chainlesschain 0.166.84 → 0.166.85

package/src/lib/permission-authority.js

@@ -10,7 +10,8 @@ import {
 
 const {
   applyManagedPermissionPolicy,
-  loadSettings,
+  inspectSettingsSources,
+  projectSettingsObservation,
   getSettingsPermissionRevision,
   subscribeSettingsPermissionRevision,
 } = settingsLoader;
@@ -47,9 +48,14 @@ const combinedAuthority = Object.freeze({
 });
 
 function freezeSnapshot(value) {
-  if (value && typeof value === "object") {
-    for (const child of Object.values(value)) freezeSnapshot(child);
-    Object.freeze(value);
+  const pending = [value];
+  const seen = new WeakSet();
+  while (pending.length) {
+    const current = pending.pop();
+    if (!current || typeof current !== "object" || seen.has(current)) continue;
+    seen.add(current);
+    for (const child of Object.values(current)) pending.push(child);
+    Object.freeze(current);
   }
   return value;
 }
@@ -83,12 +89,13 @@ export function loadPermissionAuthority({
 } = {}) {
   const settingsRevision = getSettingsPermissionRevision();
   const scopedRevision = baseRules ? null : getScopedPermissionRevision();
-  const loaded = loadSettings({
+  const settingsObservation = inspectSettingsSources({
     cwd,
     settingsFile,
     managedSettingsFile,
     env,
   });
+  const loaded = projectSettingsObservation(settingsObservation, { env });
   const sources = baseRules ? {} : { ...loaded.sources };
   let rules = baseRules
     ? applyManagedPermissionPolicy(baseRules, loaded.managed, sources)
@@ -143,6 +150,7 @@ export function loadPermissionAuthority({
     scoped,
     hasRules: hasRules(rules),
     settingsRevision,
+    settingsObservation,
     ...(scopedRevision ? { scopedRevision } : {}),
   });
 }

package/src/lib/process-execution-broker/index.js

@@ -86,11 +86,13 @@ import {
   mcpStdioCapsuleNativeCodePolicyDigest,
 } from "../mcp-stdio-native-code-policy.js";
 
+import { isPackerBuildPolicy } from "./packer-build-policy.js";
 const SUPPORTED_SANDBOX_BOUNDARIES = new Set(Object.values(SANDBOX_BOUNDARIES));
 const SUPPORTED_SANDBOX_PROFILES = new Set([
   "default",
   "strict",
   "network-only",
+  "build",
 ]);
 // Broker-private admission state. Public runtime-probe fields are audit
 // evidence, not authority to invoke a privileged post-spawn closure.
@@ -1590,6 +1592,15 @@ class ProcessExecutionBroker extends EventEmitter {
     }
 
     const profile = rawPolicy?.profile ?? null;
+    if (
+      profile === "build" &&
+      !isPackerBuildPolicy(rawPolicy, options, launch)
+    ) {
+      throw this._sandboxBoundaryError(
+        "untrusted_build_sandbox_policy",
+        "The build CPU budget requires an original packer policy for this origin and scope",
+      );
+    }
     if (profile !== null && !SUPPORTED_SANDBOX_PROFILES.has(profile)) {
       throw this._sandboxBoundaryError(
         "invalid_sandbox_profile",

package/src/lib/process-execution-broker/linux-subreaper-helper.js

@@ -67,10 +67,77 @@ function compilerPath() {
   return compiler;
 }
 
+function isPkgRuntime() {
+  if (!process.pkg) return false;
+  // The location is derived only from this module and pkg's bootstrap, never
+  // from cwd, executable siblings, environment variables or caller paths.
+  if (
+    typeof process.pkg.defaultEntrypoint !== "string" ||
+    !process.pkg.defaultEntrypoint.startsWith("/snapshot/") ||
+    !fileURLToPath(import.meta.url).startsWith("/snapshot/")
+  )
+    throw failure("invalid-standalone-runtime");
+  return true;
+}
+
+function readPkgAsset(file, maximum) {
+  // pkg's snapshot descriptors refer to /dev/null in the kernel and are read
+  // through its immutable payload reader. They are NOT native directory FDs.
+  // Reject real files mounted under a snapshot-looking pathname as well as
+  // symlink aliases; a pathname prefix alone never establishes this identity.
+  if (fs.realpathSync(file) !== file || fs.lstatSync(file).isSymbolicLink())
+    throw failure("invalid-standalone-asset");
+  const fd = fs.openSync(file, fs.constants.O_RDONLY);
+  try {
+    if (fs.readlinkSync(`/proc/self/fd/${fd}`) !== "/dev/null")
+      throw failure("standalone-asset-not-embedded");
+    const stat = fs.fstatSync(fd);
+    if (
+      !stat.isFile() ||
+      stat.size < 1 ||
+      stat.size > maximum ||
+      stat.nlink !== 0 ||
+      stat.ino !== 0 ||
+      stat.dev !== 0
+    )
+      throw failure("invalid-standalone-asset");
+    // readFileSync(path) reads the embedded payload directly. pkg readSync(fd)
+    // can instead read a decompressed external cache when compression is on.
+    // Never trust those cache bytes as supervision executable content.
+    const bytes = fs.readFileSync(file);
+    if (
+      !Buffer.isBuffer(bytes) ||
+      bytes.length !== stat.size ||
+      bytes.length > maximum
+    )
+      throw failure("invalid-standalone-asset");
+    return bytes;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
 function packagedImage() {
   const root = fileURLToPath(
     new URL("../../assets/linux-subreaper/", import.meta.url),
   );
+  if (isPkgRuntime()) {
+    const directory = path.join(root, `linux-${process.arch}`);
+    const manifest = readPkgAsset(
+      path.join(directory, "manifest.json"),
+      MAX_SUBREAPER_MANIFEST_BYTES,
+    );
+    const bytes = readPkgAsset(
+      path.join(directory, "supervisor"),
+      MAX_IMAGE_BYTES,
+    );
+    return {
+      bytes,
+      identity: validateLinuxSubreaperArtifact(manifest, bytes, {
+        arch: process.arch,
+      }),
+    };
+  }
   // Only source checkouts with no packaged directory may use the development
   // compiler path. A partial/corrupt installed payload must never fall back.
   try {
@@ -135,23 +202,28 @@ function compileImage(spawnSync) {
     const source = fileURLToPath(
       new URL("./linux-subreaper-supervisor.c", import.meta.url),
     );
-    sourceFd = fs.openSync(
-      source,
-      fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW,
-    );
-    const snapshot = readDescriptor(sourceFd, MAX_SOURCE_BYTES);
+    const packed = isPkgRuntime();
+    let sourceSnapshot;
+    if (packed) {
+      sourceSnapshot = readPkgAsset(source, MAX_SOURCE_BYTES);
+    } else {
+      sourceFd = fs.openSync(
+        source,
+        fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW,
+      );
+      const snapshot = readDescriptor(sourceFd, MAX_SOURCE_BYTES);
+      if (snapshot.stat.nlink !== 1n) throw failure("source-digest-mismatch");
+      sourceSnapshot = snapshot.bytes;
+      fs.closeSync(sourceFd);
+      sourceFd = null;
+    }
     // npm/git may transport text with CRLF. Compile the exact canonical bytes
     // that the source digest commits to, passed on stdin rather than reopened.
     const sourceBytes = Buffer.from(
-      snapshot.bytes.toString("utf8").replace(/\r\n/g, "\n"),
+      sourceSnapshot.toString("utf8").replace(/\r\n/g, "\n"),
     );
-    if (
-      snapshot.stat.nlink !== 1n ||
-      sha(sourceBytes) !== LINUX_SUBREAPER_SOURCE_DIGEST
-    )
+    if (sha(sourceBytes) !== LINUX_SUBREAPER_SOURCE_DIGEST)
       throw failure("source-digest-mismatch");
-    fs.closeSync(sourceFd);
-    sourceFd = null;
     const packaged = packagedImage();
     const compiler = packaged ? null : compilerPath();
     temporaryRoot = fs.mkdtempSync(
@@ -253,7 +325,9 @@ function compileImage(spawnSync) {
     // Do not expose compiler stdout/stderr, paths, environment, or native argv.
     throw failure(
       error.code === "ENOENT"
-        ? "system-compiler-or-source-missing"
+        ? process.pkg
+          ? "standalone-asset-missing"
+          : "system-compiler-or-source-missing"
         : "native-build-setup-failed",
     );
   } finally {

package/src/lib/process-execution-broker/packer-build-policy.js

@@ -0,0 +1,31 @@
+// In-process identity, not a JSON profile name, admits the packer's larger
+// finite CPU budget. This grants no process permission: the broker's ordinary
+// deny/prompt checks and strict-mode override still apply.
+const policies = new WeakMap();
+const origins = new Set(["packer:pkg", "packer:web-panel-build"]);
+
+export const PACKER_BUILD_TIMEOUT_MS = 900_000;
+
+export function createPackerBuildPolicy(origin) {
+  if (!origins.has(origin)) throw new Error("Unknown packer build origin");
+  const policy = Object.freeze({ profile: "build" });
+  policies.set(policy, origin);
+  return policy;
+}
+
+export function isPackerBuildPolicy(policy, options, launch = {}) {
+  const { origin, scope, shell, detached, timeout, killSignal } = options;
+  return (
+    scope === "pack" &&
+    origins.has(origin) &&
+    policies.get(policy) === origin &&
+    launch.sync === true &&
+    launch.pty !== true &&
+    shell === false &&
+    (detached === undefined || detached === false) &&
+    Number.isSafeInteger(timeout) &&
+    timeout > 0 &&
+    timeout <= PACKER_BUILD_TIMEOUT_MS &&
+    killSignal === "SIGKILL"
+  );
+}

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -2128,7 +2128,7 @@ export function applyMacSandbox(
   // non-strict mode records the unavailable primitive and executes the
   // original invocation, while strict mode fails closed. Explicit strict or
   // network-only profiles still opt in to the sandbox-exec wrapper below.
-  if ((sandboxOpts.profileName || "default") === "default") {
+  if (["default", "build"].includes(sandboxOpts.profileName || "default")) {
     return createSandboxPlan({
       ...base,
       reason: "macos_default_profile_requires_explicit_policy",
@@ -9969,8 +9969,16 @@ export function applySandbox(
   };
 
   const profile = {
-    ...(profiles[profileName] || profiles.default),
-    profileName: profiles[profileName] ? profileName : "default",
+    ...(profileName === "build"
+      ? {
+          ...profiles.default,
+          limits: { ...profiles.default.limits, cpu: 600 },
+        }
+      : profiles[profileName] || profiles.default),
+    profileName:
+      profileName === "build" || profiles[profileName]
+        ? profileName
+        : "default",
     requiredBoundaries: sandboxRequest.requiredBoundaries,
     sync: sandboxRequest.sync,
     pty: sandboxRequest.pty,

package/src/lib/scoped-permission-store.js

@@ -143,7 +143,7 @@ function validateRecord(record, seenIds) {
     seenIds.has(record.id) ||
     !DECISIONS.has(record.decision) ||
     !parseRule(record.rule) ||
-    !Number.isInteger(record.revision) ||
+    !Number.isSafeInteger(record.revision) ||
     record.revision < 1 ||
     !Number.isFinite(record.createdAt) ||
     !Number.isFinite(record.expiresAt) ||
@@ -165,7 +165,7 @@ function validateState(value, workspace) {
     !value ||
     value.schema !== STATE_SCHEMA ||
     value.schemaVersion !== STATE_SCHEMA_VERSION ||
-    !Number.isInteger(value.generation) ||
+    !Number.isSafeInteger(value.generation) ||
     value.generation < 0 ||
     !value.workspace ||
     value.workspace.id !== workspace.id ||
@@ -188,6 +188,16 @@ function statusFor(record, now) {
   return "active";
 }
 
+function nextVersion(value, label) {
+  if (value === Number.MAX_SAFE_INTEGER) {
+    throw scopedPermissionError(
+      SCOPED_PERMISSION_ERROR_CODES.INVALID,
+      `Scoped permission ${label} is exhausted`,
+    );
+  }
+  return value + 1;
+}
+
 function projectRecord(record, now, filePath) {
   return Object.freeze({
     ...structuredClone(record),
@@ -412,7 +422,7 @@ export class ScopedPermissionStore {
         reason: normalizedReason,
       };
       Object.assign(draft, current, {
-        generation: current.generation + 1,
+        generation: nextVersion(current.generation, "generation"),
         updatedAt: now,
         rules: [...retained, created],
       });
@@ -462,13 +472,13 @@ export class ScopedPermissionStore {
       }
       revoked = {
         ...record,
-        revision: record.revision + 1,
+        revision: nextVersion(record.revision, "revision"),
         revokedAt: now,
       };
       const rules = [...current.rules];
       rules[index] = revoked;
       Object.assign(draft, current, {
-        generation: current.generation + 1,
+        generation: nextVersion(current.generation, "generation"),
         updatedAt: now,
         rules,
       });

package/src/lib/settings-loader.cjs

@@ -50,6 +50,7 @@ const _deps = {
   writeSecurityStore: (...args) => securityStore().writeSecurityStore(...args),
   withFileLock: (...args) => lockHelper()(...args),
 };
+const settingsObservations = new WeakSet();
 
 // A process-wide owner deliberately revokes unrelated projects too. Matching
 // only contributing paths misses absent files, parent discovery and aliases.
@@ -173,7 +174,7 @@ function inspectSettingsSources(opts = {}) {
     ...settingsPaths(cwd, opts.settingsFile),
     managedSettingsPath(opts),
   ];
-  return Object.freeze({
+  const observation = Object.freeze({
     schema: "chainlesschain.settings-source-observation/v1",
     cwd,
     sources: observeSettingsSources(candidates, {
@@ -181,6 +182,8 @@ function inspectSettingsSources(opts = {}) {
       maxBytes: opts.maxBytes,
     }),
   });
+  settingsObservations.add(observation);
+  return observation;
 }
 
 /** Organization-controlled settings file. This layer is always highest. */
@@ -273,13 +276,50 @@ function loadSettings(opts = {}) {
   const cwd = opts.cwd || process.cwd();
   const env = opts.env || process.env;
   const onWarn = opts.onWarn;
+  function* layers() {
+    for (const file of settingsPaths(cwd, opts.settingsFile)) {
+      yield { file, settings: readSettingsFile(file, { onWarn }) };
+    }
+  }
+  return mergePermissionSettings(layers(), env, () =>
+    loadManagedSettings({
+      env,
+      managedSettingsFile: opts.managedSettingsFile,
+      onWarn,
+    }),
+  );
+}
+
+/**
+ * Project the exact JSON trees read and hashed by inspectSettingsSources.
+ * No path discovery or filesystem read occurs here. The final source has the
+ * managed role even when an earlier explicit/user/project source has the same
+ * path; retaining both positions preserves precedence and provenance.
+ *
+ * This is a byte-bound projection, not a fresh authority check or an atomic
+ * inventory snapshot. Environment inputs retain their existing sampling rules.
+ */
+function projectSettingsObservation(observation, { env = {} } = {}) {
+  if (!settingsObservations.has(observation)) {
+    throw new TypeError("A strict settings source observation is required");
+  }
+  const managed = observation.sources[observation.sources.length - 1];
+  return mergePermissionSettings(
+    observation.sources.slice(0, -1).map((source) => ({
+      file: source.logicalPath,
+      settings: source.settings,
+    })),
+    env,
+    () => ({ file: managed.logicalPath, settings: managed.settings }),
+  );
+}
 
+function mergePermissionSettings(layers, env, readManaged) {
   let rules = emptyRules();
   const sources = {};
   const files = [];
 
-  for (const file of settingsPaths(cwd, opts.settingsFile)) {
-    const data = readSettingsFile(file, { onWarn });
+  for (const { file, settings: data } of layers) {
     if (!data) continue;
     const perms =
       data.permissions && typeof data.permissions === "object"
@@ -308,11 +348,7 @@ function loadSettings(opts = {}) {
   }
   if (envContributed) files.push("<env>");
 
-  const managedLoaded = loadManagedSettings({
-    env,
-    managedSettingsFile: opts.managedSettingsFile,
-    onWarn,
-  });
+  const managedLoaded = readManaged();
   if (managedLoaded.settings) {
     rules = applyManagedPermissionPolicy(
       rules,
@@ -662,6 +698,7 @@ function readStringArraySetting(key, opts = {}) {
 
 module.exports = {
   inspectSettingsSources,
+  projectSettingsObservation,
   loadSettings,
   loadSettingsConfig,
   readSettingsFile,

package/src/assets/web-panel/assets/ChatBubbleRenderer-B8ts_JnN.js

@@ -1 +0,0 @@
-import{I as v,P as u,J as S,U as s,R as a,S as y,K as C,Q as x,V as w,_ as B,b as n}from"./vendor-Bn1JzzAn.js";import{_ as k}from"./index-CuZupgUw.js";import"./icons-DG5UD-6K.js";const N={__name:"ChatBubbleRenderer",props:{event:{type:Object,required:!0}},setup(c,{expose:d}){d();const t=c,r=n(()=>{const e=t.event.content||{};return e.text||e.body||e.message||e.title||JSON.stringify(e).slice(0,200)}),i=n(()=>{const e=t.event.content||{};return e.from||e.sender||e.senderName||t.event.actor||"(unknown)"}),l=n(()=>{const e=(t.event.actor||"").toLowerCase();return e.includes("self")||e==="me"||e.endsWith("_self")}),o=n(()=>{const e=t.event.source.adapter||"";return e.startsWith("messaging-qq")?"magenta":e==="wechat"?"green":"blue"}),m=n(()=>{if(!t.event.occurredAt)return"";try{const e=new Date(t.event.occurredAt),p=e.getFullYear(),f=String(e.getMonth()+1).padStart(2,"0"),g=String(e.getDate()).padStart(2,"0"),b=String(e.getHours()).padStart(2,"0"),h=String(e.getMinutes()).padStart(2,"0");return`${p}-${f}-${g} ${b}:${h}`}catch{return""}}),_={props:t,messageText:r,actorLabel:i,isMine:l,adapterColor:o,formattedTime:m,computed:n};return Object.defineProperty(_,"__isScriptSetup",{enumerable:!1,value:!0}),_}},T={class:"bubble"},M={class:"meta"},R={class:"actor"},V={class:"time"},q={class:"body"};function D(c,d,t,r,i,l){const o=v("a-tag");return u(),S("div",{class:B(["chat-row",{mine:r.isMine}])},[s("div",T,[s("div",M,[s("span",R,a(r.actorLabel),1),s("span",V,a(r.formattedTime),1)]),s("div",q,a(r.messageText),1),t.event.source.adapter?(u(),y(o,{key:0,class:"src",color:r.adapterColor},{default:C(()=>[x(a(t.event.source.adapter),1)]),_:1},8,["color"])):w("v-if",!0)])],2)}const j=k(N,[["render",D],["__scopeId","data-v-49238629"],["__file","/tmp/cc-web-panel-eIdfn0/repo/packages/web-panel/src/components/pdh/renderers/ChatBubbleRenderer.vue"]]);export{j as default};

package/src/assets/web-panel/assets/MarkdownRenderer-qNJS3ygh.js

@@ -1 +0,0 @@
-import{P as c,J as d,b as s}from"./vendor-Bn1JzzAn.js";import{r as a}from"./markdown-Yo_c6Krv.js";import{_ as p}from"./index-CuZupgUw.js";const _={__name:"MarkdownRenderer",props:{content:{type:String,default:""}},setup(t,{expose:o}){o();const e=t,r=s(()=>a(e.content||"")),n={props:e,rendered:r,computed:s,get renderMarkdown(){return a}};return Object.defineProperty(n,"__isScriptSetup",{enumerable:!1,value:!0}),n}},i=["innerHTML"];function m(t,o,e,r,n,u){return c(),d("div",{class:"markdown-content",innerHTML:r.rendered},null,8,i)}const w=p(_,[["render",m],["__scopeId","data-v-0b0b9f63"],["__file","/tmp/cc-web-panel-eIdfn0/repo/packages/web-panel/src/components/MarkdownRenderer.vue"]]);export{w as M};

package/src/assets/web-panel/assets/MobileProjects-DC0Clgzs.js

@@ -1 +0,0 @@
-import{I as n,J as g,c as l,K as r,N as u,P as h,U as o,R as t,Q as b}from"./vendor-Bn1JzzAn.js";import{_ as v,b as m}from"./index-CuZupgUw.js";import{a8 as y,M}from"./icons-DG5UD-6K.js";const B={__name:"MobileProjects",setup(p,{expose:i}){i();const c=u(),{t:e}=m();function a(){c.push("/projects")}function _(){c.push("/mobile-bridge")}const s={router:c,t:e,goToProjects:a,goToMobileBridge:_,get useRouter(){return u},get useI18n(){return m},get MobileOutlined(){return M},get FolderOutlined(){return y}};return Object.defineProperty(s,"__isScriptSetup",{enumerable:!1,value:!0}),s}},x={class:"mobile-projects-placeholder"},O={class:"title"},k={class:"subtitle"},w={class:"explainer"};function T(p,i,c,e,a,_){const s=n("a-alert"),d=n("a-button"),f=n("a-space"),P=n("a-empty"),j=n("a-card");return h(),g("div",x,[l(j,null,{default:r(()=>[l(P,{description:!1},{image:r(()=>[l(e.MobileOutlined,{style:{fontSize:"64px",color:"#bfbfbf"}})]),default:r(()=>[o("h2",O,t(e.t("mobileProjects.title")),1),o("p",k,t(e.t("mobileProjects.subtitle")),1),l(s,{message:e.t("mobileProjects.v02Banner"),type:"info","show-icon":"",class:"banner"},null,8,["message"]),o("div",w,[o("h3",null,t(e.t("mobileProjects.currentDirection")),1),o("p",null,t(e.t("mobileProjects.currentDirectionBody")),1),o("ul",null,[o("li",null,t(e.t("mobileProjects.stepPhone")),1),o("li",null,t(e.t("mobileProjects.stepTap")),1),o("li",null,t(e.t("mobileProjects.stepPull")),1)]),o("h3",null,t(e.t("mobileProjects.reverseDirection")),1),o("p",null,t(e.t("mobileProjects.reverseDirectionBody")),1)]),l(f,{class:"actions"},{default:r(()=>[l(d,{type:"primary",onClick:e.goToProjects},{default:r(()=>[l(e.FolderOutlined),b(" "+t(e.t("mobileProjects.viewLocalProjects")),1)]),_:1}),l(d,{onClick:e.goToMobileBridge},{default:r(()=>[l(e.MobileOutlined),b(" "+t(e.t("mobileProjects.checkBridge")),1)]),_:1})]),_:1})]),_:1})]),_:1})])}const N=v(B,[["render",T],["__scopeId","data-v-9262cc45"],["__file","/tmp/cc-web-panel-eIdfn0/repo/packages/web-panel/src/views/MobileProjects.vue"]]);export{N as default};

package/src/assets/web-panel/assets/devWarning-BoDvrsgY.js

@@ -1 +0,0 @@
-import{Q as r}from"./index-CuZupgUw.js";const o=((n,a,e)=>{r(n,`[ant-design-vue: ${a}] ${e}`)});export{o as d};

package/src/assets/web-panel/assets/index-BhqRbl5P.js

@@ -1 +0,0 @@
-import{C as o}from"./Col-G0zYohIP.js";import{a0 as t}from"./index-CuZupgUw.js";import"./vendor-Bn1JzzAn.js";import"./index-BZ7mv_oS.js";import"./icons-DG5UD-6K.js";const s=t(o);export{s as default};

package/src/assets/web-panel/assets/index-DreT6MIR.js

@@ -1 +0,0 @@
-import{A as o}from"./Row-EzEMaYoV.js";import{a0 as t}from"./index-CuZupgUw.js";import"./vendor-Bn1JzzAn.js";import"./responsiveObserve-PfqJrlkI.js";import"./useFlexGapSupport-ITPUjcDw.js";import"./styleChecker-Bq57I3ls.js";import"./index-BZ7mv_oS.js";import"./icons-DG5UD-6K.js";const l=t(o);export{l as default};