chainlesschain 0.166.85 → 0.166.87

package/src/lib/sandbox-egress-authority-monitor.js

@@ -1,3 +1,5 @@
+import { randomUUID } from "node:crypto";
+
 /**
  * Recheck the live shell authority while a Docker egress session exists. This
  * uses bounded polling as a fallback. Trusted policy owners also call revoke()
@@ -9,19 +11,35 @@ export function createDockerEgressAuthorityMonitor({
   abortProxy,
   intervalMs = 500,
   checkTimeoutMs = 5_000,
+  sessionId = null,
+  policyVersion = null,
 }) {
   if (typeof revalidate !== "function" || typeof abortProxy !== "function")
     throw new TypeError("Docker egress authority callbacks are required");
+  if (
+    (sessionId !== null && typeof sessionId !== "string") ||
+    (policyVersion !== null && typeof policyVersion !== "string")
+  )
+    throw new TypeError(
+      "Docker egress acknowledgement identities must be strings",
+    );
+  const stopIdentity = Object.freeze({
+    receiverId: randomUUID(),
+    sessionId,
+    policyVersion,
+  });
   let revoked = null;
   let session = null;
   let timer = null;
   let checking = null;
   let stopped = false;
   const cleanupTasks = new Set();
+  let proxyStopped = false;
+  let sessionStopped = false;
 
-  function trackCleanup(operation) {
+  function trackCleanup(operation, onStopped) {
     try {
-      const task = Promise.resolve(operation());
+      const task = Promise.resolve(operation()).then(onStopped);
       cleanupTasks.add(task);
       void task.catch((error) => {
         if (revoked && !revoked.cleanupError) revoked.cleanupError = error;
@@ -41,8 +59,18 @@ export function createDockerEgressAuthorityMonitor({
     if (!revoked.code) revoked.code = "CC_DOCKER_EGRESS_AUTHORITY_CHANGED";
     clearTimeout(timer);
     // Latch first, then cut the broker before closing the target containers.
-    trackCleanup(abortProxy);
-    if (session) trackCleanup(() => session.close());
+    trackCleanup(abortProxy, () => {
+      proxyStopped = true;
+    });
+    if (session) {
+      const closing = session;
+      trackCleanup(
+        () => closing.close(),
+        () => {
+          if (session === closing) sessionStopped = true;
+        },
+      );
+    }
     return revoked;
   }
 
@@ -51,9 +79,17 @@ export function createDockerEgressAuthorityMonitor({
   }
 
   function attachSession(value) {
+    if (session)
+      throw new TypeError("Docker egress monitor session is already attached");
     session = value;
+    sessionStopped = false;
     if (revoked) {
-      trackCleanup(() => value.close());
+      trackCleanup(
+        () => value.close(),
+        () => {
+          if (session === value) sessionStopped = true;
+        },
+      );
       throw revoked;
     }
   }
@@ -112,6 +148,7 @@ export function createDockerEgressAuthorityMonitor({
   }
 
   return {
+    stopIdentity,
     get revocationError() {
       return revoked;
     },
@@ -134,5 +171,25 @@ export function createDockerEgressAuthorityMonitor({
     async awaitCleanup() {
       await Promise.allSettled([...cleanupTasks]);
     },
+    getStopAcknowledgement() {
+      // A synchronous writer commit is never a stop ACK. Only the receiving
+      // runtime, after stopping checks and awaiting both teardown operations,
+      // can report this acknowledgement. Cleanup failures never mint one.
+      if (
+        !stopped ||
+        !revoked ||
+        revoked.cleanupError ||
+        cleanupTasks.size ||
+        !proxyStopped ||
+        !sessionStopped
+      )
+        return null;
+      return Object.freeze({
+        schema: "chainlesschain.egress-stop-ack/v1",
+        ...stopIdentity,
+        proxyStopped: true,
+        sessionStopped: true,
+      });
+    },
   };
 }

package/src/lib/scoped-permission-store.js

@@ -11,6 +11,7 @@ import path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import projectRoot from "./project-root.cjs";
 import permissionRules from "./permission-rules.cjs";
+import persistentSettings from "./settings-permission-authority.cjs";
 import { getMachineSecurityAnchorDir } from "./paths.js";
 import {
   readSecurityStore,
@@ -27,6 +28,7 @@ const STORE_LABEL = "scoped permission";
 const RULE_ID_PATTERN = /^spr_[0-9a-f]{32}$/;
 const DECISIONS = new Set(["allow", "ask", "deny"]);
 const DEFAULT_MAX_RECORDS = 1000;
+const persistentBindings = new WeakMap();
 
 // Official mutations revoke every provider in this module instance. Path
 // matching alone misses aliases and files that did not exist at admission.
@@ -216,6 +218,7 @@ export class ScopedPermissionStore {
     maxRecords = DEFAULT_MAX_RECORDS,
     lock = undefined,
     randomId = () => `spr_${randomUUID().replaceAll("-", "")}`,
+    settingsAuthority = null,
   } = {}) {
     this.workspace = workspaceBinding(cwd);
     this.filePath = path.resolve(
@@ -242,6 +245,17 @@ export class ScopedPermissionStore {
     );
     this._lock = lock;
     this._randomId = randomId;
+    if (settingsAuthority) {
+      const bound =
+        persistentSettings.settingsPermissionAuthorityOptions(
+          settingsAuthority,
+        );
+      if (path.resolve(cwd) !== bound.cwd || this.filePath !== bound.scopedFile)
+        throw new TypeError(
+          "persistent scoped permission authority options mismatch",
+        );
+      persistentBindings.set(this, settingsAuthority);
+    }
   }
 
   _capture() {
@@ -253,7 +267,22 @@ export class ScopedPermissionStore {
       randomId: this._randomId.bind(this),
       maxRecords: this.maxRecords,
       lock: this._lock || withFileLock,
+      settingsAuthority: persistentBindings.get(this) || null,
     });
+    if (captured.settingsAuthority) {
+      const bound = persistentSettings.settingsPermissionAuthorityOptions(
+        captured.settingsAuthority,
+      );
+      const workspace = workspaceBinding(bound.cwd);
+      if (
+        captured.filePath !== bound.scopedFile ||
+        captured.workspace.id !== workspace.id ||
+        captured.workspace.root !== workspace.root
+      )
+        throw new TypeError(
+          "persistent scoped permission authority options mismatch",
+        );
+    }
     if (getScopedPermissionRevision() !== revision)
       throw scopedPermissionError(
         "CC_SCOPED_PERMISSION_AUTHORITY_CHANGED",
@@ -264,13 +293,54 @@ export class ScopedPermissionStore {
 
   _read(captured = this._capture()) {
     getScopedPermissionRevision();
-    const stored = readSecurityStore(captured.filePath, STORE_LABEL);
+    const stored = captured.settingsAuthority
+      ? persistentSettings.readSettingsPermissionAuthority(
+          captured.settingsAuthority,
+        ).scopedObservation.settings || {}
+      : readSecurityStore(captured.filePath, STORE_LABEL);
     if (Object.keys(stored).length === 0) return emptyState(captured.workspace);
     return validateState(stored, captured.workspace);
   }
 
   _mutate(captured, update) {
     getScopedPermissionRevision(); // Reject observer reentry before the lock.
+    if (captured.settingsAuthority) {
+      let started = false;
+      try {
+        persistentSettings.mutateSettingsPermissionSource(
+          captured.settingsAuthority,
+          {
+            logicalPath: captured.filePath,
+            prepare(draft) {
+              if (Object.keys(draft).length === 0)
+                Object.assign(draft, emptyState(captured.workspace));
+              validateState(draft, captured.workspace);
+              if (update(draft) === false) return false;
+              validateState(draft, captured.workspace);
+            },
+            revokeLocal() {
+              started = true;
+              beginMutation();
+            },
+            replace(file, draft) {
+              validateState(draft, captured.workspace);
+              writeSecurityStore(file, STORE_LABEL, draft);
+            },
+          },
+        );
+        if (started) finishMutation("ready");
+      } catch (error) {
+        if (started)
+          finishMutation(
+            error.commitState === "unknown" ||
+              permissionRevision.state === "invalid"
+              ? "invalid"
+              : "ready",
+          );
+        throw error;
+      }
+      return;
+    }
     fs.mkdirSync(path.dirname(captured.filePath), {
       recursive: true,
       mode: 0o700,
@@ -487,3 +557,36 @@ export class ScopedPermissionStore {
     return projectRecord(revoked, now, captured.filePath);
   }
 }
+
+// Only the production provider uses a scoped observation already validated in
+// the same durable read as settings. A store cannot substitute another source.
+export function projectScopedPermissionObservation(
+  store,
+  binding,
+  observation,
+) {
+  if (persistentBindings.get(store) !== binding)
+    throw new TypeError(
+      "scoped store must use the provider's persistent authority",
+    );
+  const captured = ScopedPermissionStore.prototype._capture.call(store);
+  if (observation.logicalPath !== captured.filePath)
+    throw new TypeError("persistent scoped permission source mismatch");
+  const stored = observation.settings || {};
+  const state =
+    Object.keys(stored).length === 0
+      ? emptyState(captured.workspace)
+      : validateState(stored, captured.workspace);
+  const now = captured.now();
+  return Object.freeze({
+    schema: state.schema,
+    schemaVersion: state.schemaVersion,
+    generation: state.generation,
+    updatedAt: state.updatedAt,
+    workspace: structuredClone(state.workspace),
+    file: captured.filePath,
+    rules: state.rules.map((record) =>
+      projectRecord(record, now, captured.filePath),
+    ),
+  });
+}

package/src/lib/settings-authority-domain.cjs

@@ -727,12 +727,24 @@ function transitionSettingsAuthority(
     replace,
     revokeLocal,
     transactionId = randomUUID(),
+    expectedSnapshot = null,
+    localRevision = null,
   } = {},
 ) {
   const state = stateFor(handle);
   // Snapshot caller data before any callback. These are trusted host APIs, but
   // mutable intents must not turn an already-validated no-op into a mutation.
   intent = plainCopy(intent);
+  if (expectedSnapshot !== null) {
+    expectedSnapshot = plainCopy(expectedSnapshot);
+    shape(expectedSnapshot, [
+      "domainId",
+      "epoch",
+      "generation",
+      "digest",
+      "state",
+    ]);
+  }
   requireSynchronous(observeContexts);
   requireSynchronous(revokeLocal);
   if (intent.kind === "write") requireSynchronous(replace);
@@ -743,7 +755,15 @@ function transitionSettingsAuthority(
   try {
     return locked(state, () => {
       const perform = () => {
-        const current = readSettingsAuthority(handle, { observeContexts });
+        const current = readSettingsAuthority(handle, {
+          observeContexts,
+          localRevision,
+        });
+        if (
+          expectedSnapshot !== null &&
+          !sameData(current.snapshot, expectedSnapshot)
+        )
+          refuse("CC_SETTINGS_AUTHORITY_CONFLICT");
         if (
           intent.kind === "register" &&
           current.ledger.contexts.some(
@@ -841,7 +861,15 @@ function transitionSettingsAuthority(
         };
       };
       if (intent.kind !== "write") return perform();
-      const admission = readSettingsAuthority(handle, { observeContexts });
+      const admission = readSettingsAuthority(handle, {
+        observeContexts,
+        localRevision,
+      });
+      if (
+        expectedSnapshot !== null &&
+        !sameData(admission.snapshot, expectedSnapshot)
+      )
+        refuse("CC_SETTINGS_AUTHORITY_CONFLICT");
       records.prepareTransition({
         ledger: admission.ledger,
         transactionId,
@@ -878,6 +906,12 @@ function transitionSettingsAuthority(
   }
 }
 
+// Official read/modify/write adapters take an initial snapshot under the same
+// authority lock. The later transition MUST still compare expectedSnapshot.
+function readSettingsAuthorityForUpdate(handle, options) {
+  return locked(stateFor(handle), () => readSettingsAuthority(handle, options));
+}
+
 function recoverSettingsAuthority(
   handle,
   { transactionId, observeContexts, outcome } = {},
@@ -954,6 +988,7 @@ function recoverSettingsAuthority(
 }
 
 module.exports = {
+  readSettingsAuthorityForUpdate,
   DOMAIN_SCHEMA,
   initializeSettingsAuthorityDomain,
   pinSettingsAuthorityDomain,

package/src/lib/settings-loader.cjs

@@ -146,9 +146,11 @@ function accrete(target, sources, arr, file, kind) {
 }
 
 /** The ordered list of candidate settings files for a cwd. */
-function settingsPaths(cwd, explicitFile) {
+function settingsPaths(cwd, explicitFile, userSettingsFile = null) {
   const home = _deps.homedir();
-  const list = [path.join(home, ".claude", "settings.json")];
+  const list = [
+    userSettingsFile || path.join(home, ".claude", "settings.json"),
+  ];
   // When run from a subdirectory, the project-root `.claude` sits BELOW cwd's
   // own (closest wins) but ABOVE the user layer — so its rules apply yet a
   // cwd-local settings file still overrides them. Null when cwd IS the root.
@@ -171,7 +173,7 @@ function settingsPaths(cwd, explicitFile) {
 function inspectSettingsSources(opts = {}) {
   const cwd = path.resolve(opts.cwd || process.cwd());
   const candidates = [
-    ...settingsPaths(cwd, opts.settingsFile),
+    ...settingsPaths(cwd, opts.settingsFile, opts.userSettingsFile),
     managedSettingsPath(opts),
   ];
   const observation = Object.freeze({
@@ -390,7 +392,38 @@ function scopeFile(cwd, scope) {
  * @returns {{ file:string, added:boolean }} added=false → already present.
  * @throws if the target file exists but is malformed JSON (refuse to clobber).
  */
-function addRule({ cwd = process.cwd(), kind, rule, scope = "project" } = {}) {
+function appendPermissionRule(data, file, kind, rule) {
+  if (
+    Object.hasOwn(data, "permissions") &&
+    (!data.permissions ||
+      typeof data.permissions !== "object" ||
+      Array.isArray(data.permissions))
+  )
+    throw new TypeError(`refusing to overwrite malformed permissions: ${file}`);
+  data.permissions ??= {};
+  for (const decision of KINDS) {
+    if (
+      Object.hasOwn(data.permissions, decision) &&
+      (!Array.isArray(data.permissions[decision]) ||
+        data.permissions[decision].some((entry) => typeof entry !== "string"))
+    )
+      throw new TypeError(
+        `refusing to overwrite malformed permission rules: ${file}`,
+      );
+  }
+  data.permissions[kind] ??= [];
+  if (data.permissions[kind].includes(rule)) return false;
+  data.permissions[kind].push(rule);
+  return true;
+}
+
+function addRule({
+  cwd = process.cwd(),
+  kind,
+  rule,
+  scope = "project",
+  settingsAuthority = null,
+} = {}) {
   const entryCwd = process.cwd();
   const absoluteCwd = path.resolve(entryCwd, cwd);
   // Check before lock acquisition: notification callbacks may reenter here.
@@ -404,11 +437,38 @@ function addRule({ cwd = process.cwd(), kind, rule, scope = "project" } = {}) {
   if (!["project", "local", "user"].includes(scope)) {
     throw new TypeError("scope must be project | local | user");
   }
-  const file = path.resolve(entryCwd, scopeFile(absoluteCwd, scope));
-  _deps.fs.mkdirSync(path.dirname(file), { recursive: true });
+  let file = path.resolve(entryCwd, scopeFile(absoluteCwd, scope));
+  if (settingsAuthority !== null) {
+    const authority = require("./settings-permission-authority.cjs");
+    const bound =
+      authority.settingsPermissionAuthorityOptions(settingsAuthority);
+    if (absoluteCwd !== bound.cwd)
+      throw new TypeError("settings authority cwd mismatch");
+    if (scope === "user") file = bound.userSettingsFile;
+  } else _deps.fs.mkdirSync(path.dirname(file), { recursive: true });
   let began = false;
   let committed = false;
   try {
+    if (settingsAuthority !== null) {
+      const authority = require("./settings-permission-authority.cjs");
+      const result = authority.mutateSettingsPermissionSource(
+        settingsAuthority,
+        {
+          logicalPath: file,
+          prepare: (data) => appendPermissionRule(data, file, kind, rule),
+          revokeLocal() {
+            beginSettingsMutation();
+            began = true;
+          },
+          replace(physicalPath, data) {
+            _deps.writeSecurityStore(physicalPath, "settings", data);
+            committed = true;
+          },
+        },
+      );
+      if (began) finishSettingsMutation("ready");
+      return { file, added: result.changed };
+    }
     const result = _deps.withFileLock(
       file,
       () => {
@@ -423,35 +483,8 @@ function addRule({ cwd = process.cwd(), kind, rule, scope = "project" } = {}) {
           );
         }
         const data = _deps.readSecurityStore(file, "settings");
-        if (
-          Object.hasOwn(data, "permissions") &&
-          (!data.permissions ||
-            typeof data.permissions !== "object" ||
-            Array.isArray(data.permissions))
-        ) {
-          throw new TypeError(
-            `refusing to overwrite malformed permissions: ${file}`,
-          );
-        }
-        data.permissions ??= {};
-        // Refuse to hide a damaged rule list, including a different decision.
-        for (const decision of KINDS) {
-          if (
-            Object.hasOwn(data.permissions, decision) &&
-            (!Array.isArray(data.permissions[decision]) ||
-              data.permissions[decision].some(
-                (entry) => typeof entry !== "string",
-              ))
-          ) {
-            throw new TypeError(
-              `refusing to overwrite malformed permission rules: ${file}`,
-            );
-          }
-        }
-        data.permissions[kind] ??= [];
-        if (data.permissions[kind].includes(rule))
+        if (!appendPermissionRule(data, file, kind, rule))
           return { file, added: false };
-        data.permissions[kind].push(rule);
         beginSettingsMutation();
         began = true;
         _deps.writeSecurityStore(file, "settings", data);