chainlesschain 0.166.91 → 0.166.92

package/src/lib/formal-quality-eval-runtime.js

@@ -1,3 +1,4 @@
+import { isFormalQualityHermeticRuntime } from "@chainlesschain/session-core/host-storage-environment";
 import { createHash } from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
@@ -23,20 +24,7 @@ export const FORMAL_QUALITY_FILE_TOOLS = Object.freeze([
  * headless boundary through a launcher-only environment marker. Keep the
  * check exact so inherited or malformed values never change normal CLI runs.
  */
-export function isFormalQualityHermeticRuntime(environment = process.env) {
-  if (environment?.[FORMAL_QUALITY_HERMETIC_ENV] !== "1") return false;
-  const configuredHome = String(environment?.CHAINLESSCHAIN_HOME || "").trim();
-  if (!configuredHome) return false;
-  const temporaryRoot = path.resolve(os.tmpdir());
-  const resolvedHome = path.resolve(configuredHome);
-  const relation = path.relative(temporaryRoot, resolvedHome);
-  return Boolean(
-    relation &&
-    relation !== ".." &&
-    !relation.startsWith(`..${path.sep}`) &&
-    !path.isAbsolute(relation),
-  );
-}
+export { isFormalQualityHermeticRuntime };
 
 function formalQualityIsolationRoot(environment) {
   if (!isFormalQualityHermeticRuntime(environment)) return null;

package/src/lib/goal-store.js

@@ -18,8 +18,15 @@
 
 import fs from "node:fs";
 import path from "node:path";
+import { createHash } from "node:crypto";
 import { getHomeDir } from "./paths.js";
 import { withFileLock } from "./with-file-lock.js";
+import {
+  createGoalRecord,
+  validateGoalRecord,
+  upgradeLegacyGoal,
+  goalError,
+} from "@chainlesschain/session-core/goal-contract";
 
 /** Valid goal lifecycle states. `active` goals are the ones injected. */
 export const GOAL_STATUS = Object.freeze({
@@ -35,6 +42,25 @@ function defaultRoot() {
   return path.join(getHomeDir(), "goals");
 }
 
+/** Store identity is path-bound metadata, not filesystem authorization. */
+export function goalFileStoreId(root = defaultRoot()) {
+  const resolved = path.resolve(root);
+  const canonical =
+    process.platform === "win32" ? resolved.toLowerCase() : resolved;
+  return `cli-goals-${createHash("sha256").update(canonical).digest("hex")}`;
+}
+
+function fileRecord(value, root) {
+  const record = upgradeLegacyGoal(value, goalFileStoreId(root));
+  if (record.storeId !== goalFileStoreId(root))
+    throw goalError("GOAL_STORE_MISMATCH");
+  // Files are the legacy standalone CLI store. Project authority lives in the
+  // host database and must not be acquired by copying a record into this dir.
+  if (record.ownerRef !== null || record.projectRef !== null)
+    throw goalError("GOAL_PROJECT_STORE_REQUIRED");
+  return record;
+}
+
 function ensureDir(dir) {
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
 }
@@ -83,6 +109,7 @@ function isUnsafeGoalId(id) {
     id == null ||
     id === "" ||
     typeof id !== "string" ||
+    !/^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/u.test(id) ||
     id.includes("/") ||
     id.includes("\\") ||
     id.includes("..")
@@ -133,17 +160,15 @@ export function createGoal(input = {}, opts = {}) {
   }
   const keyResults = (input.keyResults || []).map((kr) => normalizeKr(kr));
   const goal = {
-    id,
-    title: String(input.title || objective).trim(),
-    objective,
-    keyResults,
-    status: GOAL_STATUS.ACTIVE,
+    ...createGoalRecord({
+      id,
+      storeId: goalFileStoreId(root),
+      title: String(input.title || objective).trim(),
+      objective,
+      keyResults,
+      createdAt: nowIso(),
+    }),
     progress: derivedProgress(keyResults) ?? 0,
-    linkedSessions: [],
-    notes: [],
-    drift: { lastProgressAt: null, flags: [] },
-    createdAt: nowIso(),
-    updatedAt: nowIso(),
   };
   ensureDir(root);
   const file = goalFile(root, id);
@@ -186,21 +211,42 @@ export function getGoal(id, opts = {}) {
   const file = goalFile(root, id);
   if (!fs.existsSync(file)) return null;
   try {
-    return JSON.parse(fs.readFileSync(file, "utf-8"));
+    const value = JSON.parse(fs.readFileSync(file, "utf-8"));
+    if (value?.id !== id) return null;
+    if (Object.hasOwn(value, "schema") || Object.hasOwn(value, "schemaVersion"))
+      fileRecord(value, root);
+    return value;
   } catch {
     return null;
   }
 }
 
-function saveGoal(goal, opts = {}) {
+function saveGoal(goal, opts = {}, before = null) {
   if (isUnsafeGoalId(goal && goal.id)) {
     throw new Error(`非法 goal id: ${String(goal && goal.id).slice(0, 60)}`);
   }
   const root = opts.root || defaultRoot();
   ensureDir(root);
-  goal.updatedAt = nowIso();
-  atomicWriteFileSync(goalFile(root, goal.id), JSON.stringify(goal, null, 2));
-  return goal;
+  const previous = before || fileRecord(goal, root);
+  const migrated = goal.schema ? goal : { ...fileRecord(goal, root) };
+  if (previous.completion !== null && migrated.status === "done")
+    throw goalError("GOAL_TERMINAL_REVISION_DENIED");
+  const controls = ["status", "objective", "keyResults"];
+  const changedControl = controls.some(
+    (key) => JSON.stringify(previous[key]) !== JSON.stringify(migrated[key]),
+  );
+  const saved = fileRecord(
+    {
+      ...migrated,
+      revision: previous.revision + 1,
+      controlGeneration: previous.controlGeneration + (changedControl ? 1 : 0),
+      completion: null,
+      updatedAt: nowIso(),
+    },
+    root,
+  );
+  atomicWriteFileSync(goalFile(root, goal.id), JSON.stringify(saved, null, 2));
+  return saved;
 }
 
 /** List goals, newest first. Optionally filter by status. */
@@ -233,8 +279,64 @@ function mutate(id, fn, opts = {}) {
     () => {
       const goal = getGoal(id, opts);
       if (!goal) throw new Error(`no such goal: ${id}`);
+      let before;
+      try {
+        before = fileRecord(goal, root);
+      } catch (error) {
+        // Older CLI records had unbounded notes/strings. Preserve their full
+        // history and existing controls if the bounded contract cannot accept
+        // them. This fallback is never available to a versioned record.
+        if (
+          Object.hasOwn(goal, "schema") ||
+          Object.hasOwn(goal, "schemaVersion") ||
+          ![
+            "GOAL_INVALID_ARRAY",
+            "GOAL_INVALID_TEXT",
+            "GOAL_INVALID_JSON",
+          ].includes(error.code)
+        )
+          throw error;
+        const revision = goal.revision ?? 1;
+        const generation = goal.controlGeneration ?? 0;
+        if (
+          !Number.isSafeInteger(revision) ||
+          revision < 1 ||
+          !Number.isSafeInteger(generation) ||
+          generation < 0 ||
+          !Number.isSafeInteger(revision + 1) ||
+          !Number.isSafeInteger(generation + 1)
+        )
+          throw goalError("GOAL_INVALID_REVISION");
+        if (
+          opts.expectedRevision !== undefined &&
+          opts.expectedRevision !== revision
+        )
+          throw goalError("GOAL_REVISION_CONFLICT");
+        const controls = JSON.stringify([
+          goal.status,
+          goal.objective,
+          goal.keyResults,
+        ]);
+        fn(goal);
+        goal.revision = revision + 1;
+        goal.controlGeneration =
+          generation +
+          (controls !==
+          JSON.stringify([goal.status, goal.objective, goal.keyResults])
+            ? 1
+            : 0);
+        goal.updatedAt = nowIso();
+        atomicWriteFileSync(goalFile(root, id), JSON.stringify(goal, null, 2));
+        return goal;
+      }
+      if (
+        opts.expectedRevision !== undefined &&
+        (!Number.isSafeInteger(opts.expectedRevision) ||
+          opts.expectedRevision !== before.revision)
+      )
+        throw goalError("GOAL_REVISION_CONFLICT");
       fn(goal);
-      return saveGoal(goal, opts);
+      return saveGoal(goal, opts, before);
     },
     { failIfUnavailable: true },
   );
@@ -385,6 +487,15 @@ export function deleteGoal(id, opts = {}) {
     file,
     () => {
       if (!fs.existsSync(file)) return false;
+      if (opts.expectedRevision !== undefined) {
+        const current = getGoal(id, { root });
+        if (
+          !current ||
+          !Number.isSafeInteger(opts.expectedRevision) ||
+          opts.expectedRevision !== (current.revision ?? 1)
+        )
+          throw goalError("GOAL_REVISION_CONFLICT");
+      }
       fs.rmSync(file);
       return true;
     },
@@ -419,3 +530,101 @@ export function resolveActiveGoal(sel = {}, opts = {}) {
   // Ambiguous (multiple active, none linked) — caller must pick explicitly.
   return null;
 }
+
+/** Injectable repository adapter using the same files/strict locks as cc goal.
+ * Reading a legacy file upgrades the returned view only; it never rewrites the
+ * file, binds an owner or enables scheduling. */
+export function createGoalFileAdapter(opts = {}) {
+  const root = opts.root || defaultRoot();
+  const storeId = goalFileStoreId(root);
+  function read(id) {
+    if (isUnsafeGoalId(id)) throw goalError("GOAL_INVALID_ID");
+    const file = goalFile(root, id);
+    if (!fs.existsSync(file)) return null;
+    let value;
+    try {
+      value = JSON.parse(fs.readFileSync(file, "utf8"));
+    } catch {
+      throw goalError("GOAL_RECORD_CORRUPT");
+    }
+    const record = fileRecord(value, root);
+    if (record.id !== id) throw goalError("GOAL_RECORD_CORRUPT");
+    return record;
+  }
+  return Object.freeze({
+    storeId,
+    get: read,
+    create(value) {
+      const record = fileRecord(value, root);
+      if (isUnsafeGoalId(record.id)) throw goalError("GOAL_INVALID_ID");
+      if (
+        record.revision !== 1 ||
+        record.controlGeneration !== 0 ||
+        record.status !== "active"
+      )
+        throw goalError("GOAL_INVALID_INITIAL_STATE");
+      ensureDir(root);
+      return withFileLock(
+        goalFile(root, record.id),
+        () => {
+          if (fs.existsSync(goalFile(root, record.id)))
+            throw goalError("GOAL_ALREADY_EXISTS");
+          atomicWriteFileSync(
+            goalFile(root, record.id),
+            JSON.stringify(record, null, 2),
+          );
+          return record;
+        },
+        { failIfUnavailable: true },
+      );
+    },
+    compareAndSwap(id, expectedRevision, transform) {
+      if (isUnsafeGoalId(id)) throw goalError("GOAL_INVALID_ID");
+      if (
+        !Number.isSafeInteger(expectedRevision) ||
+        expectedRevision < 1 ||
+        typeof transform !== "function"
+      )
+        throw goalError("GOAL_INVALID_REVISION");
+      if (!fs.existsSync(goalFile(root, id)))
+        throw goalError("GOAL_NOT_FOUND_OR_DENIED");
+      return withFileLock(
+        goalFile(root, id),
+        () => {
+          const current = read(id);
+          if (current === null) throw goalError("GOAL_NOT_FOUND_OR_DENIED");
+          if (current.revision !== expectedRevision)
+            throw goalError("GOAL_REVISION_CONFLICT");
+          const next = fileRecord(validateGoalRecord(transform(current)), root);
+          if (
+            next.id !== id ||
+            next.revision !== current.revision + 1 ||
+            next.controlGeneration < current.controlGeneration
+          )
+            throw goalError("GOAL_INVALID_REPLACEMENT");
+          atomicWriteFileSync(
+            goalFile(root, id),
+            JSON.stringify(next, null, 2),
+          );
+          return next;
+        },
+        { failIfUnavailable: true },
+      );
+    },
+    list({ status } = {}) {
+      if (status !== undefined && !STATUS_VALUES.has(status))
+        throw goalError("GOAL_INVALID_STATUS");
+      if (!fs.existsSync(root)) return [];
+      return fs
+        .readdirSync(root)
+        .filter((name) => name.endsWith(".json"))
+        .map((name) => read(name.slice(0, -5)))
+        .filter(
+          (record) =>
+            record !== null &&
+            (status === undefined || record.status === status),
+        )
+        .sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+    },
+  });
+}

package/src/lib/record-replay/skill-recorder.js

@@ -26,6 +26,7 @@ const VOLATILE_PATTERNS = Object.freeze([
   /(?:^|[\\/])(?:tmp|temp)(?:[\\/]|$)/iu,
 ]);
 const PARAMETER_PATTERN = /^\$\{parameter\.([A-Za-z][A-Za-z0-9_]*)\}$/u;
+const SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/u;
 const EMBEDDED_PARAMETER_PATTERN = /\$\{parameter\.([A-Za-z][A-Za-z0-9_]*)\}/gu;
 const DRAFT_SCHEMA = "chainlesschain.recorded-skill-draft/v1";
 const REPORT_SCHEMA = "chainlesschain.recorded-skill-replay/v1";
@@ -165,6 +166,34 @@ export function scanRecordedValue(value) {
   return findings;
 }
 
+function scanRecordedContent({ environment, ...content }) {
+  const scannedEnvironment = clone(environment);
+  const omitDigest = (object, key, nullable = false) => {
+    if (!Object.hasOwn(object, key) || (nullable && object[key] === null))
+      return;
+    if (typeof object[key] !== "string" || !SHA256_PATTERN.test(object[key])) {
+      throw recorderError(
+        "CC_REPLAY_INVALID_ARGUMENT",
+        `recorded browser ${key} must be a canonical SHA-256 digest`,
+      );
+    }
+    delete object[key];
+  };
+  // These exact browser-binding fields contain generated hashes, whose hex
+  // digits can accidentally match a phone number. Do not exempt digest-like
+  // strings in descriptions, actions or arbitrary environment fields.
+  omitDigest(scannedEnvironment, "targetDigest");
+  omitDigest(scannedEnvironment, "storageStateDigest", true);
+  if (
+    scannedEnvironment.networkPolicy &&
+    typeof scannedEnvironment.networkPolicy === "object" &&
+    !Array.isArray(scannedEnvironment.networkPolicy)
+  ) {
+    omitDigest(scannedEnvironment.networkPolicy, "digest");
+  }
+  return scanRecordedValue({ ...content, environment: scannedEnvironment });
+}
+
 function environmentBinding(environment) {
   const value = canonicalValue(environment || {});
   assertPlainObject(value, "environment");
@@ -440,8 +469,14 @@ export function validateRecordedSkillDraft(value) {
       "recorded skill environment binding was modified",
     );
   }
-  const scanned = { description, actions, failureConditions, environment };
-  const findings = scanRecordedValue(scanned);
+  // The binding digest was recomputed and checked above. Scan the underlying
+  // requirements, not the generated digest, just as initial capture does.
+  const findings = scanRecordedContent({
+    description,
+    actions,
+    failureConditions,
+    environment: environment.requirements,
+  });
   if (findings.length > 0) {
     throw recorderError(
       "CC_REPLAY_SENSITIVE_OR_VOLATILE_DATA",
@@ -689,7 +724,7 @@ export function createRecordedSkillDraft({
     clone(actions, "actions"),
     bindings,
   );
-  const findings = scanRecordedValue({
+  const findings = scanRecordedContent({
     description: safeDescription,
     actions: sanitizedActions,
     environment: safeEnvironment,

package/src/lib/scheduler-kernel/authority-resolver.js

@@ -1,163 +1,12 @@
-import {
-  SchedulerKernelError,
-  normalizeAuthorityEnvelope,
-  normalizeIdentifier,
-} from "./contract.js";
-
-export const DEFAULT_SCHEDULER_AUTHORITY_WINDOW_MS = 24 * 60 * 60 * 1_000;
-export const DEFAULT_SCHEDULER_AUTHORITY_MAX_RUNS = 100_000;
-export const DEFAULT_SCHEDULER_AUTHORITY_MAX_UNITS = 100_000;
-
-function authorityError(code, message, details = undefined, cause = undefined) {
-  const error = new SchedulerKernelError(
-    code,
-    message,
-    details,
-    cause ? { cause } : undefined,
-  );
-  error.retryable = false;
-  return error;
-}
-
-function assertAuthorityStore(store) {
-  const methods = [
-    "ensureAuthorityPolicy",
-    "getAuthorityPolicy",
-    "reserveAuthority",
-  ];
-  if (!store || methods.some((method) => typeof store[method] !== "function")) {
-    throw authorityError(
-      "SCHEDULER_AUTHORITY_STORE_REQUIRED",
-      "Scheduler authority resolver requires a compatible scheduler store",
-    );
-  }
-  return store;
-}
-
-function normalizeUnits(value) {
-  if (!Number.isSafeInteger(value) || value < 1) {
-    throw authorityError(
-      "SCHEDULER_AUTHORITY_UNITS_INVALID",
-      "Scheduler authority units must be a positive integer",
-    );
-  }
-  return value;
-}
-
-export function schedulerAuthorityPolicyReference(revision) {
-  if (!Number.isSafeInteger(revision) || revision < 1) {
-    throw authorityError(
-      "SCHEDULER_AUTHORITY_POLICY_INVALID",
-      "Scheduler authority policy revision must be a positive integer",
-    );
-  }
-  return `scheduler-authority:${revision}`;
-}
-
-export function parseSchedulerAuthorityPolicyReference(value) {
-  const match = /^scheduler-authority:(\d+)$/u.exec(String(value || ""));
-  const revision = match ? Number(match[1]) : NaN;
-  return Number.isSafeInteger(revision) && revision > 0 ? revision : null;
-}
-
-export function bindSchedulerAuthorityPolicy(store, authority, defaults = {}) {
-  const compatibleStore = assertAuthorityStore(store);
-  const normalized = normalizeAuthorityEnvelope(authority);
-  const policy = compatibleStore.ensureAuthorityPolicy(normalized, {
-    windowMs: defaults.windowMs ?? DEFAULT_SCHEDULER_AUTHORITY_WINDOW_MS,
-    maxRuns: defaults.maxRuns ?? DEFAULT_SCHEDULER_AUTHORITY_MAX_RUNS,
-    maxUnits: defaults.maxUnits ?? DEFAULT_SCHEDULER_AUTHORITY_MAX_UNITS,
-  });
-  return {
-    ...normalized,
-    authorizationRefs: {
-      ...normalized.authorizationRefs,
-      schedulerPolicyRevision: schedulerAuthorityPolicyReference(
-        policy.revision,
-      ),
-    },
-  };
-}
-
-export function createSchedulerAuthorityResolver({
-  store,
-  validate,
-  units = () => 1,
-} = {}) {
-  const compatibleStore = assertAuthorityStore(store);
-  if (typeof validate !== "function") {
-    throw authorityError(
-      "SCHEDULER_AUTHORITY_VALIDATOR_REQUIRED",
-      "Scheduler authority resolver requires a domain validator",
-    );
-  }
-  if (typeof units !== "function") {
-    throw authorityError(
-      "SCHEDULER_AUTHORITY_UNITS_REQUIRED",
-      "Scheduler authority resolver requires a unit estimator",
-    );
-  }
-  return async (context) => {
-    const domain = await validate(context);
-    if (!domain || typeof domain !== "object" || domain.allowed !== true) {
-      return {
-        allowed: false,
-        reason:
-          typeof domain?.reason === "string"
-            ? domain.reason.slice(0, 256)
-            : "domain_authority_denied",
-      };
-    }
-    const authority = normalizeAuthorityEnvelope(
-      context?.occurrence?.authority,
-    );
-    const policy = compatibleStore.getAuthorityPolicy(authority.principal);
-    if (!policy || !policy.enabled) {
-      return { allowed: false, reason: "scheduler_authority_policy_required" };
-    }
-    const reference = parseSchedulerAuthorityPolicyReference(
-      authority.authorizationRefs.schedulerPolicyRevision,
-    );
-    if (reference === null) {
-      return { allowed: false, reason: "scheduler_authority_policy_unbound" };
-    }
-    if (reference !== policy.revision) {
-      return { allowed: false, reason: "scheduler_authority_policy_stale" };
-    }
-    const occurrenceId = normalizeIdentifier(
-      context?.occurrence?.id,
-      "occurrenceId",
-    );
-    try {
-      const requestedUnits = normalizeUnits(await units(context));
-      const reservation = compatibleStore.reserveAuthority({
-        occurrenceId,
-        policyRevision: policy.revision,
-        units: requestedUnits,
-      });
-      return {
-        allowed: true,
-        reason: "scheduler_authority_reserved",
-        policyRevision: policy.revision,
-        reservation,
-      };
-    } catch (cause) {
-      if (
-        typeof cause?.code === "string" &&
-        cause.code.startsWith("SCHEDULER_AUTHORITY_")
-      ) {
-        return {
-          allowed: false,
-          reason: cause.code.toLowerCase(),
-          details: cause.details,
-        };
-      }
-      throw authorityError(
-        "SCHEDULER_AUTHORITY_RESOLUTION_FAILED",
-        "Scheduler permission and budget resolution failed closed",
-        undefined,
-        cause,
-      );
-    }
-  };
-}
+// Shared policy reservations; the CLI retains its public ESM entry.
+import authority from "@chainlesschain/session-core/scheduler-authority-resolver";
+export const {
+  DEFAULT_SCHEDULER_AUTHORITY_WINDOW_MS,
+  DEFAULT_SCHEDULER_AUTHORITY_MAX_RUNS,
+  DEFAULT_SCHEDULER_AUTHORITY_MAX_UNITS,
+  schedulerAuthorityPolicyReference,
+  parseSchedulerAuthorityPolicyReference,
+  bindSchedulerAuthorityPolicy,
+  checkSchedulerAuthorityPolicy,
+  createSchedulerAuthorityResolver,
+} = authority;