chainlesschain 0.166.82 → 0.166.84

package/src/lib/scoped-permission-store.js

@@ -13,9 +13,10 @@ import projectRoot from "./project-root.cjs";
 import permissionRules from "./permission-rules.cjs";
 import { getMachineSecurityAnchorDir } from "./paths.js";
 import {
-  mutateSecurityStore,
   readSecurityStore,
+  writeSecurityStore,
 } from "./durable-security-store.js";
+import { withFileLock } from "./with-file-lock.js";
 
 const { findGitProjectRoot } = projectRoot;
 const { parseRule } = permissionRules;
@@ -27,6 +28,58 @@ const RULE_ID_PATTERN = /^spr_[0-9a-f]{32}$/;
 const DECISIONS = new Set(["allow", "ask", "deny"]);
 const DEFAULT_MAX_RECORDS = 1000;
 
+// Official mutations revoke every provider in this module instance. Path
+// matching alone misses aliases and files that did not exist at admission.
+// This is an in-process event owner, not a cross-process notification journal.
+const ownerId = randomUUID();
+let permissionRevision = Object.freeze({
+  ownerId,
+  revision: 0,
+  state: "ready",
+});
+const revisionListeners = new Set();
+
+export function getScopedPermissionRevision() {
+  if (permissionRevision.state !== "ready") {
+    throw scopedPermissionError(
+      "CC_SCOPED_PERMISSION_AUTHORITY_UNAVAILABLE",
+      "Scoped permission authority is unavailable",
+    );
+  }
+  return permissionRevision;
+}
+
+export function subscribeScopedPermissionRevision(listener) {
+  if (typeof listener !== "function")
+    throw new TypeError(
+      "scoped permission revision listener must be a function",
+    );
+  revisionListeners.add(listener);
+  return () => revisionListeners.delete(listener);
+}
+
+function beginMutation() {
+  getScopedPermissionRevision();
+  const revision = permissionRevision.revision + 1;
+  permissionRevision = Object.freeze({
+    ownerId,
+    revision,
+    state: Number.isSafeInteger(revision) ? "mutating" : "invalid",
+  });
+  for (const listener of [...revisionListeners]) {
+    try {
+      listener(permissionRevision);
+    } catch {
+      // One observer must not prevent the other shells from being revoked.
+    }
+  }
+  if (permissionRevision.state === "invalid") getScopedPermissionRevision();
+}
+
+function finishMutation(state) {
+  permissionRevision = Object.freeze({ ...permissionRevision, state });
+}
+
 export const SCOPED_PERMISSION_ERROR_CODES = Object.freeze({
   INVALID: "CC_SCOPED_PERMISSION_INVALID",
   CONFLICT: "CC_SCOPED_PERMISSION_CONFLICT",
@@ -181,24 +234,89 @@ export class ScopedPermissionStore {
     this._randomId = randomId;
   }
 
-  _read() {
-    const stored = readSecurityStore(this.filePath, STORE_LABEL);
-    if (Object.keys(stored).length === 0) return emptyState(this.workspace);
-    return validateState(stored, this.workspace);
+  _capture() {
+    const revision = getScopedPermissionRevision();
+    const captured = Object.freeze({
+      filePath: path.resolve(this.filePath),
+      workspace: Object.freeze({ ...this.workspace }),
+      now: this._now.bind(this),
+      randomId: this._randomId.bind(this),
+      maxRecords: this.maxRecords,
+      lock: this._lock || withFileLock,
+    });
+    if (getScopedPermissionRevision() !== revision)
+      throw scopedPermissionError(
+        "CC_SCOPED_PERMISSION_AUTHORITY_CHANGED",
+        "Scoped permission authority changed while capturing the operation",
+      );
+    return captured;
+  }
+
+  _read(captured = this._capture()) {
+    getScopedPermissionRevision();
+    const stored = readSecurityStore(captured.filePath, STORE_LABEL);
+    if (Object.keys(stored).length === 0) return emptyState(captured.workspace);
+    return validateState(stored, captured.workspace);
+  }
+
+  _mutate(captured, update) {
+    getScopedPermissionRevision(); // Reject observer reentry before the lock.
+    fs.mkdirSync(path.dirname(captured.filePath), {
+      recursive: true,
+      mode: 0o700,
+    });
+    let started = false;
+    let committed = false;
+    try {
+      captured.lock(
+        captured.filePath,
+        () => {
+          const draft = this._read(captured);
+          if (update(draft) === false) return; // Idempotent revoke does no I/O.
+          validateState(draft, captured.workspace);
+          started = true;
+          beginMutation();
+          // No draft field aliases the public instance during notification.
+          validateState(draft, captured.workspace);
+          writeSecurityStore(captured.filePath, STORE_LABEL, draft);
+          committed = true;
+        },
+        { timeoutMs: 2000, staleMs: 30000, failIfUnavailable: true },
+      );
+      if (started) finishMutation("ready");
+    } catch (error) {
+      if (!error.commitState)
+        error.commitState = committed ? "committed" : "not-committed";
+      if (started)
+        finishMutation(
+          error.commitState === "unknown" ||
+            permissionRevision.state === "invalid"
+            ? "invalid"
+            : "ready",
+        );
+      throw error;
+    }
   }
 
   list() {
-    const state = this._read();
-    const now = this._now();
+    const revision = getScopedPermissionRevision();
+    const captured = this._capture();
+    const state = this._read(captured);
+    const now = captured.now();
+    if (getScopedPermissionRevision() !== revision)
+      throw scopedPermissionError(
+        "CC_SCOPED_PERMISSION_AUTHORITY_CHANGED",
+        "Scoped permission authority changed while reading rules",
+      );
     return Object.freeze({
       schema: state.schema,
       schemaVersion: state.schemaVersion,
       generation: state.generation,
       updatedAt: state.updatedAt,
       workspace: structuredClone(state.workspace),
-      file: this.filePath,
+      file: captured.filePath,
       rules: state.rules.map((record) =>
-        projectRecord(record, now, this.filePath),
+        projectRecord(record, now, captured.filePath),
       ),
     });
   }
@@ -210,12 +328,13 @@ export class ScopedPermissionStore {
     reason = "",
     expectedGeneration = null,
   } = {}) {
+    const captured = this._capture();
     const normalizedDecision = String(decision || "")
       .trim()
       .toLowerCase();
     const normalizedRule = String(rule || "").trim();
     const normalizedReason = String(reason || "").trim();
-    const now = this._now();
+    const now = captured.now();
     const expiry = Number(expiresAt);
     if (!DECISIONS.has(normalizedDecision)) {
       throw scopedPermissionError(
@@ -243,71 +362,67 @@ export class ScopedPermissionStore {
     }
 
     let created = null;
-    mutateSecurityStore(
-      this.filePath,
-      STORE_LABEL,
-      (draft) => {
-        const current =
-          Object.keys(draft).length === 0
-            ? emptyState(this.workspace)
-            : validateState(draft, this.workspace);
-        if (
-          expectedGeneration !== null &&
-          Number(expectedGeneration) !== current.generation
-        ) {
-          throw scopedPermissionError(
-            SCOPED_PERMISSION_ERROR_CODES.CONFLICT,
-            `Scoped permission generation changed (expected ${expectedGeneration}, current ${current.generation})`,
-          );
-        }
+    this._mutate(captured, (draft) => {
+      const current =
+        Object.keys(draft).length === 0
+          ? emptyState(captured.workspace)
+          : validateState(draft, captured.workspace);
+      if (
+        expectedGeneration !== null &&
+        Number(expectedGeneration) !== current.generation
+      ) {
+        throw scopedPermissionError(
+          SCOPED_PERMISSION_ERROR_CODES.CONFLICT,
+          `Scoped permission generation changed (expected ${expectedGeneration}, current ${current.generation})`,
+        );
+      }
 
-        const retained = [...current.rules];
-        while (retained.length >= this.maxRecords) {
-          const inactiveIndex = retained.findIndex(
-            (record) => statusFor(record, now) !== "active",
-          );
-          if (inactiveIndex < 0) break;
-          retained.splice(inactiveIndex, 1);
-        }
-        if (retained.length >= this.maxRecords) {
-          throw scopedPermissionError(
-            SCOPED_PERMISSION_ERROR_CODES.INVALID,
-            `Scoped permission store is full (${this.maxRecords} retained rules)`,
-          );
-        }
-        const id = this._randomId();
-        if (
-          !RULE_ID_PATTERN.test(id) ||
-          retained.some((item) => item.id === id)
-        ) {
-          throw scopedPermissionError(
-            SCOPED_PERMISSION_ERROR_CODES.INVALID,
-            "Could not allocate a valid unique scoped permission id",
-          );
-        }
-        created = {
-          id,
-          decision: normalizedDecision,
-          rule: normalizedRule,
-          revision: 1,
-          createdAt: now,
-          expiresAt: expiry,
-          revokedAt: null,
-          reason: normalizedReason,
-        };
-        Object.assign(draft, current, {
-          generation: current.generation + 1,
-          updatedAt: now,
-          rules: [...retained, created],
-        });
-        validateState(draft, this.workspace);
-      },
-      this._lock ? { lock: this._lock } : undefined,
-    );
-    return projectRecord(created, now, this.filePath);
+      const retained = [...current.rules];
+      while (retained.length >= captured.maxRecords) {
+        const inactiveIndex = retained.findIndex(
+          (record) => statusFor(record, now) !== "active",
+        );
+        if (inactiveIndex < 0) break;
+        retained.splice(inactiveIndex, 1);
+      }
+      if (retained.length >= captured.maxRecords) {
+        throw scopedPermissionError(
+          SCOPED_PERMISSION_ERROR_CODES.INVALID,
+          `Scoped permission store is full (${captured.maxRecords} retained rules)`,
+        );
+      }
+      const id = captured.randomId();
+      if (
+        !RULE_ID_PATTERN.test(id) ||
+        retained.some((item) => item.id === id)
+      ) {
+        throw scopedPermissionError(
+          SCOPED_PERMISSION_ERROR_CODES.INVALID,
+          "Could not allocate a valid unique scoped permission id",
+        );
+      }
+      created = {
+        id,
+        decision: normalizedDecision,
+        rule: normalizedRule,
+        revision: 1,
+        createdAt: now,
+        expiresAt: expiry,
+        revokedAt: null,
+        reason: normalizedReason,
+      };
+      Object.assign(draft, current, {
+        generation: current.generation + 1,
+        updatedAt: now,
+        rules: [...retained, created],
+      });
+      validateState(draft, captured.workspace);
+    });
+    return projectRecord(created, now, captured.filePath);
   }
 
   revoke({ id, expectedRevision = null } = {}) {
+    const captured = this._capture();
     const normalizedId = String(id || "").trim();
     if (!RULE_ID_PATTERN.test(normalizedId)) {
       throw scopedPermissionError(
@@ -315,55 +430,50 @@ export class ScopedPermissionStore {
         "A valid scoped permission id is required",
       );
     }
-    const now = this._now();
+    const now = captured.now();
     let revoked = null;
-    mutateSecurityStore(
-      this.filePath,
-      STORE_LABEL,
-      (draft) => {
-        const current =
-          Object.keys(draft).length === 0
-            ? emptyState(this.workspace)
-            : validateState(draft, this.workspace);
-        const index = current.rules.findIndex(
-          (record) => record.id === normalizedId,
+    this._mutate(captured, (draft) => {
+      const current =
+        Object.keys(draft).length === 0
+          ? emptyState(captured.workspace)
+          : validateState(draft, captured.workspace);
+      const index = current.rules.findIndex(
+        (record) => record.id === normalizedId,
+      );
+      if (index < 0) {
+        throw scopedPermissionError(
+          SCOPED_PERMISSION_ERROR_CODES.NOT_FOUND,
+          `Scoped permission rule not found: ${normalizedId}`,
         );
-        if (index < 0) {
-          throw scopedPermissionError(
-            SCOPED_PERMISSION_ERROR_CODES.NOT_FOUND,
-            `Scoped permission rule not found: ${normalizedId}`,
-          );
-        }
-        const record = current.rules[index];
-        if (
-          expectedRevision !== null &&
-          Number(expectedRevision) !== record.revision
-        ) {
-          throw scopedPermissionError(
-            SCOPED_PERMISSION_ERROR_CODES.CONFLICT,
-            `Scoped permission revision changed (expected ${expectedRevision}, current ${record.revision})`,
-          );
-        }
-        if (record.revokedAt !== null) {
-          revoked = record;
-          return;
-        }
-        revoked = {
-          ...record,
-          revision: record.revision + 1,
-          revokedAt: now,
-        };
-        const rules = [...current.rules];
-        rules[index] = revoked;
-        Object.assign(draft, current, {
-          generation: current.generation + 1,
-          updatedAt: now,
-          rules,
-        });
-        validateState(draft, this.workspace);
-      },
-      this._lock ? { lock: this._lock } : undefined,
-    );
-    return projectRecord(revoked, now, this.filePath);
+      }
+      const record = current.rules[index];
+      if (
+        expectedRevision !== null &&
+        Number(expectedRevision) !== record.revision
+      ) {
+        throw scopedPermissionError(
+          SCOPED_PERMISSION_ERROR_CODES.CONFLICT,
+          `Scoped permission revision changed (expected ${expectedRevision}, current ${record.revision})`,
+        );
+      }
+      if (record.revokedAt !== null) {
+        revoked = record;
+        return false;
+      }
+      revoked = {
+        ...record,
+        revision: record.revision + 1,
+        revokedAt: now,
+      };
+      const rules = [...current.rules];
+      rules[index] = revoked;
+      Object.assign(draft, current, {
+        generation: current.generation + 1,
+        updatedAt: now,
+        rules,
+      });
+      validateState(draft, captured.workspace);
+    });
+    return projectRecord(revoked, now, captured.filePath);
   }
 }

package/src/lib/session-manager.js

@@ -108,7 +108,7 @@ export function saveMessages(db, sessionId, messages, metadata) {
 /**
  * Get a session by ID
  */
-export function getSession(db, sessionId) {
+export function getSession(db, sessionId, { strictMetadata = false } = {}) {
   ensureSessionsTable(db);
 
   // Try exact match first, then prefix match
@@ -127,16 +127,31 @@ export function getSession(db, sessionId) {
 
   if (!session) return null;
 
+  let metadata;
+  if (strictMetadata) {
+    metadata =
+      typeof session.metadata === "string"
+        ? JSON.parse(session.metadata)
+        : (session.metadata ?? {});
+    if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+      const error = new TypeError("Session authority metadata is invalid");
+      error.code = "CC_SESSION_AUTHORITY_METADATA_INVALID";
+      throw error;
+    }
+  } else {
+    metadata =
+      typeof session.metadata === "string"
+        ? safeJsonParse(session.metadata, {})
+        : session.metadata || {};
+  }
+
   return {
     ...session,
     // A single corrupt (non-JSON, non-empty) column must not make the whole
     // session unloadable — that would block resume of the user's own data.
     // Matches the safeJsonParse fallback listSessions already uses.
     messages: safeJsonParse(session.messages, []),
-    metadata:
-      typeof session.metadata === "string"
-        ? safeJsonParse(session.metadata, {})
-        : session.metadata || {},
+    metadata,
   };
 }