chainlesschain 0.166.85 → 0.166.86

package/src/lib/packer/pack-update-applier.js

@@ -853,6 +853,11 @@ async function scheduleWindowsTransaction(ctx) {
 function windowsGenerationJournalHelperSource() {
   return String.raw`param()
 $ErrorActionPreference = 'Stop'
+# The journal contains only JSON primitives. Use the inbox .NET serializer and
+# file/path APIs so each phase does not repeat PowerShell module discovery.
+# Keep the same synchronous atomic replacement and durable flush protocol.
+[void][Reflection.Assembly]::Load('System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35')
+$Serializer = [Web.Script.Serialization.JavaScriptSerializer]::new()
 $Action = [string]$env:JOURNAL_ACTION
 $JournalPath = [string]$env:JOURNAL_FILE
 $RetiredPath = [string]$env:JOURNAL_RETIRED
@@ -872,7 +877,7 @@ if (($Phase -eq 'committed') -ne ($Decision -eq 'commit')) { throw 'Invalid phas
 if ($Action -eq 'write' -and $Phase -eq 'prepared') {
   if ([IO.File]::Exists($JournalPath)) { throw 'A generation journal already exists' }
   $Bytes = [Convert]::FromBase64String([string]$env:JOURNAL_INITIAL_BASE64)
-  $Journal = [Text.Encoding]::UTF8.GetString($Bytes) | ConvertFrom-Json
+  $Journal = $Serializer.DeserializeObject([Text.Encoding]::UTF8.GetString($Bytes))
   $ParentSource = @'
 using System;
 using System.Runtime.InteropServices;
@@ -900,10 +905,10 @@ public static class CcParentProcess {
 }
 '@
   Add-Type -TypeDefinition $ParentSource -Language CSharp
-  $Journal | Add-Member -NotePropertyName ownerPid -NotePropertyValue ([CcParentProcess]::Get())
+  $Journal.Add('ownerPid', [CcParentProcess]::Get())
 } else {
   if (-not [IO.File]::Exists($JournalPath)) { throw 'Generation journal is missing' }
-  $Journal = Get-Content -Raw -LiteralPath $JournalPath | ConvertFrom-Json
+  $Journal = $Serializer.DeserializeObject([IO.File]::ReadAllText($JournalPath, [Text.Encoding]::UTF8))
 }
 
 $ValidBefore = {
@@ -931,7 +936,7 @@ if ($Action -eq 'retire') {
   if ([string]$Journal.phase -ne $Phase -or [string]$Journal.decision -ne $Decision) {
     throw 'Generation journal decision changed before retirement'
   }
-  $ReplacedPath = Join-Path (Split-Path -Parent $JournalPath) ('.chainlesschain.journal-retired-previous-' + [guid]::NewGuid().ToString('N'))
+  $ReplacedPath = [IO.Path]::Combine([IO.Path]::GetDirectoryName($JournalPath), ('.chainlesschain.journal-retired-previous-' + [guid]::NewGuid().ToString('N')))
   try {
     if ([IO.File]::Exists($RetiredPath)) {
       [IO.File]::Replace($JournalPath, $RetiredPath, $ReplacedPath, $true)
@@ -985,11 +990,11 @@ if ($Phase -ne 'prepared') {
 $Journal.phase = $Phase
 $Journal.decision = $Decision
 $Journal.updatedAt = [DateTimeOffset]::UtcNow.ToString('o')
-$Directory = Split-Path -Parent $JournalPath
-$StagingPath = Join-Path $Directory ('.chainlesschain.journal-' + [guid]::NewGuid().ToString('N'))
-$ReplacedPath = Join-Path $Directory ('.chainlesschain.journal-previous-' + [guid]::NewGuid().ToString('N'))
+$Directory = [IO.Path]::GetDirectoryName($JournalPath)
+$StagingPath = [IO.Path]::Combine($Directory, ('.chainlesschain.journal-' + [guid]::NewGuid().ToString('N')))
+$ReplacedPath = [IO.Path]::Combine($Directory, ('.chainlesschain.journal-previous-' + [guid]::NewGuid().ToString('N')))
 try {
-  $Payload = $Journal | ConvertTo-Json -Compress -Depth 8
+  $Payload = $Serializer.Serialize($Journal)
   $PayloadBytes = [Text.UTF8Encoding]::new($false).GetBytes($Payload + [Environment]::NewLine)
   $Stream = [IO.File]::Open($StagingPath, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)
   try {

package/src/lib/permission-authority.js

@@ -1,11 +1,13 @@
 /** Resolve static settings plus CLI-owned workspace-scoped permission rules. */
 
 import settingsLoader from "./settings-loader.cjs";
+import persistentSettings from "./settings-permission-authority.cjs";
 import path from "node:path";
 import {
   ScopedPermissionStore,
   getScopedPermissionRevision,
   subscribeScopedPermissionRevision,
+  projectScopedPermissionObservation,
 } from "./scoped-permission-store.js";
 
 const {
@@ -86,16 +88,41 @@ export function loadPermissionAuthority({
   env = process.env,
   baseRules = null,
   scopedStore = null,
+  settingsAuthority: persistentAuthority = null,
 } = {}) {
   const settingsRevision = getSettingsPermissionRevision();
   const scopedRevision = baseRules ? null : getScopedPermissionRevision();
-  const settingsObservation = inspectSettingsSources({
-    cwd,
-    settingsFile,
-    managedSettingsFile,
-    env,
-  });
-  const loaded = projectSettingsObservation(settingsObservation, { env });
+  const persistent = persistentAuthority
+    ? persistentSettings.readSettingsPermissionAuthority(persistentAuthority)
+    : null;
+  if (persistentAuthority) {
+    const bound =
+      persistentSettings.settingsPermissionAuthorityOptions(
+        persistentAuthority,
+      );
+    if (
+      path.resolve(cwd) !== bound.cwd ||
+      (settingsFile &&
+        path.resolve(cwd, settingsFile) !== bound.settingsFile) ||
+      (managedSettingsFile &&
+        path.resolve(managedSettingsFile) !== bound.managedSettingsFile)
+    )
+      throw new TypeError("persistent settings authority options mismatch");
+  }
+  const settingsObservation =
+    persistent?.observation ||
+    inspectSettingsSources({
+      cwd,
+      settingsFile,
+      managedSettingsFile,
+      env,
+    });
+  const loaded = persistent
+    ? persistentSettings.projectSettingsPermissionObservation(
+        settingsObservation,
+        { env },
+      )
+    : projectSettingsObservation(settingsObservation, { env });
   const sources = baseRules ? {} : { ...loaded.sources };
   let rules = baseRules
     ? applyManagedPermissionPolicy(baseRules, loaded.managed, sources)
@@ -105,7 +132,29 @@ export function loadPermissionAuthority({
   // Explicit caller rules retain their historical replacement semantics.
   // Managed-only policy also suppresses every user-owned scoped grant.
   if (!baseRules) {
-    scoped = (scopedStore || new ScopedPermissionStore({ cwd })).list();
+    const bound = persistentAuthority
+      ? persistentSettings.settingsPermissionAuthorityOptions(
+          persistentAuthority,
+        )
+      : null;
+    const store =
+      scopedStore ||
+      new ScopedPermissionStore({
+        cwd,
+        ...(bound
+          ? {
+              filePath: bound.scopedFile,
+              settingsAuthority: persistentAuthority,
+            }
+          : {}),
+      });
+    scoped = persistent
+      ? projectScopedPermissionObservation(
+          store,
+          persistentAuthority,
+          persistent.scopedObservation,
+        )
+      : store.list();
     const managedOnly =
       loaded.managed?.allowManagedPermissionRulesOnly === true;
     scoped = {
@@ -143,6 +192,17 @@ export function loadPermissionAuthority({
     error.code = "CC_SCOPED_PERMISSION_AUTHORITY_CHANGED";
     throw error;
   }
+  if (
+    persistent &&
+    persistentSettings.readSettingsPermissionAuthority(persistentAuthority)
+      .snapshot !== persistent.snapshot
+  ) {
+    const error = new Error(
+      "persistent settings changed while permission authority was loading",
+    );
+    error.code = "CC_SETTINGS_PERMISSION_AUTHORITY_CHANGED";
+    throw error;
+  }
   return freezeSnapshot({
     ...loaded,
     rules,
@@ -151,12 +211,17 @@ export function loadPermissionAuthority({
     hasRules: hasRules(rules),
     settingsRevision,
     settingsObservation,
+    ...(persistent ? { persistentSettingsRevision: persistent.snapshot } : {}),
     ...(scopedRevision ? { scopedRevision } : {}),
   });
 }
 
 export function createPermissionRulesProvider(options = {}) {
-  const cwd = path.resolve(options.cwd || process.cwd());
+  const persistentAuthority = options.settingsAuthority ?? null;
+  const bound = persistentAuthority
+    ? persistentSettings.settingsPermissionAuthorityOptions(persistentAuthority)
+    : null;
+  const cwd = path.resolve(options.cwd || bound?.cwd || process.cwd());
   const captured = Object.freeze({
     cwd,
     settingsFile: options.settingsFile
@@ -172,15 +237,86 @@ export function createPermissionRulesProvider(options = {}) {
       ? freezeSnapshot(cloneRules(options.baseRules))
       : null,
     scopedStore: options.scopedStore || null,
+    settingsAuthority: persistentAuthority,
   });
+  if (
+    bound &&
+    (cwd !== bound.cwd ||
+      (captured.settingsFile && captured.settingsFile !== bound.settingsFile) ||
+      (captured.managedSettingsFile &&
+        captured.managedSettingsFile !== bound.managedSettingsFile))
+  )
+    throw new TypeError("persistent settings authority options mismatch");
   const provider = () => loadPermissionAuthority(captured);
+  const localAuthority = captured.baseRules
+    ? settingsAuthority
+    : combinedAuthority;
   providers.set(
     provider,
-    captured.baseRules ? settingsAuthority : combinedAuthority,
+    persistentAuthority
+      ? persistentProviderAuthority(persistentAuthority, localAuthority)
+      : localAuthority,
   );
   return Object.freeze(provider);
 }
 
+function persistentProviderAuthority(binding, localAuthority) {
+  let last = null;
+  function getSnapshot() {
+    const local = localAuthority.getSnapshot();
+    const durable =
+      persistentSettings.readSettingsPermissionAuthority(binding).snapshot;
+    if (last?.local !== local || last?.durable !== durable)
+      last = Object.freeze({ local, durable });
+    return last;
+  }
+  return Object.freeze({
+    getSnapshot,
+    assertWorkspace(cwd) {
+      if (
+        path.resolve(cwd) !==
+        persistentSettings.settingsPermissionAuthorityOptions(binding).cwd
+      )
+        throw Object.assign(
+          new Error("persistent permission authority workspace mismatch"),
+          { code: "CC_SETTINGS_AUTHORITY_BINDING_CHANGED" },
+        );
+    },
+    assertWritableRoots(roots) {
+      persistentSettings.assertSettingsPermissionWritableRoots(binding, roots);
+    },
+    subscribePolicyRevision(listener) {
+      if (typeof listener !== "function")
+        throw new TypeError("permission revision listener must be a function");
+      let known = getSnapshot();
+      const remove = localAuthority.subscribePolicyRevision(listener);
+      // Persistence prevents official ABA loss between polls. Timers provide
+      // bounded observation, not a promise that another process has stopped
+      // before synchronous addRule returns.
+      const timer = setInterval(() => {
+        let next;
+        try {
+          next = getSnapshot();
+        } catch {
+          next = null;
+        }
+        if (next === known) return;
+        known = next;
+        try {
+          listener(next);
+        } catch {
+          /* isolate observers */
+        }
+      }, 100);
+      timer.unref?.();
+      return () => {
+        clearInterval(timer);
+        remove();
+      };
+    },
+  });
+}
+
 // A legacy callback cannot advertise a trusted revision subscription simply
 // by copying properties onto itself. It still receives sampled revalidation.
 export function permissionRulesProviderAuthority(provider) {

package/src/lib/sandbox-egress-authority-monitor.js

@@ -1,3 +1,5 @@
+import { randomUUID } from "node:crypto";
+
 /**
  * Recheck the live shell authority while a Docker egress session exists. This
  * uses bounded polling as a fallback. Trusted policy owners also call revoke()
@@ -9,19 +11,35 @@ export function createDockerEgressAuthorityMonitor({
   abortProxy,
   intervalMs = 500,
   checkTimeoutMs = 5_000,
+  sessionId = null,
+  policyVersion = null,
 }) {
   if (typeof revalidate !== "function" || typeof abortProxy !== "function")
     throw new TypeError("Docker egress authority callbacks are required");
+  if (
+    (sessionId !== null && typeof sessionId !== "string") ||
+    (policyVersion !== null && typeof policyVersion !== "string")
+  )
+    throw new TypeError(
+      "Docker egress acknowledgement identities must be strings",
+    );
+  const stopIdentity = Object.freeze({
+    receiverId: randomUUID(),
+    sessionId,
+    policyVersion,
+  });
   let revoked = null;
   let session = null;
   let timer = null;
   let checking = null;
   let stopped = false;
   const cleanupTasks = new Set();
+  let proxyStopped = false;
+  let sessionStopped = false;
 
-  function trackCleanup(operation) {
+  function trackCleanup(operation, onStopped) {
     try {
-      const task = Promise.resolve(operation());
+      const task = Promise.resolve(operation()).then(onStopped);
       cleanupTasks.add(task);
       void task.catch((error) => {
         if (revoked && !revoked.cleanupError) revoked.cleanupError = error;
@@ -41,8 +59,18 @@ export function createDockerEgressAuthorityMonitor({
     if (!revoked.code) revoked.code = "CC_DOCKER_EGRESS_AUTHORITY_CHANGED";
     clearTimeout(timer);
     // Latch first, then cut the broker before closing the target containers.
-    trackCleanup(abortProxy);
-    if (session) trackCleanup(() => session.close());
+    trackCleanup(abortProxy, () => {
+      proxyStopped = true;
+    });
+    if (session) {
+      const closing = session;
+      trackCleanup(
+        () => closing.close(),
+        () => {
+          if (session === closing) sessionStopped = true;
+        },
+      );
+    }
     return revoked;
   }
 
@@ -51,9 +79,17 @@ export function createDockerEgressAuthorityMonitor({
   }
 
   function attachSession(value) {
+    if (session)
+      throw new TypeError("Docker egress monitor session is already attached");
     session = value;
+    sessionStopped = false;
     if (revoked) {
-      trackCleanup(() => value.close());
+      trackCleanup(
+        () => value.close(),
+        () => {
+          if (session === value) sessionStopped = true;
+        },
+      );
       throw revoked;
     }
   }
@@ -112,6 +148,7 @@ export function createDockerEgressAuthorityMonitor({
   }
 
   return {
+    stopIdentity,
     get revocationError() {
       return revoked;
     },
@@ -134,5 +171,25 @@ export function createDockerEgressAuthorityMonitor({
     async awaitCleanup() {
       await Promise.allSettled([...cleanupTasks]);
     },
+    getStopAcknowledgement() {
+      // A synchronous writer commit is never a stop ACK. Only the receiving
+      // runtime, after stopping checks and awaiting both teardown operations,
+      // can report this acknowledgement. Cleanup failures never mint one.
+      if (
+        !stopped ||
+        !revoked ||
+        revoked.cleanupError ||
+        cleanupTasks.size ||
+        !proxyStopped ||
+        !sessionStopped
+      )
+        return null;
+      return Object.freeze({
+        schema: "chainlesschain.egress-stop-ack/v1",
+        ...stopIdentity,
+        proxyStopped: true,
+        sessionStopped: true,
+      });
+    },
   };
 }

package/src/lib/scoped-permission-store.js

@@ -11,6 +11,7 @@ import path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import projectRoot from "./project-root.cjs";
 import permissionRules from "./permission-rules.cjs";
+import persistentSettings from "./settings-permission-authority.cjs";
 import { getMachineSecurityAnchorDir } from "./paths.js";
 import {
   readSecurityStore,
@@ -27,6 +28,7 @@ const STORE_LABEL = "scoped permission";
 const RULE_ID_PATTERN = /^spr_[0-9a-f]{32}$/;
 const DECISIONS = new Set(["allow", "ask", "deny"]);
 const DEFAULT_MAX_RECORDS = 1000;
+const persistentBindings = new WeakMap();
 
 // Official mutations revoke every provider in this module instance. Path
 // matching alone misses aliases and files that did not exist at admission.
@@ -216,6 +218,7 @@ export class ScopedPermissionStore {
     maxRecords = DEFAULT_MAX_RECORDS,
     lock = undefined,
     randomId = () => `spr_${randomUUID().replaceAll("-", "")}`,
+    settingsAuthority = null,
   } = {}) {
     this.workspace = workspaceBinding(cwd);
     this.filePath = path.resolve(
@@ -242,6 +245,17 @@ export class ScopedPermissionStore {
     );
     this._lock = lock;
     this._randomId = randomId;
+    if (settingsAuthority) {
+      const bound =
+        persistentSettings.settingsPermissionAuthorityOptions(
+          settingsAuthority,
+        );
+      if (path.resolve(cwd) !== bound.cwd || this.filePath !== bound.scopedFile)
+        throw new TypeError(
+          "persistent scoped permission authority options mismatch",
+        );
+      persistentBindings.set(this, settingsAuthority);
+    }
   }
 
   _capture() {
@@ -253,7 +267,22 @@ export class ScopedPermissionStore {
       randomId: this._randomId.bind(this),
       maxRecords: this.maxRecords,
       lock: this._lock || withFileLock,
+      settingsAuthority: persistentBindings.get(this) || null,
     });
+    if (captured.settingsAuthority) {
+      const bound = persistentSettings.settingsPermissionAuthorityOptions(
+        captured.settingsAuthority,
+      );
+      const workspace = workspaceBinding(bound.cwd);
+      if (
+        captured.filePath !== bound.scopedFile ||
+        captured.workspace.id !== workspace.id ||
+        captured.workspace.root !== workspace.root
+      )
+        throw new TypeError(
+          "persistent scoped permission authority options mismatch",
+        );
+    }
     if (getScopedPermissionRevision() !== revision)
       throw scopedPermissionError(
         "CC_SCOPED_PERMISSION_AUTHORITY_CHANGED",
@@ -264,13 +293,54 @@ export class ScopedPermissionStore {
 
   _read(captured = this._capture()) {
     getScopedPermissionRevision();
-    const stored = readSecurityStore(captured.filePath, STORE_LABEL);
+    const stored = captured.settingsAuthority
+      ? persistentSettings.readSettingsPermissionAuthority(
+          captured.settingsAuthority,
+        ).scopedObservation.settings || {}
+      : readSecurityStore(captured.filePath, STORE_LABEL);
     if (Object.keys(stored).length === 0) return emptyState(captured.workspace);
     return validateState(stored, captured.workspace);
   }
 
   _mutate(captured, update) {
     getScopedPermissionRevision(); // Reject observer reentry before the lock.
+    if (captured.settingsAuthority) {
+      let started = false;
+      try {
+        persistentSettings.mutateSettingsPermissionSource(
+          captured.settingsAuthority,
+          {
+            logicalPath: captured.filePath,
+            prepare(draft) {
+              if (Object.keys(draft).length === 0)
+                Object.assign(draft, emptyState(captured.workspace));
+              validateState(draft, captured.workspace);
+              if (update(draft) === false) return false;
+              validateState(draft, captured.workspace);
+            },
+            revokeLocal() {
+              started = true;
+              beginMutation();
+            },
+            replace(file, draft) {
+              validateState(draft, captured.workspace);
+              writeSecurityStore(file, STORE_LABEL, draft);
+            },
+          },
+        );
+        if (started) finishMutation("ready");
+      } catch (error) {
+        if (started)
+          finishMutation(
+            error.commitState === "unknown" ||
+              permissionRevision.state === "invalid"
+              ? "invalid"
+              : "ready",
+          );
+        throw error;
+      }
+      return;
+    }
     fs.mkdirSync(path.dirname(captured.filePath), {
       recursive: true,
       mode: 0o700,
@@ -487,3 +557,36 @@ export class ScopedPermissionStore {
     return projectRecord(revoked, now, captured.filePath);
   }
 }
+
+// Only the production provider uses a scoped observation already validated in
+// the same durable read as settings. A store cannot substitute another source.
+export function projectScopedPermissionObservation(
+  store,
+  binding,
+  observation,
+) {
+  if (persistentBindings.get(store) !== binding)
+    throw new TypeError(
+      "scoped store must use the provider's persistent authority",
+    );
+  const captured = ScopedPermissionStore.prototype._capture.call(store);
+  if (observation.logicalPath !== captured.filePath)
+    throw new TypeError("persistent scoped permission source mismatch");
+  const stored = observation.settings || {};
+  const state =
+    Object.keys(stored).length === 0
+      ? emptyState(captured.workspace)
+      : validateState(stored, captured.workspace);
+  const now = captured.now();
+  return Object.freeze({
+    schema: state.schema,
+    schemaVersion: state.schemaVersion,
+    generation: state.generation,
+    updatedAt: state.updatedAt,
+    workspace: structuredClone(state.workspace),
+    file: captured.filePath,
+    rules: state.rules.map((record) =>
+      projectRecord(record, now, captured.filePath),
+    ),
+  });
+}

package/src/lib/settings-authority-domain.cjs

@@ -727,12 +727,24 @@ function transitionSettingsAuthority(
     replace,
     revokeLocal,
     transactionId = randomUUID(),
+    expectedSnapshot = null,
+    localRevision = null,
   } = {},
 ) {
   const state = stateFor(handle);
   // Snapshot caller data before any callback. These are trusted host APIs, but
   // mutable intents must not turn an already-validated no-op into a mutation.
   intent = plainCopy(intent);
+  if (expectedSnapshot !== null) {
+    expectedSnapshot = plainCopy(expectedSnapshot);
+    shape(expectedSnapshot, [
+      "domainId",
+      "epoch",
+      "generation",
+      "digest",
+      "state",
+    ]);
+  }
   requireSynchronous(observeContexts);
   requireSynchronous(revokeLocal);
   if (intent.kind === "write") requireSynchronous(replace);
@@ -743,7 +755,15 @@ function transitionSettingsAuthority(
   try {
     return locked(state, () => {
       const perform = () => {
-        const current = readSettingsAuthority(handle, { observeContexts });
+        const current = readSettingsAuthority(handle, {
+          observeContexts,
+          localRevision,
+        });
+        if (
+          expectedSnapshot !== null &&
+          !sameData(current.snapshot, expectedSnapshot)
+        )
+          refuse("CC_SETTINGS_AUTHORITY_CONFLICT");
         if (
           intent.kind === "register" &&
           current.ledger.contexts.some(
@@ -841,7 +861,15 @@ function transitionSettingsAuthority(
         };
       };
       if (intent.kind !== "write") return perform();
-      const admission = readSettingsAuthority(handle, { observeContexts });
+      const admission = readSettingsAuthority(handle, {
+        observeContexts,
+        localRevision,
+      });
+      if (
+        expectedSnapshot !== null &&
+        !sameData(admission.snapshot, expectedSnapshot)
+      )
+        refuse("CC_SETTINGS_AUTHORITY_CONFLICT");
       records.prepareTransition({
         ledger: admission.ledger,
         transactionId,
@@ -878,6 +906,12 @@ function transitionSettingsAuthority(
   }
 }
 
+// Official read/modify/write adapters take an initial snapshot under the same
+// authority lock. The later transition MUST still compare expectedSnapshot.
+function readSettingsAuthorityForUpdate(handle, options) {
+  return locked(stateFor(handle), () => readSettingsAuthority(handle, options));
+}
+
 function recoverSettingsAuthority(
   handle,
   { transactionId, observeContexts, outcome } = {},
@@ -954,6 +988,7 @@ function recoverSettingsAuthority(
 }
 
 module.exports = {
+  readSettingsAuthorityForUpdate,
   DOMAIN_SCHEMA,
   initializeSettingsAuthorityDomain,
   pinSettingsAuthorityDomain,