chainlesschain 0.166.87 → 0.166.89

package/src/commands/agent-controlled-host.js

@@ -0,0 +1,220 @@
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import {
+  normalizeAgentSandbox,
+  assertSandboxCapabilities,
+  assertSandboxAvailable,
+} from "../lib/agent-sandbox.js";
+import { isFormalQualityHermeticRuntime } from "../lib/formal-quality-eval-runtime.js";
+import { resolveCredentialEnvironmentValue } from "../lib/process-execution-broker/credential-transport.js";
+
+const MAX_JSON_BYTES = 1024 * 1024;
+
+function invalid(message, code = "CC_CONTROLLED_HOST_INVALID") {
+  return Object.assign(new Error(message), { code });
+}
+
+/** Read one bounded regular file through its opened identity, never create it. */
+function readJson(file) {
+  if (typeof file !== "string" || !path.isAbsolute(file))
+    throw invalid("Controlled-host JSON paths must be absolute");
+  const before = fs.lstatSync(file, { bigint: true });
+  if (!before.isFile() || before.isSymbolicLink())
+    throw invalid("Controlled-host JSON must be a regular non-symlink file");
+  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+  try {
+    const opened = fs.fstatSync(fd, { bigint: true });
+    if (
+      !opened.isFile() ||
+      opened.dev !== before.dev ||
+      opened.ino !== before.ino ||
+      opened.size < 1n ||
+      opened.size > BigInt(MAX_JSON_BYTES)
+    )
+      throw invalid("Controlled-host JSON identity or size is invalid");
+    const bytes = Buffer.alloc(Number(opened.size) + 1);
+    let size = 0;
+    while (size < bytes.length) {
+      const read = fs.readSync(fd, bytes, size, bytes.length - size, null);
+      if (!read) break;
+      size += read;
+    }
+    const after = fs.fstatSync(fd, { bigint: true });
+    if (
+      BigInt(size) !== opened.size ||
+      after.size !== opened.size ||
+      after.mtimeNs !== opened.mtimeNs ||
+      after.ctimeNs !== opened.ctimeNs
+    )
+      throw invalid("Controlled-host JSON changed while reading");
+    const value = JSON.parse(
+      new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)),
+    );
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw invalid("Controlled-host JSON must contain an object");
+    return value;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+/** Explicit one-shot entry. Provisioning is deliberately not available here. */
+export async function runControlledHost(options, dependencies = {}) {
+  const platform = dependencies.platform ?? process.platform;
+  if (platform !== "linux")
+    throw invalid(
+      "Controlled-host permission authority requires Linux",
+      "CC_SETTINGS_AUTHORITY_PLATFORM_UNSUPPORTED",
+    );
+  const env = dependencies.env ?? process.env;
+  if (isFormalQualityHermeticRuntime(env))
+    throw invalid(
+      "Controlled-host authority cannot run in a hermetic evaluator that suppresses permission providers",
+    );
+  if (!/^[a-zA-Z0-9._:-]{1,128}$/.test(options.context || ""))
+    throw invalid("An explicit controlled-host context is required");
+  if (
+    (options.check === true) ===
+    (typeof options.prompt === "string" && options.prompt.trim().length > 0)
+  )
+    throw invalid("Choose exactly one of --check or a non-empty --prompt");
+  if (
+    !options.check &&
+    ["provider", "model", "baseUrl"].some(
+      (key) => typeof options[key] !== "string" || !options[key].trim(),
+    )
+  )
+    throw invalid("A run requires explicit --provider, --model and --base-url");
+  const maxTurns =
+    options.maxTurns === undefined ? 10 : Number(options.maxTurns);
+  if (!Number.isSafeInteger(maxTurns) || maxTurns < 1 || maxTurns > 100)
+    throw invalid("--max-turns must be an integer from 1 to 100");
+  if (!["text", "json", "stream-json"].includes(options.outputFormat || "text"))
+    throw invalid("--output-format must be text, json or stream-json");
+  const cwd = dependencies.cwd ?? process.cwd();
+  const launch = readJson(options.launch);
+  const settings = readJson(options.sandboxSettings);
+  if (settings.engine !== "docker-egress" || settings.enabled === false)
+    throw invalid(
+      "Controlled-host entry requires enabled docker-egress sandbox settings",
+    );
+  const sandbox = normalizeAgentSandbox(true, { cwd, settings, network: true });
+  assertSandboxCapabilities(sandbox, {
+    host: { platform, arch: process.arch, release: os.release() },
+  });
+  const open =
+    dependencies.openHost ??
+    (await import("../runtime/permission-authority-host.js"))
+      .openPermissionAuthorityHost;
+  const host = open({ launch, contextId: options.context, env });
+  try {
+    // Reopening never provisions; runtimeOptions checks the actual invocation
+    // workspace and rejects writable roots overlapping the fixed authority.
+    host.runtimeOptions({ cwd, sandbox });
+    if (options.check) {
+      const capabilities = host.capabilities(sandbox);
+      const report = {
+        schema: "chainlesschain.controlled-host-check/v1",
+        authorityIdentityVerified: true,
+        backendExecutionVerified: false,
+        backendAvailabilityProbed: false,
+        capabilities,
+      };
+      (dependencies.writeOut ?? ((text) => process.stdout.write(text)))(
+        JSON.stringify(report) + "\n",
+      );
+      return { exitCode: 0, report };
+    }
+    // Availability is checked before resolving credentials or calling a model.
+    (dependencies.assertAvailable ?? assertSandboxAvailable)(sandbox);
+    let apiKey;
+    if (options.apiKeyEnv) {
+      apiKey = await resolveCredentialEnvironmentValue(options.apiKeyEnv, {
+        env,
+      });
+      if (!apiKey)
+        throw invalid("The selected API key environment source is unavailable");
+    }
+    return await host.runHeadless(
+      {
+        cwd,
+        sandbox,
+        prompt: options.prompt,
+        provider: options.provider,
+        model: options.model,
+        baseUrl: options.baseUrl,
+        apiKey,
+        maxTurns,
+        outputFormat: options.outputFormat || "text",
+        permissionMode: "dontAsk",
+        useRegisteredMcp: false,
+        strictMcpConfig: true,
+        ide: false,
+        pdh: false,
+        jetbrains: false,
+        slashMacros: false,
+        expandFileRefs: false,
+      },
+      dependencies.runtimeDependencies,
+    );
+  } finally {
+    host.close();
+  }
+}
+
+export function registerControlledHostCommand(agent, dependencies = {}) {
+  agent
+    .command("controlled-host")
+    .description(
+      "Run against a pre-provisioned Linux permission authority (one-shot, dontAsk)",
+    )
+    .requiredOption(
+      "--launch <file>",
+      "Absolute pre-provisioned launch descriptor JSON",
+    )
+    .requiredOption("--context <id>", "Exact provisioned workspace context ID")
+    .requiredOption(
+      "--sandbox-settings <file>",
+      "Absolute docker-egress sandbox settings JSON",
+    )
+    .option(
+      "--check",
+      "Verify configuration and authority identity only; no backend or model execution",
+    )
+    .option(
+      "--prompt <text>",
+      "Run one headless task in the bound current workspace",
+    )
+    .option("--provider <name>", "Explicit model provider")
+    .option("--model <name>", "Explicit model name")
+    .option("--base-url <url>", "Explicit provider endpoint")
+    .option(
+      "--api-key-env <name>",
+      "Credential environment variable or broker reference",
+    )
+    .option("--max-turns <n>", "Maximum task turns, 1-100", "10")
+    .option("--output-format <format>", "text | json | stream-json", "text")
+    .action(async (options, command) => {
+      try {
+        // Parent agent flags are a different launch contract. Never silently
+        // ignore a supplied --yolo, --bg, --settings or model override there.
+        if (
+          agent.options.some(
+            (option) =>
+              agent.getOptionValueSource(option.attributeName()) === "cli",
+          )
+        )
+          throw invalid(
+            "Place only controlled-host options after the subcommand; parent agent flags are unsupported",
+          );
+        const outcome = await runControlledHost(command.opts(), dependencies);
+        process.exitCode = outcome.exitCode;
+      } catch (error) {
+        process.stderr.write(
+          `${error.code || "CC_CONTROLLED_HOST_FAILED"}: ${error.message}\n`,
+        );
+        process.exitCode = 1;
+      }
+    });
+}

package/src/commands/agent.js

@@ -46,6 +46,7 @@ import {
   isFormalQualityHermeticRuntime,
 } from "../lib/formal-quality-eval-runtime.js";
 import { withQuietStdout } from "../runtime/quiet-stdout.js";
+import { registerControlledHostCommand } from "./agent-controlled-host.js";
 import { resolveCredentialEnvironmentValue } from "../lib/process-execution-broker/credential-transport.js";
 import {
   captureClaudeStorageLaunchEnvironment,
@@ -290,7 +291,7 @@ export function registerAgentCommand(program, dependencies = {}) {
       : captureSkillRetrievalRevocationReader(
           dependencies.skillRetrievalRevocationReader,
         );
-  program
+  const agent = program
     .command("agent")
     .aliases(["a", "exec"])
     .description(
@@ -2259,6 +2260,7 @@ export function registerAgentCommand(program, dependencies = {}) {
       // Interactive session ended (REPL closed) — settle the worktree.
       await _finishWorktree();
     });
+  registerControlledHostCommand(agent, dependencies.controlledHost);
 }
 
 export function registerSubAgentV2Command(program) {

package/src/commands/eval.js

@@ -14,6 +14,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 import { runEvalSuite } from "../lib/eval/runner.js";
 import { getSuite } from "../lib/eval/tasks.js";
+import { verifyAgentTerminal } from "../lib/eval/stream-terminal.js";
 import { persistVerify01Receipts } from "../lib/eval/verify01-execution.js";
 import executionBroker from "../lib/process-execution-broker/index.js";
 import {
@@ -49,57 +50,6 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // This file is src/commands/eval.js → the CLI entry is bin/chainlesschain.js.
 const BIN = path.resolve(__dirname, "..", "..", "bin", "chainlesschain.js");
 
-function verifyAgentTerminal(output) {
-  try {
-    const events = output
-      .split(/\r?\n/u)
-      .filter((line) => line.trim())
-      .map((line) => JSON.parse(line));
-    const results = events.filter((event) => event?.type === "result");
-    const terminal = results[0];
-    const usage = terminal?.usage;
-    const normalizedUsage =
-      usage &&
-      [
-        usage.input_tokens,
-        usage.output_tokens,
-        usage.cache_read_input_tokens,
-        usage.cache_creation_input_tokens,
-      ].every((value) => Number.isSafeInteger(value) && value >= 0)
-        ? {
-            inputTokens: usage.input_tokens,
-            outputTokens: usage.output_tokens,
-            cacheReadInputTokens: usage.cache_read_input_tokens,
-            cacheCreationInputTokens: usage.cache_creation_input_tokens,
-          }
-        : null;
-    return {
-      terminalVerified:
-        results.length === 1 &&
-        events.at(-1) === terminal &&
-        terminal.subtype === "success" &&
-        terminal.is_error === false &&
-        !events.some((event) => event?.type === "error"),
-      observedFallback: events.some((event) =>
-        ["provider_fallback", "model_fallback"].includes(event?.subtype),
-      ),
-      usage: normalizedUsage,
-      totalCostUsd:
-        Number.isFinite(terminal?.total_cost_usd) &&
-        terminal.total_cost_usd >= 0
-          ? terminal.total_cost_usd
-          : null,
-    };
-  } catch {
-    return {
-      terminalVerified: false,
-      observedFallback: null,
-      usage: null,
-      totalCostUsd: null,
-    };
-  }
-}
-
 /**
  * Kill an agent child AND its tool grandchildren. A bare child.kill("SIGTERM")
  * only reaches the direct child (and on Windows TerminateProcess never reaches
@@ -542,9 +492,8 @@ export function registerEvalCommand(program, { logger } = {}) {
         }
       }
       try {
-        const { exportTelemetryRecorder } = await import(
-          "../lib/observability/index.js"
-        );
+        const { exportTelemetryRecorder } =
+          await import("../lib/observability/index.js");
         exportTelemetryRecorder(recorder);
       } catch {
         // Collector export is best-effort and never changes evaluation gates.

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.89",
+      "cliVersions": ["0.166.89"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.89: IDE capture journeys and controlled Linux entry",
+          "body": "- Prepare and finish frozen IDE tasks with byte-pinned baselines, complete diffs,\n  a shared deadline and real protocol/UI evidence from both IDE hosts.\n- Add explicit `agent controlled-host` for pre-provisioned Linux permission domains;\n  configuration checks do not claim backend execution or provision new authority.\n- Pair VS Code `0.37.134` and JetBrains `0.4.152` with CLI `0.166.89` for\n  opt-in panel capture, deterministic initial/restart diagnostics and retained\n  process-cleanup evidence. Add official MCP stdio interoperability checks."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.88",
+      "cliVersions": ["0.166.88"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.88: reviewed acceptance packs and host evidence import",
+          "body": "- Generate byte-pinned setup/check scripts for all 36 frozen tasks, including\n  behavior mutants, bounded Linux Docker execution and raw acceptance receipts.\n- Import IDE and first-run evidence through existing Eval/outcome contracts,\n  requiring input acceptance, terminal state, drained exit and complete file diffs.\n  Explicit failures stay failures; missing cost and identity attestation stay unknown.\n- Pair VS Code `0.37.133` and JetBrains `0.4.151` with CLI `0.166.88` for optional\n  ordered protocol capture. Full container, GUI, provider and billing acceptance\n  remain open; the frozen 36+9 samples remain `NOT_RUN`."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.87",

package/src/lib/eval/stream-terminal.js

@@ -0,0 +1,51 @@
+/** Parse raw agent NDJSON. A declaration of success is never terminal evidence. */
+export function verifyAgentTerminal(output) {
+  try {
+    const events = output
+      .split(/\r?\n/u)
+      .filter((line) => line.trim())
+      .map((line) => JSON.parse(line));
+    const results = events.filter((event) => event?.type === "result");
+    const terminal = results[0];
+    const usage = terminal?.usage;
+    const normalizedUsage =
+      usage &&
+      [
+        usage.input_tokens,
+        usage.output_tokens,
+        usage.cache_read_input_tokens,
+        usage.cache_creation_input_tokens,
+      ].every((value) => Number.isSafeInteger(value) && value >= 0)
+        ? {
+            inputTokens: usage.input_tokens,
+            outputTokens: usage.output_tokens,
+            cacheReadInputTokens: usage.cache_read_input_tokens,
+            cacheCreationInputTokens: usage.cache_creation_input_tokens,
+          }
+        : null;
+    return {
+      terminalVerified:
+        results.length === 1 &&
+        events.at(-1) === terminal &&
+        terminal.subtype === "success" &&
+        terminal.is_error === false &&
+        !events.some((event) => event?.type === "error"),
+      observedFallback: events.some((event) =>
+        ["provider_fallback", "model_fallback"].includes(event?.subtype),
+      ),
+      usage: normalizedUsage,
+      totalCostUsd:
+        Number.isFinite(terminal?.total_cost_usd) &&
+        terminal.total_cost_usd >= 0
+          ? terminal.total_cost_usd
+          : null,
+    };
+  } catch {
+    return {
+      terminalVerified: false,
+      observedFallback: null,
+      usage: null,
+      totalCostUsd: null,
+    };
+  }
+}

package/src/lib/eval/verify01-execution.js

@@ -19,6 +19,15 @@ export const VERIFY01_SUITES = [
 const MAX_SNAPSHOT_BYTES = 512 * 1024 * 1024;
 const MAX_DIFF_BYTES = 32 * 1024 * 1024;
 
+// Host drivers use the same checkout, complete scan, dependency boundary and
+// pinned evaluator processes as the CLI executor; no second diff contract.
+export {
+  materializeCheckout as materializeVerify01Checkout,
+  snapshot as snapshotVerify01Workspace,
+  diff as diffVerify01Workspace,
+  reviewedProcess as runVerify01ReviewedProcess,
+};
+
 function git(directory, args, options = {}) {
   return executionBroker.execFileSync("git", ["-C", directory, ...args], {
     encoding: "utf8",
@@ -328,7 +337,13 @@ function reviewedProcess(bytes, directory, reviewRoot, kind, timeout) {
   // operator code; their digest is not an independent-review attestation.
   const result = executionBroker.spawnSync(
     process.execPath,
-    ["--input-type=module", "--eval", bytes.toString("utf8"), directory],
+    [
+      "--input-type=module",
+      "--eval",
+      bytes.toString("utf8"),
+      directory,
+      String(Date.now() + timeout),
+    ],
     {
       cwd: reviewRoot,
       encoding: "utf8",