chainlesschain 0.166.88 → 0.166.90

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.90",
+      "cliVersions": ["0.166.90"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.90: recoverable projections and project risk evidence",
+          "body": "- Publish Personal Data Hub `0.4.63` and Session Core `0.3.15` before the CLI,\n  with exact dependency pins and public tarball verification. Require the full\n  PDH suite with its declared native SQLCipher driver on Linux, Windows and macOS.\n- Publish Agent SDK `0.2.13` with Vitest `4.1.11` test tooling to remove the\n  vulnerable Tinypool dependency, and upgrade the workspace proxy-addr to\n  `2.0.8`. Require SDK build and tests on the exact Linux, Windows and macOS\n  release commit before OIDC publication.\n- Persist PDH projection receipts, recover incomplete derivations and support\n  bounded receipt retention. Harden RAG updates, audit redaction and capability\n  reporting so unavailable sources do not appear as successful live collection.\n- Add offline project risk evaluation and version-bound task description\n  previews. Session Core also supplies native SQLite action/read services and\n  saved rule/source reviews for the desktop project workbench; CLI previews\n  carry unverified snapshot authority and do not execute those desktop actions.\n- Pair VS Code `0.37.135` and JetBrains `0.4.153` with CLI `0.166.90` after\n  exact-commit release checks and public npm readback."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.89",
+      "cliVersions": ["0.166.89"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.89: IDE capture journeys and controlled Linux entry",
+          "body": "- Prepare and finish frozen IDE tasks with byte-pinned baselines, complete diffs,\n  a shared deadline and real protocol/UI evidence from both IDE hosts.\n- Add explicit `agent controlled-host` for pre-provisioned Linux permission domains;\n  configuration checks do not claim backend execution or provision new authority.\n- Pair VS Code `0.37.134` and JetBrains `0.4.152` with CLI `0.166.89` for\n  opt-in panel capture, deterministic initial/restart diagnostics and retained\n  process-cleanup evidence. Add official MCP stdio interoperability checks."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.88",

package/src/gateways/ws/personal-data-hub-protocol.js

@@ -193,7 +193,8 @@ async function withHub(fn, loadHub = getHub) {
 }
 
 function governedHubLoader(factory) {
-  if (typeof factory === "function") return () => getGovernedAnalysisHub(factory);
+  if (typeof factory === "function")
+    return () => getGovernedAnalysisHub(factory);
   const error = new Error(
     "Personal Data Hub model egress requires an authenticated evolution composition factory",
   );
@@ -201,16 +202,24 @@ function governedHubLoader(factory) {
   throw error;
 }
 
+function validateEntityReference(entityType, entityId) {
+  if (
+    !["event", "person", "place", "item", "topic"].includes(entityType) ||
+    typeof entityId !== "string" ||
+    !entityId.trim() ||
+    entityId.length > 1024
+  ) {
+    throw new Error("A valid entityType and entityId are required");
+  }
+}
+
 export const PERSONAL_DATA_HUB_HANDLERS = {
   "personal-data-hub.ask": async (msg, context = {}) => {
     const factory = context.server?.evolutionCompositionFactory;
-    return withHub(
-      async (hub) => {
-        if (!hub.engine) throw new Error("Analysis engine unavailable");
-        return await hub.engine.ask(msg.question, msg.options || {});
-      },
-      governedHubLoader(factory),
-    );
+    return withHub(async (hub) => {
+      if (!hub.engine) throw new Error("Analysis engine unavailable");
+      return await hub.engine.ask(msg.question, msg.options || {});
+    }, governedHubLoader(factory));
   },
 
   // Path Y: prompt context only, no LLM call. Lets web-shell / mobile host
@@ -250,6 +259,43 @@ export const PERSONAL_DATA_HUB_HANDLERS = {
   "personal-data-hub.list-adapters": async () =>
     withHub((hub) => hub.registry.list()),
 
+  "personal-data-hub.derivation-status": async (msg) =>
+    withHub((hub) =>
+      hub.registry.getDerivationStatus({
+        adapter: msg.adapter,
+        scope: msg.scope,
+      }),
+    ),
+
+  "personal-data-hub.derivation-state": async (msg) =>
+    withHub((hub) => {
+      validateEntityReference(msg.entityType, msg.entityId);
+      return hub.vault
+        .getDerivationStore()
+        .getState(msg.entityType, msg.entityId, {
+          consumerId: hub.registry.consumerId,
+        });
+    }),
+
+  "personal-data-hub.retry-derivations": async (msg) =>
+    withHub((hub) =>
+      hub.registry.retryDerivations({
+        adapter: msg.adapter,
+        scope: msg.scope,
+        limit: msg.limit,
+      }),
+    ),
+
+  "personal-data-hub.delete-entity": async (msg) =>
+    withHub(async (hub) => {
+      if (msg.confirm !== true)
+        throw new Error("Entity deletion requires confirm: true");
+      validateEntityReference(msg.entityType, msg.entityId);
+      const deleted = hub.vault.deleteEntity(msg.entityType, msg.entityId);
+      const derivations = await hub.registry.retryDerivations({ limit: 1000 });
+      return { deleted, derivations };
+    }),
+
   // Per-adapter readiness ("能否采集 + 不能的原因"). Probes each adapter's
   // authenticate({ readinessOnly: true }) — see AdapterRegistry.readiness().
   // The web-shell PersonalDataHub view renders this as a 就绪状态 column so

package/src/lib/audit-logger.js

@@ -6,6 +6,7 @@
 import crypto from "crypto";
 import { safeJsonParse } from "./safe-json.js";
 import { escapeLike } from "./sql-like.js";
+import { sanitizeAuditDetails } from "./audit-sanitizer.js";
 
 /**
  * Event types for audit logging.
@@ -112,29 +113,15 @@ export function assessRisk(eventType, operation, details) {
  * Sanitize sensitive data from log details.
  */
 export function sanitizeDetails(details) {
-  if (!details || typeof details !== "object") return details;
-
-  const sanitized = { ...details };
-  const sensitiveKeys = [
-    "password",
-    "secret",
-    "secretKey",
-    "secret_key",
-    "privateKey",
-    "private_key",
-    "token",
-    "apiKey",
-    "api_key",
-    "mnemonic",
-  ];
-
-  for (const key of sensitiveKeys) {
-    if (sanitized[key]) {
-      sanitized[key] = "[REDACTED]";
-    }
-  }
+  return sanitizeAuditDetails(details);
+}
 
-  return sanitized;
+function sanitizeErrorMessage(value) {
+  const sanitized = sanitizeDetails(value);
+  if (sanitized == null) return null;
+  return typeof sanitized === "object"
+    ? JSON.stringify(sanitized)
+    : String(sanitized);
 }
 
 /**
@@ -146,8 +133,7 @@ export function logEvent(db, event) {
   const id = crypto.randomUUID();
   const sanitized = sanitizeDetails(event.details);
   const risk =
-    event.riskLevel ||
-    assessRisk(event.eventType, event.operation, event.details);
+    event.riskLevel || assessRisk(event.eventType, event.operation, sanitized);
 
   db.prepare(
     `INSERT INTO audit_log (id, event_type, operation, actor, target, details, risk_level, ip_address, user_agent, success, error_message)
@@ -158,12 +144,12 @@ export function logEvent(db, event) {
     event.operation || "unknown",
     event.actor || null,
     event.target || null,
-    sanitized ? JSON.stringify(sanitized) : null,
+    sanitized == null ? null : JSON.stringify(sanitized),
     risk,
     event.ipAddress || null,
     event.userAgent || null,
     event.success !== false ? 1 : 0,
-    event.errorMessage || null,
+    sanitizeErrorMessage(event.errorMessage),
   );
 
   return { id, riskLevel: risk, createdAt: new Date().toISOString() };
@@ -516,7 +502,8 @@ export function logEventV2(
   if (_logStatesV2.has(logId)) {
     throw new Error(`Log already registered: ${logId}`);
   }
-  const risk = riskLevel || assessRisk(eventType, operation, details);
+  const sanitized = sanitizeDetails(details);
+  const risk = riskLevel || assessRisk(eventType, operation, sanitized);
   if (!RISK_LEVELS_V2.includes(risk)) {
     throw new Error(`Invalid riskLevel: ${risk}`);
   }
@@ -527,12 +514,12 @@ export function logEventV2(
     operation,
     actor: actor || null,
     target: target || null,
-    details: sanitizeDetails(details) || null,
+    details: sanitized ?? null,
     riskLevel: risk,
     ipAddress: ipAddress || null,
     userAgent: userAgent || null,
     success: success !== false,
-    errorMessage: errorMessage || null,
+    errorMessage: sanitizeErrorMessage(errorMessage),
     status: LOG_STATUS_V2.ACTIVE,
     integrityStatus: INTEGRITY_STATUS_V2.UNVERIFIED,
     prevHash: _lastChainHash,

package/src/lib/audit-sanitizer.js

@@ -0,0 +1,279 @@
+/**
+ * JSON-safe audit details. Limits apply before string processing and while
+ * traversing; getters and user-provided toJSON methods are never invoked.
+ * This is field/credential redaction, not detection of arbitrary secrets in prose.
+ */
+const REDACTED = "[REDACTED]";
+const TRUNCATED = "[Truncated]";
+const LIMITS = Object.freeze({
+  depth: 8,
+  entries: 100,
+  nodes: 512,
+  stringLength: 4096,
+  keyLength: 256,
+  totalCharacters: 16384,
+  serializedBytes: 65536,
+});
+
+const SENSITIVE_KEYS = new Set([
+  "password",
+  "passwd",
+  "pwd",
+  "passphrase",
+  "secret",
+  "secretkey",
+  "privatekey",
+  "apikey",
+  "token",
+  "authorization",
+  "proxyauthorization",
+  "cookie",
+  "setcookie",
+  "mnemonic",
+  "seedphrase",
+  "credentials",
+  "credential",
+  "encryptionkey",
+  "signingkey",
+  "sessionid",
+  "auth",
+]);
+
+function normalizeKey(key) {
+  return key.toLowerCase().replace(/[\s_.-]/g, "");
+}
+
+function isSensitiveKey(key) {
+  const normalized = normalizeKey(key);
+  return (
+    SENSITIVE_KEYS.has(normalized) ||
+    /(?:password|secret|privatekey|apikey|token)$/.test(normalized)
+  );
+}
+
+function isSensitiveQueryKey(key) {
+  return isSensitiveKey(key) || /^(?:key|code|sig|signature)$/i.test(key);
+}
+
+function sanitizeUrl(text) {
+  try {
+    const url = new URL(text);
+    if (url.username || url.password) {
+      url.username = REDACTED;
+      url.password = "";
+    }
+    const params = new URLSearchParams();
+    for (const [key, value] of url.searchParams) {
+      params.append(key, isSensitiveQueryKey(key) ? REDACTED : value);
+    }
+    url.search = params.toString();
+    // OAuth implicit responses put credentials in the fragment instead of query.
+    if (url.hash.includes("=")) {
+      const fragment = new URLSearchParams(url.hash.slice(1));
+      const sanitized = new URLSearchParams();
+      for (const [key, value] of fragment) {
+        sanitized.append(key, isSensitiveQueryKey(key) ? REDACTED : value);
+      }
+      url.hash = sanitized.toString();
+    }
+    return url.toString();
+  } catch {
+    return "[REDACTED URL]";
+  }
+}
+
+function sanitizeString(value) {
+  // Drop oversized strings whole: slicing can expose half of a credential.
+  if (value.length > LIMITS.stringLength) return TRUNCATED;
+  return value
+    .replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s<>"'`]+/gi, sanitizeUrl)
+    .replace(/\b(?:Bearer|Basic)\s+[a-z0-9._~+/=-]+/gi, REDACTED)
+    .replace(
+      /\b((?:proxy[-_ ]?)?authorization|(?:set[-_ ]?)?cookie)\s*:\s*[^\r\n]+/gi,
+      "$1: [REDACTED]",
+    )
+    .replace(
+      /\b((?:[a-z0-9_.-]{0,64})?(?:password|secret|private[-_.]?key|api[-_.]?key|token)|passwd|pwd|passphrase|mnemonic|seed[-_.]?phrase|credentials?|encryption[-_.]?key|signing[-_.]?key|session[-_.]?id|auth|(?:proxy[-_.]?)?authorization|(?:set[-_.]?)?cookie)(["']?\s*[=:]\s*)("(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*'|[^\s&,;"']+)/gi,
+      (_match, key, separator, value) => {
+        const quote = value[0] === '"' || value[0] === "'" ? value[0] : "";
+        return `${key}${separator}${quote}${REDACTED}${quote}`;
+      },
+    );
+}
+
+function readDataProperty(value, key) {
+  const descriptor = Object.getOwnPropertyDescriptor(value, key);
+  return descriptor && "value" in descriptor
+    ? descriptor.value
+    : "[Accessor omitted]";
+}
+
+function errorName(value) {
+  let prototype = value;
+  for (let i = 0; prototype && i < LIMITS.depth; i += 1) {
+    if (Object.hasOwn(prototype, "name")) {
+      const name = readDataProperty(prototype, "name");
+      return typeof name === "string" ? name : "Error";
+    }
+    prototype = Object.getPrototypeOf(prototype);
+  }
+  return "Error";
+}
+
+function setDataProperty(target, key, value) {
+  // Defining __proto__ as data cannot mutate the output object's prototype.
+  Object.defineProperty(target, key, {
+    value,
+    enumerable: true,
+    configurable: true,
+    writable: true,
+  });
+}
+
+export function sanitizeAuditDetails(details) {
+  const ancestors = new WeakSet();
+  let remainingNodes = LIMITS.nodes;
+  let remainingCharacters = LIMITS.totalCharacters;
+
+  function text(value) {
+    const sanitized = sanitizeString(value);
+    if (sanitized.length > remainingCharacters) return TRUNCATED;
+    remainingCharacters -= sanitized.length;
+    return sanitized;
+  }
+
+  function visit(value, depth = 0, context = "") {
+    if (remainingNodes-- <= 0) return TRUNCATED;
+    if (value === null || value === undefined) return value;
+    if (typeof value === "string") return text(value);
+    if (typeof value === "bigint") return text(value.toString());
+    if (typeof value === "number") return Number.isFinite(value) ? value : null;
+    if (typeof value === "boolean") return value;
+    if (typeof value === "function") return "[Function omitted]";
+    if (typeof value === "symbol") return "[Symbol omitted]";
+    if (depth >= LIMITS.depth) return TRUNCATED;
+    if (ancestors.has(value)) return "[Circular Reference]";
+    ancestors.add(value);
+    try {
+      if (value instanceof Date) {
+        return text(Date.prototype.toISOString.call(value));
+      }
+      if (value instanceof URL) {
+        return text(URL.prototype.toString.call(value));
+      }
+      if (ArrayBuffer.isView(value) || value instanceof ArrayBuffer) {
+        return "[Binary omitted]";
+      }
+
+      // Native fetch headers and query objects have no useful enumerable fields.
+      if (value instanceof Headers || value instanceof URLSearchParams) {
+        const result = {};
+        const iterator =
+          value instanceof Headers
+            ? Headers.prototype.entries.call(value)
+            : URLSearchParams.prototype.entries.call(value);
+        let count = 0;
+        for (const [key, item] of iterator) {
+          if (count++ >= LIMITS.entries || remainingNodes <= 0) {
+            setDataProperty(result, "[Truncated]", true);
+            break;
+          }
+          if (key.length > LIMITS.keyLength) continue;
+          setDataProperty(
+            result,
+            text(key),
+            isSensitiveQueryKey(key) ? REDACTED : visit(item, depth + 1),
+          );
+        }
+        return result;
+      }
+
+      if (Array.isArray(value)) {
+        const result = [];
+        const isHeaderList = normalizeKey(context).endsWith("headers");
+        // Header tuple arrays are commonly returned by fetch/HTTP clients.
+        const first = readDataProperty(value, "0");
+        const isSensitivePair =
+          value.length === 2 &&
+          typeof first === "string" &&
+          isSensitiveKey(first);
+        for (let i = 0; i < value.length; i += 1) {
+          if (i >= LIMITS.entries || remainingNodes <= 0) {
+            result.push(TRUNCATED);
+            break;
+          }
+          const previous =
+            i % 2 === 1 && isHeaderList
+              ? readDataProperty(value, String(i - 1))
+              : null;
+          const redact =
+            (isSensitivePair && i === 1) ||
+            (typeof previous === "string" && isSensitiveKey(previous));
+          result.push(
+            redact
+              ? REDACTED
+              : visit(readDataProperty(value, String(i)), depth + 1, context),
+          );
+        }
+        return result;
+      }
+
+      const result = {};
+      if (value instanceof Error) {
+        setDataProperty(result, "name", text(errorName(value)));
+        // message/stack/cause are usually non-enumerable. Do not call getters.
+        for (const key of ["name", "message", "stack", "cause"]) {
+          if (Object.hasOwn(value, key)) {
+            setDataProperty(
+              result,
+              key,
+              visit(readDataProperty(value, key), depth + 1),
+            );
+          }
+        }
+      }
+      let count = 0;
+      const headerName = normalizeKey(context).endsWith("headers")
+        ? readDataProperty(value, "name")
+        : null;
+      for (const key in value) {
+        if (
+          count++ >= LIMITS.entries ||
+          remainingNodes <= 0 ||
+          remainingCharacters <= 0
+        ) {
+          setDataProperty(result, "[Truncated]", true);
+          break;
+        }
+        if (!Object.hasOwn(value, key)) continue;
+        if (key.length > LIMITS.keyLength) {
+          setDataProperty(result, "[Truncated key]", true);
+          continue;
+        }
+        setDataProperty(
+          result,
+          text(key),
+          isSensitiveKey(key) ||
+            (key === "value" &&
+              typeof headerName === "string" &&
+              isSensitiveKey(headerName))
+            ? REDACTED
+            : visit(readDataProperty(value, key), depth + 1, key),
+        );
+      }
+      return result;
+    } catch {
+      // Proxies, invalid native objects, etc. must not break event persistence.
+      return "[Unserializable]";
+    } finally {
+      ancestors.delete(value);
+    }
+  }
+
+  const sanitized = visit(details);
+  const serialized = JSON.stringify(sanitized);
+  return serialized &&
+    Buffer.byteLength(serialized, "utf8") > LIMITS.serializedBytes
+    ? TRUNCATED
+    : sanitized;
+}

package/src/lib/automation-center.js

@@ -18,6 +18,7 @@ import {
   buildAutomationCenterRuntimeProjection,
 } from "./automation-center-runtime.js";
 import {
+  AUTOMATION_EXECUTION_CAPABILITY,
   EXECUTION_STATUS,
   FLOW_STATUS,
   TRIGGER_TYPE,
@@ -117,6 +118,7 @@ function projectExecution(execution) {
   return {
     id: execution.id,
     status: execution.status,
+    mode: execution.mode,
     triggerType: execution.triggerType || null,
     durationMs: Number(execution.durationMs) || 0,
     startedAt: execution.startedAt || null,
@@ -213,6 +215,7 @@ function projectFlow(db, flow, { historyLimit, now }) {
     history,
     incidents,
     security,
+    executionCapability: AUTOMATION_EXECUTION_CAPABILITY,
   };
   const revision = digest(content);
   const active = flow.status === FLOW_STATUS.ACTIVE;
@@ -225,21 +228,28 @@ function projectFlow(db, flow, { historyLimit, now }) {
     actions: [
       action(
         "run_now",
-        active && security.ready,
+        active && security.ready && AUTOMATION_EXECUTION_CAPABILITY.live,
         !active
           ? "flow is not active"
-          : "permission or budget preflight denied",
+          : !security.ready
+            ? "permission or budget preflight denied"
+            : AUTOMATION_EXECUTION_CAPABILITY.reason,
         flow.id,
         revision,
       ),
       action(
         "retry_failed",
-        active && latestFailed && security.ready,
+        active &&
+          latestFailed &&
+          security.ready &&
+          AUTOMATION_EXECUTION_CAPABILITY.live,
         !active
           ? "flow is not active"
           : !latestFailed
             ? "latest run did not fail"
-            : "permission or budget preflight denied",
+            : !security.ready
+              ? "permission or budget preflight denied"
+              : AUTOMATION_EXECUTION_CAPABILITY.reason,
         flow.id,
         revision,
       ),