chainlesschain 0.166.82 → 0.166.84

package/src/lib/evolution/volcengine-function-replay-store.js

@@ -687,37 +687,47 @@ export function captureVolcengineFunctionReplayStore(value) {
       "A branded Volcengine function replay store is required",
     );
   }
+  function readRevocation() {
+    try {
+      const revocation = readRevocationRecord(
+        captured.revocationPath,
+        captured.descriptor,
+      );
+      return Object.freeze({
+        schema: revocation.schema,
+        replayStoreId: revocation.replayStoreId,
+        authorityId: revocation.authorityId,
+        revocationAuthorityId: revocation.revocationAuthorityId,
+        tenantId: revocation.tenantId,
+        handlerArtifactDigest: revocation.handlerArtifactDigest,
+        policyRevision: revocation.policyRevision,
+        revocationId: revocation.revocationId,
+        reasonDigest: revocation.reasonDigest,
+        authorizationRequestDigest: revocation.authorizationRequestDigest,
+        authorizationEvidenceDigest: revocation.authorizationEvidenceDigest,
+        auditEventDigest: revocation.auditEventDigest,
+        durabilityReceiptDigest: revocation.durabilityReceiptDigest,
+        evidenceResolverDigest: revocation.evidenceResolverDigest,
+        evidenceReadbackDigest: revocation.evidenceReadbackDigest,
+        revokedAt: revocation.revokedAt,
+        revocationDigest: revocation.revocationDigest,
+      });
+    } catch (error) {
+      if (error?.code === "ENOENT") return null;
+      throw error;
+    }
+  }
   return Object.freeze({
     descriptor: captured.descriptor,
     readRevocation() {
-      try {
-        const revocation = readRevocationRecord(
-          captured.revocationPath,
-          captured.descriptor,
-        );
-        return Object.freeze({
-          schema: revocation.schema,
-          replayStoreId: revocation.replayStoreId,
-          authorityId: revocation.authorityId,
-          revocationAuthorityId: revocation.revocationAuthorityId,
-          tenantId: revocation.tenantId,
-          handlerArtifactDigest: revocation.handlerArtifactDigest,
-          policyRevision: revocation.policyRevision,
-          revocationId: revocation.revocationId,
-          reasonDigest: revocation.reasonDigest,
-          authorizationRequestDigest: revocation.authorizationRequestDigest,
-          authorizationEvidenceDigest: revocation.authorizationEvidenceDigest,
-          auditEventDigest: revocation.auditEventDigest,
-          durabilityReceiptDigest: revocation.durabilityReceiptDigest,
-          evidenceResolverDigest: revocation.evidenceResolverDigest,
-          evidenceReadbackDigest: revocation.evidenceReadbackDigest,
-          revokedAt: revocation.revokedAt,
-          revocationDigest: revocation.revocationDigest,
-        });
-      } catch (error) {
-        if (error?.code === "ENOENT") return null;
-        throw error;
-      }
+      // A revocation is created exclusively at its final path. Serialize
+      // readback with the official writer so a live publication's partial
+      // bytes cannot masquerade as a corrupt crash record. After a failed or
+      // dead writer releases its lock, incomplete records still fail closed.
+      return withFileLock(captured.lockTarget, readRevocation, {
+        failIfUnavailable: true,
+        timeoutMs: 5_000,
+      });
     },
     revoke(value) {
       const revocation = normalizeRevocation(value, captured.descriptor);

package/src/lib/host-tool-policy-authority.js

@@ -0,0 +1,151 @@
+/** Host-owned policy snapshots and synchronous, irreversible revisions.
+ * Revisions cover commits through this owner in this process. Persisting a
+ * session's latest policy does not make these revisions a durable journal.
+ */
+import { randomUUID } from "node:crypto";
+import { snapshotMcpJsonRpcInput } from "./mcp-call-ledger.js";
+
+const AUTHORITIES = new WeakSet();
+const CHILD_AUTHORITIES = new WeakMap();
+
+function unavailable() {
+  const error = new Error("Host tool policy authority is unavailable");
+  error.code = "CC_HOST_TOOL_POLICY_AUTHORITY_UNAVAILABLE";
+  return error;
+}
+
+function capturePolicy(policy) {
+  if (policy == null) return null;
+  try {
+    const snapshot = snapshotMcpJsonRpcInput(policy);
+    if (typeof snapshot !== "object" || Array.isArray(snapshot))
+      throw unavailable();
+    for (const field of ["tools", "toolPolicies"]) {
+      const policies = snapshot[field];
+      if (policies == null) continue;
+      if (typeof policies !== "object" || Array.isArray(policies))
+        throw unavailable();
+      for (const entry of Object.values(policies)) {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+          throw unavailable();
+        for (const flag of [
+          "allowed",
+          "requiresConfirmation",
+          "requiresPlanApproval",
+          "isReadOnly",
+        ]) {
+          if (entry[flag] !== undefined && typeof entry[flag] !== "boolean")
+            throw unavailable();
+        }
+        if (entry.decision !== undefined && typeof entry.decision !== "string")
+          throw unavailable();
+      }
+    }
+    if (
+      snapshot.toolDefinitions !== undefined &&
+      !Array.isArray(snapshot.toolDefinitions)
+    )
+      throw unavailable();
+    return snapshot;
+  } catch {
+    throw unavailable();
+  }
+}
+
+export function captureHostToolPolicyAuthority(authority) {
+  if (authority == null) return null;
+  if (!AUTHORITIES.has(authority)) throw unavailable();
+  return authority;
+}
+
+/** The host retains the controller; consumers receive only `authority`. */
+export function createHostToolPolicyAuthority(policy = null) {
+  const ownerId = randomUUID();
+  let snapshot = Object.freeze({
+    schema: "chainlesschain.host-tool-policy-authority/v1",
+    ownerId,
+    revision: 0,
+    policy: capturePolicy(policy),
+  });
+  let invalid = false;
+  const listeners = new Set();
+  function publish(nextPolicy) {
+    if (snapshot.revision >= Number.MAX_SAFE_INTEGER) throw unavailable();
+    snapshot = Object.freeze({
+      ...snapshot,
+      revision: snapshot.revision + 1,
+      policy: nextPolicy,
+    });
+    // Commit before notifying. A failing observer cannot hide a revision from
+    // the remaining execution monitors.
+    for (const listener of [...listeners]) {
+      try {
+        listener(snapshot);
+      } catch {
+        // Observer delivery does not roll back committed authority.
+      }
+    }
+    return snapshot;
+  }
+  const authority = Object.freeze({
+    getSnapshot() {
+      if (invalid) throw unavailable();
+      return snapshot;
+    },
+    subscribePolicyRevision(listener) {
+      if (typeof listener !== "function")
+        throw new TypeError("listener required");
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+  });
+  AUTHORITIES.add(authority);
+  return Object.freeze({
+    authority,
+    commit(nextPolicy) {
+      const captured = capturePolicy(nextPolicy);
+      if (
+        !invalid &&
+        JSON.stringify(captured) === JSON.stringify(snapshot.policy)
+      )
+        return snapshot;
+      invalid = false;
+      return publish(captured);
+    },
+    invalidate() {
+      invalid = true;
+      return publish(snapshot.policy);
+    },
+  });
+}
+
+/** Inherit the live ceiling without introducing host definitions into a child. */
+export function hostToolPolicyAuthorityForChild(value) {
+  const parent = captureHostToolPolicyAuthority(value);
+  if (!parent) return null;
+  if (CHILD_AUTHORITIES.has(parent)) return CHILD_AUTHORITIES.get(parent);
+  let previous = null;
+  let projected = null;
+  const child = Object.freeze({
+    getSnapshot() {
+      const current = parent.getSnapshot();
+      if (current !== previous) {
+        projected = Object.freeze({
+          ...current,
+          policy: current.policy
+            ? Object.freeze({
+                ...current.policy,
+                toolDefinitions: Object.freeze([]),
+              })
+            : null,
+        });
+        previous = current;
+      }
+      return projected;
+    },
+    subscribePolicyRevision: parent.subscribePolicyRevision,
+  });
+  AUTHORITIES.add(child);
+  CHILD_AUTHORITIES.set(parent, child);
+  return child;
+}

package/src/lib/permission-authority.js

@@ -1,14 +1,71 @@
 /** Resolve static settings plus CLI-owned workspace-scoped permission rules. */
 
 import settingsLoader from "./settings-loader.cjs";
-import { ScopedPermissionStore } from "./scoped-permission-store.js";
+import path from "node:path";
+import {
+  ScopedPermissionStore,
+  getScopedPermissionRevision,
+  subscribeScopedPermissionRevision,
+} from "./scoped-permission-store.js";
 
-const { applyManagedPermissionPolicy, loadSettings } = settingsLoader;
+const {
+  applyManagedPermissionPolicy,
+  loadSettings,
+  getSettingsPermissionRevision,
+  subscribeSettingsPermissionRevision,
+} = settingsLoader;
 const KINDS = ["allow", "ask", "deny"];
+const providers = new WeakMap();
+const settingsAuthority = Object.freeze({
+  getSnapshot: getSettingsPermissionRevision,
+  subscribePolicyRevision: subscribeSettingsPermissionRevision,
+});
+let combinedSnapshot = null;
+function getCombinedSnapshot() {
+  const settings = getSettingsPermissionRevision();
+  const scoped = getScopedPermissionRevision();
+  if (
+    combinedSnapshot?.settings !== settings ||
+    combinedSnapshot?.scoped !== scoped
+  ) {
+    combinedSnapshot = Object.freeze({ settings, scoped });
+  }
+  return combinedSnapshot;
+}
+const combinedAuthority = Object.freeze({
+  getSnapshot: getCombinedSnapshot,
+  subscribePolicyRevision(listener) {
+    if (typeof listener !== "function")
+      throw new TypeError("permission revision listener must be a function");
+    const removeSettings = subscribeSettingsPermissionRevision(listener);
+    const removeScoped = subscribeScopedPermissionRevision(listener);
+    return () => {
+      removeSettings();
+      removeScoped();
+    };
+  },
+});
+
+function freezeSnapshot(value) {
+  if (value && typeof value === "object") {
+    for (const child of Object.values(value)) freezeSnapshot(child);
+    Object.freeze(value);
+  }
+  return value;
+}
 
 function cloneRules(rules) {
   return Object.fromEntries(
-    KINDS.map((kind) => [kind, [...(rules?.[kind] || [])]]),
+    KINDS.map((kind) => {
+      const entries = rules?.[kind] ?? [];
+      if (
+        !Array.isArray(entries) ||
+        entries.some((entry) => typeof entry !== "string")
+      ) {
+        throw new TypeError(`permission ${kind} rules must be a string array`);
+      }
+      return [kind, [...entries]];
+    }),
   );
 }
 
@@ -24,6 +81,8 @@ export function loadPermissionAuthority({
   baseRules = null,
   scopedStore = null,
 } = {}) {
+  const settingsRevision = getSettingsPermissionRevision();
+  const scopedRevision = baseRules ? null : getScopedPermissionRevision();
   const loaded = loadSettings({
     cwd,
     settingsFile,
@@ -63,15 +122,59 @@ export function loadPermissionAuthority({
     }
   }
 
-  return {
+  if (getSettingsPermissionRevision() !== settingsRevision) {
+    const error = new Error(
+      "settings changed while permission authority was loading",
+    );
+    error.code = "CC_SETTINGS_PERMISSION_AUTHORITY_CHANGED";
+    throw error;
+  }
+  if (!baseRules && getScopedPermissionRevision() !== scopedRevision) {
+    const error = new Error(
+      "scoped permissions changed while permission authority was loading",
+    );
+    error.code = "CC_SCOPED_PERMISSION_AUTHORITY_CHANGED";
+    throw error;
+  }
+  return freezeSnapshot({
     ...loaded,
     rules,
     sources,
     scoped,
     hasRules: hasRules(rules),
-  };
+    settingsRevision,
+    ...(scopedRevision ? { scopedRevision } : {}),
+  });
 }
 
 export function createPermissionRulesProvider(options = {}) {
-  return () => loadPermissionAuthority(options);
+  const cwd = path.resolve(options.cwd || process.cwd());
+  const captured = Object.freeze({
+    cwd,
+    settingsFile: options.settingsFile
+      ? path.resolve(cwd, options.settingsFile)
+      : null,
+    managedSettingsFile: options.managedSettingsFile
+      ? path.resolve(options.managedSettingsFile)
+      : null,
+    // Environment kill switches retain live sampling semantics. The source
+    // object cannot be replaced through later changes to the options object.
+    env: options.env || process.env,
+    baseRules: options.baseRules
+      ? freezeSnapshot(cloneRules(options.baseRules))
+      : null,
+    scopedStore: options.scopedStore || null,
+  });
+  const provider = () => loadPermissionAuthority(captured);
+  providers.set(
+    provider,
+    captured.baseRules ? settingsAuthority : combinedAuthority,
+  );
+  return Object.freeze(provider);
+}
+
+// A legacy callback cannot advertise a trusted revision subscription simply
+// by copying properties onto itself. It still receives sampled revalidation.
+export function permissionRulesProviderAuthority(provider) {
+  return providers.get(provider) || null;
 }

package/src/lib/plugin-runtime/settings.js

@@ -17,6 +17,10 @@
 import fs from "fs";
 import { discoverPlugins } from "./scopes.js";
 import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
+import {
+  isPluginAuthorityEnvironmentKey,
+  isValidEnvironmentKey,
+} from "../authority-launch-environment.js";
 
 export const _deps = { readFileSync: fs.readFileSync };
 
@@ -68,7 +72,11 @@ export function collectPluginSettings(opts = {}) {
       !Array.isArray(parsed.env)
     ) {
       for (const [k, v] of Object.entries(parsed.env)) {
-        if (typeof v === "string") {
+        if (
+          typeof v === "string" &&
+          isValidEnvironmentKey(k) &&
+          !isPluginAuthorityEnvironmentKey(k)
+        ) {
           env[k] = v;
           contributed = true;
         }

package/src/lib/sandbox-egress-authority-monitor.js

@@ -1,7 +1,8 @@
 /**
  * Recheck the live shell authority while a Docker egress session exists. This
- * is a bounded poll, not a lossless revision subscription: changes that are
- * reverted between checks cannot be observed.
+ * uses bounded polling as a fallback. Trusted policy owners also call revoke()
+ * synchronously on official revisions; unobserved external changes reverted
+ * between polls remain outside that event guarantee.
  */
 export function createDockerEgressAuthorityMonitor({
   revalidate,