (
@@ -353,11 +337,7 @@ function isAutoMemoryDisabled(env) {
 
 /** Capture storage-affecting environment authority before settings merge. */
 export function captureClaudeStorageLaunchEnvironment(env = process.env) {
-  const snapshot = {};
-  for (const key of LAUNCH_ENV_KEYS) {
-    if (typeof env[key] === "string") snapshot[key] = env[key];
-  }
-  return Object.freeze(snapshot);
+  return captureStorageAuthorityEnvironment(env);
 }
 
 /**
@@ -368,10 +348,7 @@ export function restoreClaudeStorageLaunchEnvironment(
   snapshot,
   env = process.env,
 ) {
-  for (const key of LAUNCH_ENV_KEYS) {
-    if (owns(snapshot || {}, key)) env[key] = snapshot[key];
-    else delete env[key];
-  }
+  restoreStorageAuthorityEnvironment(snapshot, env);
 }
 
 /** Validate configuration/root and project-name authority before side effects. */