chainlesschain 0.162.124 → 0.162.126

package/src/runtime/headless-runner.js

@@ -50,6 +50,11 @@ import { mergeConsecutiveMessages } from "./message-roles.js";
 import { isHeadlessConfigCommand } from "../lib/headless-config-command.js";
 import { withQuietStdout } from "./quiet-stdout.js";
 import { CostBudget } from "../lib/cost-budget.js";
+import {
+  classifyDenial,
+  recordDenial,
+  formatDenials,
+} from "../lib/repl-denials.js";
 
 /** Tools that cannot mutate the filesystem or run commands. */
 export const READ_ONLY_TOOLS = Object.freeze([
@@ -69,6 +74,11 @@ const VALID_PERMISSION_MODES = Object.freeze([
 
 const VALID_OUTPUT_FORMATS = Object.freeze(["text", "json", "stream-json"]);
 
+// EPIPE guard for `cc agent -p … | head`. Lives in pipe-safety.js (shared with
+// the stream-json driver + REPL); re-exported here for existing importers.
+export { installPipeSafety } from "./pipe-safety.js";
+import { installPipeSafety } from "./pipe-safety.js";
+
 /**
  * Resolve a --permission-mode string into the session-policy tier + a
  * non-interactive confirmer + whether to clamp tools to the read-only set.
@@ -289,17 +299,46 @@ export async function runAgentHeadless(options = {}, deps = {}) {
   let settingsHooks = options.settingsHooks || null;
   if (!settingsHooks) {
     try {
-      const { loadHooks } = await import("../lib/settings-hooks.cjs");
+      const { loadHooks, projectHookTrustNotice } =
+        await import("../lib/settings-hooks.cjs");
       const loaded = loadHooks({ cwd, settingsFile: options.settingsFile });
       settingsHooks =
         loaded.hooks && Object.keys(loaded.hooks).length > 0
           ? loaded.hooks
           : null;
+      // First-run trust notice for an untrusted/cloned repo's shell-running
+      // hooks (Claude-Code 2.1.195 parity). Best-effort, stderr-only.
+      try {
+        const notice = projectHookTrustNotice({
+          cwd,
+          settingsFile: options.settingsFile,
+        });
+        if (notice) process.stderr.write(notice + "\n");
+      } catch {
+        /* trust notice is best-effort */
+      }
     } catch {
       settingsHooks = null; // fail-open
     }
   }
 
+  // autoMode.classifyAllShell (Claude-Code 2.1.193): route the built-in
+  // verification allowlist through the shell-policy classifier instead of
+  // fast-pathing it. Explicit option wins; otherwise read settings.json.
+  let classifyAllShell = options.classifyAllShell || false;
+  if (!classifyAllShell) {
+    try {
+      const { readBooleanSetting } = await import("../lib/settings-loader.cjs");
+      classifyAllShell =
+        readBooleanSetting("autoMode.classifyAllShell", {
+          cwd,
+          settingsFile: options.settingsFile,
+        }) === true;
+    } catch {
+      classifyAllShell = false; // fail-open
+    }
+  }
+
   const runLoop = deps.agentLoop || coreAgentLoop;
   const doBootstrap = deps.bootstrap || bootstrap;
   const getApprovalGate =
@@ -312,6 +351,12 @@ export async function runAgentHeadless(options = {}, deps = {}) {
   // trace so `cc agent -p ... > out.txt` keeps `out.txt` clean.
   const writeOut = deps.writeOut || ((s) => process.stdout.write(s));
   const writeErr = deps.writeErr || ((s) => process.stderr.write(s));
+  // Only when we own the real stdout/stderr (no injected seams = production,
+  // not tests): guard against a downstream `| head` closing the pipe, which
+  // would otherwise crash with an unhandled EPIPE. Idempotent across calls.
+  if (!deps.writeOut && !deps.writeErr) {
+    installPipeSafety();
+  }
   // Session persistence seam (file-based JSONL; DB-free, like the rest of
   // headless). Defaults to the real store; tests inject fakes.
   const store = {
@@ -667,6 +712,7 @@ export async function runAgentHeadless(options = {}, deps = {}) {
           strict: options.strictMcpConfig === true,
           ide: options.ide,
           pdh: options.pdh,
+          jetbrains: options.jetbrains,
           cwd: options.cwd || process.cwd(),
           // advertise the session id to spawned stdio MCP servers
           sessionId,
@@ -676,6 +722,7 @@ export async function runAgentHeadless(options = {}, deps = {}) {
           loadMcpConfig: deps.loadMcpConfig,
           loadRegisteredMcp: deps.loadRegisteredMcp,
           loadIdeMcp: deps.loadIdeMcp,
+          loadJetbrainsMcp: deps.loadJetbrainsMcp,
         },
       );
       if (mcp && isText) {
@@ -763,6 +810,7 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     approvalGate,
     permissionRules,
     settingsHooks,
+    classifyAllShell,
     enabledToolNames,
     disabledTools,
     iterationBudget: budget,
@@ -834,6 +882,10 @@ export async function runAgentHeadless(options = {}, deps = {}) {
 
   const startedAt = deps.now ? deps.now() : Date.now();
   const toolCalls = [];
+  // Policy denials (blocked tool calls) collected for an end-of-run summary,
+  // so a non-interactive run surfaces what got blocked the way the REPL's
+  // `/permissions denials` does (Claude-Code 2.1.193 denial reasons).
+  const denials = [];
   const usage = {
     input_tokens: 0,
     output_tokens: 0,
@@ -911,6 +963,26 @@ export async function runAgentHeadless(options = {}, deps = {}) {
           if (toolCalls.length > 0) {
             toolCalls[toolCalls.length - 1].is_error = Boolean(err);
           }
+          // Track policy denials (not plain tool failures) for the end-of-run
+          // summary. The preceding tool-executing pushed the args.
+          if (err) {
+            const last = toolCalls[toolCalls.length - 1];
+            const denial = classifyDenial({
+              tool: event.tool,
+              result: event.result,
+              error: event.error,
+              argsSummary:
+                last && last.tool === event.tool
+                  ? formatToolArgs(event.tool, last.args)
+                  : "",
+            });
+            if (denial) {
+              recordDenial(denials, {
+                ...denial,
+                at: deps.now ? deps.now() : Date.now(),
+              });
+            }
+          }
           break;
         }
         case "token-usage": {
@@ -1000,6 +1072,7 @@ export async function runAgentHeadless(options = {}, deps = {}) {
             usage,
             numTurns: budget.consumed,
             durationMs: (deps.now ? deps.now() : Date.now()) - startedAt,
+            denials,
           }),
         ) + "\n",
       );
@@ -1119,6 +1192,21 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     }
   }
 
+  // End-of-run policy-denial summary so a non-interactive run surfaces what was
+  // blocked (mirrors the REPL's `/permissions denials`). Text → stderr lines;
+  // stream → a `denials_summary` event before the final result.
+  if (denials.length) {
+    if (isText) {
+      writeErr(
+        `\n  ${denials.length} tool call(s) were denied by policy this run:\n` +
+          formatDenials(denials, { now: deps.now ? deps.now() : Date.now() }) +
+          "\n",
+      );
+    } else if (isStream) {
+      emitStream({ type: "denials_summary", count: denials.length, denials });
+    }
+  }
+
   if (isStream) {
     emitStream({
       type: "result",
@@ -1142,6 +1230,7 @@ export async function runAgentHeadless(options = {}, deps = {}) {
           usage,
           numTurns: budget.consumed,
           durationMs,
+          denials,
         }),
       ) + "\n",
     );
@@ -1162,8 +1251,9 @@ function buildResultEnvelope({
   usage,
   numTurns,
   durationMs,
+  denials,
 }) {
-  return {
+  const env = {
     type: "result",
     subtype,
     is_error: isError,
@@ -1174,4 +1264,8 @@ function buildResultEnvelope({
     tool_calls: toolCalls,
     usage,
   };
+  // Only present when something was blocked — keeps the no-denial envelope
+  // byte-identical to before (Claude-Code 2.1.193 denial reasons, json mode).
+  if (Array.isArray(denials) && denials.length) env.denials = denials;
+  return env;
 }

package/src/runtime/headless-stream.js

@@ -35,6 +35,7 @@ import {
   resolvePermissionMode,
   resolveEnabledTools,
   parseToolList,
+  installPipeSafety,
 } from "./headless-runner.js";
 import {
   startSession as jsonlStartSession,
@@ -317,9 +318,26 @@ export function sanitizeLlmHint(raw) {
 /**
  * Yield NDJSON lines from a byte/string stream (stdin). Splits on "\n" and
  * flushes any trailing partial line when the stream ends.
+ *
+ * A single line with no terminating "\n" must never accumulate without bound:
+ * a stuck / garbage producer (or a runaway multi-MB inline payload) that never
+ * emits a newline would otherwise grow `buf` unbounded and OOM this long-lived
+ * stream process. When a line exceeds the cap, a short head is yielded (so the
+ * caller surfaces it as an invalid-JSON error rather than dropping it silently)
+ * and the rest of that monster line is discarded until its newline — the stream
+ * resyncs cleanly to the next well-formed line. Cap precedence:
+ * `opts.maxLineLength` > `CC_MAX_INPUT_LINE_BYTES` env > 16 MB default.
  */
-export async function* readJsonLines(input) {
+export async function* readJsonLines(input, opts = {}) {
+  const envCap = Number(process.env.CC_MAX_INPUT_LINE_BYTES);
+  const maxLineLength =
+    Number.isFinite(opts.maxLineLength) && opts.maxLineLength > 0
+      ? opts.maxLineLength
+      : Number.isFinite(envCap) && envCap > 0
+        ? envCap
+        : 16 * 1024 * 1024;
   let buf = "";
+  let overflow = false; // discarding the tail of an over-long line until its \n
   // Reuse ONE streaming decoder across chunks so a multi-byte UTF-8 character
   // (e.g. a 3-byte Chinese char) split across two Buffer chunks is reassembled
   // rather than corrupted. process.stdin yields Buffers with no setEncoding, so
@@ -331,14 +349,34 @@ export async function* readJsonLines(input) {
       typeof chunk === "string"
         ? chunk
         : decoder.decode(chunk, { stream: true });
+    // Still skipping past an over-long line: drop everything up to (and
+    // including) the next newline, then resume normal line parsing. While no
+    // newline has arrived, keep `buf` empty so we don't re-grow it.
+    if (overflow) {
+      const nl = buf.indexOf("\n");
+      if (nl < 0) {
+        buf = "";
+        continue;
+      }
+      buf = buf.slice(nl + 1);
+      overflow = false;
+    }
     let idx;
     while ((idx = buf.indexOf("\n")) >= 0) {
       yield buf.slice(0, idx);
       buf = buf.slice(idx + 1);
     }
+    // No newline in the remaining buffer and it has blown past the cap — this is
+    // a pathological unterminated line. Yield a short head (an invalid-JSON
+    // error for the caller) and discard the rest until the next newline.
+    if (buf.length > maxLineLength) {
+      yield buf.slice(0, 200);
+      buf = "";
+      overflow = true;
+    }
   }
   buf += decoder.decode(); // flush any bytes held from a final partial char
-  if (buf.trim()) yield buf;
+  if (!overflow && buf.trim()) yield buf;
 }
 
 /**
@@ -496,23 +534,57 @@ export async function runAgentHeadlessStream(options = {}, deps = {}) {
   let settingsHooks = options.settingsHooks || null;
   if (!settingsHooks) {
     try {
-      const { loadHooks } = await import("../lib/settings-hooks.cjs");
+      const { loadHooks, projectHookTrustNotice } =
+        await import("../lib/settings-hooks.cjs");
       const loaded = loadHooks({ cwd, settingsFile: options.settingsFile });
       settingsHooks =
         loaded.hooks && Object.keys(loaded.hooks).length > 0
           ? loaded.hooks
           : null;
+      // First-run trust notice for an untrusted/cloned repo's shell-running
+      // hooks (Claude-Code 2.1.195 parity). stderr keeps the NDJSON stdout clean.
+      try {
+        const notice = projectHookTrustNotice({
+          cwd,
+          settingsFile: options.settingsFile,
+        });
+        if (notice) process.stderr.write(notice + "\n");
+      } catch {
+        /* trust notice is best-effort */
+      }
     } catch {
       settingsHooks = null; // fail-open
     }
   }
 
+  // autoMode.classifyAllShell (Claude-Code 2.1.193): classify the built-in
+  // verification allowlist through the shell-policy instead of fast-pathing it.
+  let classifyAllShell = options.classifyAllShell || false;
+  if (!classifyAllShell) {
+    try {
+      const { readBooleanSetting } = await import("../lib/settings-loader.cjs");
+      classifyAllShell =
+        readBooleanSetting("autoMode.classifyAllShell", {
+          cwd,
+          settingsFile: options.settingsFile,
+        }) === true;
+    } catch {
+      classifyAllShell = false; // fail-open
+    }
+  }
+
   const input = deps.input || process.stdin;
   const runLoop = deps.agentLoop || coreAgentLoop;
   const doBootstrap = deps.bootstrap || bootstrap;
   const doExpand = deps.expandFileRefs || expandFileRefsAsync;
   const writeOut = deps.writeOut || ((s) => process.stdout.write(s));
   const writeErr = deps.writeErr || ((s) => process.stderr.write(s));
+  // Guard the real stdout/stderr against a downstream `| head` closing the pipe
+  // (unhandled async EPIPE → crash). Only when we own the streams (no injected
+  // seams = production, not tests). Idempotent; shared with the -p runner.
+  if (!deps.writeOut && !deps.writeErr) {
+    installPipeSafety();
+  }
   // Batch consecutive partial-message text/thinking deltas into one stream_event
   // line (Claude-Code 2.1.191 streaming-CPU optimization). `emit` flushes any
   // pending deltas before writing a non-delta line, so ordering is preserved;
@@ -832,6 +904,7 @@ export async function runAgentHeadlessStream(options = {}, deps = {}) {
           strict: options.strictMcpConfig === true,
           ide: options.ide,
           pdh: options.pdh,
+          jetbrains: options.jetbrains,
           cwd: options.cwd || process.cwd(),
           // advertise the session id to spawned stdio MCP servers
           sessionId,
@@ -841,6 +914,7 @@ export async function runAgentHeadlessStream(options = {}, deps = {}) {
           loadMcpConfig: deps.loadMcpConfig,
           loadRegisteredMcp: deps.loadRegisteredMcp,
           loadIdeMcp: deps.loadIdeMcp,
+          loadJetbrainsMcp: deps.loadJetbrainsMcp,
         },
       );
     } catch (err) {
@@ -905,6 +979,7 @@ export async function runAgentHeadlessStream(options = {}, deps = {}) {
     approvalGate,
     permissionRules,
     settingsHooks,
+    classifyAllShell,
     enabledToolNames,
     disabledTools,
     // --interactive-approvals: settings/hook `ask` (and, with an IDE bridge,

package/src/runtime/mcp-config.js

@@ -28,6 +28,11 @@ import {
   pdhServerToMcpConfig,
   isInPdhTerminal,
 } from "../lib/pdh-bridge.js";
+import {
+  discoverJetbrainsServer,
+  jetbrainsServerToMcpConfig,
+  isInJetbrainsContext,
+} from "../lib/jetbrains-bridge.js";
 
 /**
  * Normalize a parsed config object into a `{ name: serverConfig }` map.
@@ -60,6 +65,22 @@ export function mcpToolName(server, tool) {
   return `mcp__${server}__${tool}`;
 }
 
+/**
+ * Case-insensitive "does this header map already carry `name`?". HTTP header
+ * names are case-insensitive, so a caller-supplied `AUTHORIZATION` must count
+ * the same as `Authorization` — otherwise the OAuth-injection guard below would
+ * not see it and would add a SECOND, conflicting auth header, leaking our
+ * stored token where the user explicitly pinned their own credential.
+ */
+export function hasHeaderInsensitive(headers, name) {
+  if (!headers || typeof headers !== "object") return false;
+  const want = String(name).toLowerCase();
+  for (const k of Object.keys(headers)) {
+    if (k.toLowerCase() === want) return true;
+  }
+  return false;
+}
+
 /**
  * When an MCP connect fails with an authentication error (HTTP 401/403, or an
  * explicit Unauthorized/Forbidden) on a URL-based server, return an actionable
@@ -138,7 +159,7 @@ export async function setupMcpFromConfig(servers, deps = {}) {
     // unless the config already supplies an Authorization header. Best-effort:
     // no token / a refresh failure just connects unauthenticated.
     let connectCfg = cfg;
-    if (cfg.url && !cfg.headers?.Authorization && !cfg.headers?.authorization) {
+    if (cfg.url && !hasHeaderInsensitive(cfg.headers, "Authorization")) {
       try {
         const { ensureValidToken } = await import("../lib/mcp-oauth.js");
         const token = await ensureValidToken(cfg.url);
@@ -147,6 +168,31 @@ export async function setupMcpFromConfig(servers, deps = {}) {
             ...cfg,
             headers: { ...cfg.headers, Authorization: `Bearer ${token}` },
           };
+          // Auto-recover from a mid-session 401/403 (server-side token rotation
+          // / revocation while the locally-stored copy still looks unexpired):
+          // register a reconnector that force-refreshes the bearer, so the
+          // mcp-client's callTool retry path reconnects and re-runs the call
+          // once with a fresh token (Claude-Code 2.1.193: "MCP auth re-runs and
+          // reconnects automatically on 401/403"). Best-effort, and skipped for
+          // a server whose config carries its own Authorization header (handled
+          // by the guard above) — an explicit IDE-bridge reconnector registered
+          // after setup still wins on any name clash.
+          if (typeof mcpClient.setReconnector === "function") {
+            const baseCfg = cfg;
+            mcpClient.setReconnector(name, async () => {
+              const { ensureValidToken: reauth } =
+                await import("../lib/mcp-oauth.js");
+              const fresh = await reauth(baseCfg.url, { forceRefresh: true });
+              if (!fresh) return null;
+              return {
+                ...baseCfg,
+                headers: {
+                  ...baseCfg.headers,
+                  Authorization: `Bearer ${fresh}`,
+                },
+              };
+            });
+          }
         }
       } catch {
         // OAuth wiring is best-effort
@@ -463,6 +509,47 @@ export async function loadPdhMcp(opts = {}, deps = {}) {
   return out;
 }
 
+/**
+ * Connect IntelliJ IDEA's built-in MCP server (IDEA >= 2025.2) as the reserved
+ * server `idea` -> tools `mcp__idea__*`. The ChainlessChain JetBrains plugin
+ * injects the exact endpoint (CHAINLESSCHAIN_JETBRAINS_MCP_URL + optional
+ * _TOKEN) into the cc it spawns ONLY when the IDE actually supports + enables
+ * MCP; absent that, this is a no-op (we never scan/guess/spawn a proxy — if
+ * the IDE's MCP is unsupported, we don't connect). Best-effort: returns
+ * `deps.into` (or null) on nothing found / bad config, never throws. An explicit
+ * user registration of a server named `idea` wins (yield + one-line warning).
+ *
+ * @param {object} opts  { env? }
+ * @param {object} [deps] { writeErr, into, discoverJetbrainsServer, jetbrainsServerToMcpConfig }
+ */
+export async function loadJetbrainsMcp(opts = {}, deps = {}) {
+  const discover = deps.discoverJetbrainsServer || discoverJetbrainsServer;
+  const toCfg = deps.jetbrainsServerToMcpConfig || jetbrainsServerToMcpConfig;
+  const found = discover({ env: opts.env });
+  if (!found) return deps.into || null;
+  if (deps.into?.mcpClient?.servers?.has?.("idea")) {
+    (deps.writeErr || (() => {}))(
+      `  idea: server "idea" already registered explicitly — ` +
+        `skipping IDEA built-in MCP auto-connect\n`,
+    );
+    return deps.into;
+  }
+  const cfg = toCfg(found);
+  if (!cfg) return deps.into || null;
+  const out = await setupMcpFromConfig({ idea: cfg }, deps);
+  // Hot reconnect: re-read the injected env on a failed mcp__idea__* call (the
+  // IDE may have restarted its MCP server on a new port/token, and the plugin
+  // re-injects a fresh CHAINLESSCHAIN_JETBRAINS_MCP_URL into the next spawn —
+  // though within one run the env is fixed, so this just re-validates it).
+  if (out?.mcpClient?.setReconnector) {
+    out.mcpClient.setReconnector("idea", () => {
+      const fresh = discover({ env: opts.env });
+      return fresh ? toCfg(fresh) : null;
+    });
+  }
+  return out;
+}
+
 /**
  * Discover + connect a project-scoped `.mcp.json` (Claude-Code parity). Reads a
  * `.mcp.json` from the git project root (walked up from cwd, same as the
@@ -534,10 +621,13 @@ export async function loadProjectMcp(opts = {}, deps = {}) {
  * there's nothing. Throws only on a bad `--mcp-config` file (explicit request).
  *
  * IDE discovery: default ON only inside an IDE integrated terminal; `ide:true`
- * (`--ide`) forces it; `ide:false` (`--no-ide`) disables it.
+ * (`--ide`) forces it; `ide:false` (`--no-ide`) disables it. IDEA built-in MCP
+ * (reserved `idea`): default ON only when the JetBrains plugin injected
+ * `CHAINLESSCHAIN_JETBRAINS_MCP_URL`; `jetbrains:true` (`--jetbrains`) forces;
+ * `jetbrains:false` (`--no-jetbrains`) disables.
  *
- * @param {object} args { mcpConfigPath?, db?, includeRegistered=true, allRegistered=false, ide?, pdh?, cwd?, env? }
- * @param {object} [deps] { writeErr, loadMcpConfig, loadRegisteredMcp, loadIdeMcp, loadPdhMcp, isInIdeTerminal, isInPdhTerminal }
+ * @param {object} args { mcpConfigPath?, db?, includeRegistered=true, allRegistered=false, ide?, pdh?, jetbrains?, cwd?, env? }
+ * @param {object} [deps] { writeErr, loadMcpConfig, loadRegisteredMcp, loadIdeMcp, loadPdhMcp, loadJetbrainsMcp, isInIdeTerminal, isInPdhTerminal, isInJetbrainsContext }
  */
 export async function resolveAgentMcp(args = {}, deps = {}) {
   const doFile = deps.loadMcpConfig || loadMcpConfig;
@@ -545,6 +635,7 @@ export async function resolveAgentMcp(args = {}, deps = {}) {
   const doProject = deps.loadProjectMcp || loadProjectMcp;
   const doIde = deps.loadIdeMcp || loadIdeMcp;
   const doPdh = deps.loadPdhMcp || loadPdhMcp;
+  const doJetbrains = deps.loadJetbrainsMcp || loadJetbrainsMcp;
   // Thread the agent session id down to setupMcpFromConfig so spawned stdio MCP
   // servers get CC_SESSION_ID / CLAUDE_CODE_SESSION_ID (Claude-Code parity).
   const fwd =
@@ -601,6 +692,25 @@ export async function resolveAgentMcp(args = {}, deps = {}) {
       );
     }
   }
+  // IntelliJ IDEA built-in MCP (IDEA >= 2025.2), reserved name `idea` ->
+  // mcp__idea__*. Scoped to the JetBrains plugin context: the plugin injects
+  // CHAINLESSCHAIN_JETBRAINS_MCP_URL only when the IDE supports + enables MCP,
+  // so default-ON is gated on that env being present (isInJetbrainsContext).
+  // `jetbrains:true` (--jetbrains) forces the attempt; `jetbrains:false`
+  // (--no-jetbrains) disables it. No URL = no connect (unsupported IDE).
+  // Skipped under --strict-mcp-config (returned above).
+  if (args.jetbrains !== false) {
+    const env = args.env || process.env;
+    const inJetbrains = (deps.isInJetbrainsContext || isInJetbrainsContext)(
+      env,
+    );
+    if (args.jetbrains === true || inJetbrains) {
+      result = await doJetbrains(
+        { env },
+        { ...fwd, into: result || undefined },
+      );
+    }
+  }
   return result;
 }
 

package/src/runtime/message-roles.js

@@ -64,6 +64,17 @@ function joinContent(a, b) {
  */
 const MERGEABLE_ROLES = new Set(["user", "assistant"]);
 
+/**
+ * Does this message carry tool calls? An assistant turn with `tool_calls` is a
+ * STRUCTURED turn whose calls must stay paired with their `tool` results —
+ * folding it loses one side's tool_calls (orphaning results / unanswered calls)
+ * and the strict-API 400s. Such turns are never merged (left to alternate; the
+ * tool-pair fix lives in sanitizeToolPairs, not here).
+ */
+function hasToolCalls(msg) {
+  return Array.isArray(msg && msg.tool_calls) && msg.tool_calls.length > 0;
+}
+
 /**
  * Merge consecutive same-role messages so the conversation alternates roles for
  * the provider. Only `user`/`assistant` turns fold; `tool` and `system` turns
@@ -85,7 +96,9 @@ export function mergeConsecutiveMessages(messages) {
       msg &&
       typeof msg.role === "string" &&
       MERGEABLE_ROLES.has(msg.role) &&
-      prev.role === msg.role
+      prev.role === msg.role &&
+      !hasToolCalls(prev) && // never fold a structured tool-call turn — merging
+      !hasToolCalls(msg) //     drops one side's tool_calls and breaks pairing
     ) {
       out[out.length - 1] = {
         ...prev,

package/src/runtime/pipe-safety.js

@@ -0,0 +1,51 @@
+/**
+ * pipe-safety — shared EPIPE guard for cc's stdout/stderr writers.
+ *
+ * A downstream consumer that closes the pipe (e.g. `cc agent -p … | head`)
+ * makes the next write fail ASYNCHRONOUSLY via the stream's `error` event,
+ * which the try/catch around a write call cannot catch. With no `error`
+ * listener that is an unhandled EPIPE → the process crashes with a stack trace
+ * instead of stopping cleanly. `installPipeSafety` adds an idempotent listener
+ * that treats EPIPE as "consumer done" (the Unix pipeline convention) and
+ * surfaces other stream errors best-effort.
+ *
+ * Used by the headless `-p` runner, the stream-json driver, and the REPL.
+ */
+
+// Global-registry symbol so the guard is installed at most once per stream even
+// across the modules that share it.
+const _PIPE_SAFE = Symbol.for("cc.headless.pipeSafe");
+
+/**
+ * Install an EPIPE-safe `error` listener on the given write streams (default:
+ * process.stdout + process.stderr). Idempotent. `onEpipe` defaults to a clean
+ * `process.exit(0)`; the REPL passes a graceful-shutdown callback instead.
+ *
+ * @param {Array<NodeJS.WriteStream>} [streams]
+ * @param {() => void} [onEpipe]
+ */
+export function installPipeSafety(streams, onEpipe) {
+  const targets = streams || [process.stdout, process.stderr];
+  const handleEpipe = onEpipe || (() => process.exit(0));
+  for (const stream of targets) {
+    if (!stream || typeof stream.on !== "function" || stream[_PIPE_SAFE]) {
+      continue;
+    }
+    stream[_PIPE_SAFE] = true;
+    stream.on("error", (err) => {
+      if (err && err.code === "EPIPE") {
+        handleEpipe();
+        return;
+      }
+      // Non-EPIPE stream error: surface best-effort (never onto the stream that
+      // just errored, to avoid a loop) and otherwise swallow.
+      try {
+        if (stream !== process.stderr) {
+          process.stderr.write(`stream error: ${err?.message || err}\n`);
+        }
+      } catch {
+        /* nothing more we can do */
+      }
+    });
+  }
+}

package/src/runtime/policies/agent-policy.js

@@ -38,6 +38,9 @@ export function resolveAgentPolicy({
     // IDE bridge tri-state (undefined=auto / true=--ide / false=--no-ide); the
     // REPL forwards it to resolveAgentMcp so --ide/--no-ide work interactively.
     ide: overrides.ide,
+    // IDEA built-in MCP tri-state (undefined=auto when the JetBrains plugin
+    // injected the endpoint / true=--jetbrains / false=--no-jetbrains).
+    jetbrains: overrides.jetbrains,
   };
 }