chainlesschain 0.162.125 → 0.162.127

package/src/lib/chat-intent-service.js

@@ -22,6 +22,40 @@ import { firstBalancedJson } from "./json-schema-output.js";
 
 const DEFAULT_INTENT_TIMEOUT_MS = 15000;
 
+/**
+ * Resolve the per-call intent-classification budget. `llmOptions.intentTimeoutMs`
+ * overrides the default; an explicit 0 disables the cap; NaN/negative/absent →
+ * default.
+ */
+function resolveIntentTimeout(llmOptions) {
+  const raw = llmOptions?.intentTimeoutMs;
+  if (raw === 0) return 0; // explicit disable
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : DEFAULT_INTENT_TIMEOUT_MS;
+}
+
+/**
+ * Bound an LLM call to the intent budget. chat-core has its OWN stall guard, but
+ * it only fires on SILENCE (no bytes for 180s) — a slow trickling stream never
+ * trips it, so without this the declared 15s intent budget was never enforced
+ * and classification could block for minutes. Racing the deadline makes it fail
+ * fast into the caller's graceful rule/verbatim fallback. `ms <= 0` disables.
+ * The losing background request is harmless (chat-core releases its own socket);
+ * the timer is unref'd so it never holds the process open.
+ */
+function withIntentTimeout(promise, ms) {
+  if (!(Number(ms) > 0)) return promise;
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(
+      () => reject(new Error(`intent LLM call timed out after ${ms}ms`)),
+      Number(ms),
+    );
+    if (timer && typeof timer.unref === "function") timer.unref();
+  });
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+
 /**
  * Build the V5 understandIntent system + user prompt pair.
  *
@@ -123,17 +157,20 @@ export async function understandIntent({
   );
 
   try {
-    const fullContent = await chatWithStreaming(
-      [
-        { role: "system", content: systemPrompt },
-        { role: "user", content: userPrompt },
-      ],
-      {
-        ...llmOptions,
-        // Lower temperature → more deterministic JSON output.
-        temperature: 0.3,
-        maxTokens: 500,
-      },
+    const fullContent = await withIntentTimeout(
+      chatWithStreaming(
+        [
+          { role: "system", content: systemPrompt },
+          { role: "user", content: userPrompt },
+        ],
+        {
+          ...llmOptions,
+          // Lower temperature → more deterministic JSON output.
+          temperature: 0.3,
+          maxTokens: 500,
+        },
+      ),
+      resolveIntentTimeout(llmOptions),
     );
 
     const jsonText = extractJson(fullContent);
@@ -204,6 +241,11 @@ export async function* understandIntentStream({
   );
   let buffer = "";
   try {
+    // Incremental token yielding makes a per-call deadline awkward to apply
+    // here; this streaming variant is instead bounded by chat-core's own
+    // silence-based stall guard (CC_CHAT_STALL_MS, default 180s). The awaited
+    // understandIntent / classifyFollowupIntent paths enforce the tighter
+    // intent budget (resolveIntentTimeout) directly.
     for await (const event of chatStream(
       [
         { role: "system", content: systemPrompt },
@@ -452,16 +494,19 @@ ${
 
 async function llmBasedClassify(userInput, context, llmOptions) {
   const { systemPrompt, userPrompt } = buildFollowupPrompts(userInput, context);
-  const fullContent = await chatWithStreaming(
-    [
-      { role: "system", content: systemPrompt },
-      { role: "user", content: userPrompt },
-    ],
-    {
-      ...llmOptions,
-      temperature: 0.1,
-      maxTokens: 300,
-    },
+  const fullContent = await withIntentTimeout(
+    chatWithStreaming(
+      [
+        { role: "system", content: systemPrompt },
+        { role: "user", content: userPrompt },
+      ],
+      {
+        ...llmOptions,
+        temperature: 0.1,
+        maxTokens: 300,
+      },
+    ),
+    resolveIntentTimeout(llmOptions),
   );
   const jsonText = extractJson(fullContent);
   if (!jsonText) throw new Error("LLM response missing JSON");
@@ -540,5 +585,7 @@ export const _internal = {
   buildFollowupPrompts,
   extractJson,
   ruleBasedClassify,
+  resolveIntentTimeout,
+  withIntentTimeout,
   DEFAULT_INTENT_TIMEOUT_MS,
 };

package/src/lib/config-manager.js

@@ -11,6 +11,16 @@ import { getConfigPath } from "./paths.js";
 import { DEFAULT_CONFIG } from "../constants.js";
 import { withFileLock } from "./with-file-lock.js";
 
+// Warn at most once per config path per process. Injectable seam: the default
+// stays silent under vitest so test output isn't polluted; tests override
+// `_deps.warn` to assert it fired.
+const _warnedConfigPaths = new Set();
+export const _deps = {
+  warn: (msg) => {
+    if (!process.env.VITEST) process.stderr.write(msg);
+  },
+};
+
 export function loadConfig() {
   const configPath = getConfigPath();
   if (!existsSync(configPath)) {
@@ -20,7 +30,21 @@ export function loadConfig() {
     const raw = readFileSync(configPath, "utf-8");
     const parsed = JSON.parse(raw);
     return deepMerge(structuredClone(DEFAULT_CONFIG), parsed);
-  } catch {
+  } catch (err) {
+    // The file EXISTS but couldn't be read/parsed (a typo, trailing comma, or
+    // truncated write). Silently returning defaults drops the user's entire
+    // config — provider, model, baseUrl, API key — and falls back to the
+    // default provider, producing a baffling "configured X but it runs Y / says
+    // no API key". Warn once so the failure is visible; still fall back so cc
+    // keeps working.
+    if (!_warnedConfigPaths.has(configPath)) {
+      _warnedConfigPaths.add(configPath);
+      _deps.warn(
+        `⚠️  Could not read config at ${configPath} (${err.message}). ` +
+          `Using defaults — your saved settings (provider / model / API key) are being IGNORED. ` +
+          `Fix the JSON to restore them.\n`,
+      );
+    }
     return { ...structuredClone(DEFAULT_CONFIG) };
   }
 }

package/src/lib/credential-guard.js

@@ -149,7 +149,10 @@ export function credentialFileReasonResolved(targetPath, opts = {}) {
 // ── secret ENV-VAR + command detection ──────────────────────────────────────
 
 // Content-reader commands: when one of these is aimed at a credential file, the
-// file's bytes land in the agent's tool output.
+// file's bytes land in the agent's tool output. Includes text processors
+// (awk/sed), encoders (base64), and field/byte slicers — all of which dump a
+// file's content just like `cat`, so an agent told to "read the .env" can't
+// route around the guard with `base64 .env` / `awk '{print}' .env`.
 const READ_COMMANDS = new Set([
   "cat",
   "tac",
@@ -165,8 +168,31 @@ const READ_COMMANDS = new Set([
   "xxd",
   "od",
   "strings",
+  "awk",
+  "gawk",
+  "mawk",
+  "sed",
+  "base64",
+  "base32",
+  "cut",
+  "rev",
+  "sort",
+  "uniq",
+  "tr",
+  "fold",
+  "expand",
+  "unexpand",
+  "column",
+  "paste",
+  "pr",
 ]);
 
+// grep-family is a content-reader too, but its FIRST non-flag arg is the search
+// PATTERN (which may itself look credential-ish, e.g. `grep "id_rsa" notes.txt`)
+// — so it is handled separately, checking only the FILE args after the pattern,
+// to keep the guard precise (no false positive on the pattern).
+const GREP_COMMANDS = new Set(["grep", "egrep", "fgrep", "rg", "ag"]);
+
 // Commands whose job is to print a value into output — the exfil surface for a
 // secret env var (a tool that merely CONSUMES `$API_KEY` does not echo it).
 const PRINT_COMMANDS = new Set([
@@ -281,6 +307,22 @@ export function commandReadsCredentials(command) {
       }
     }
 
+    // (b2) grep-family: skip the search pattern (first non-flag arg) and check
+    //      only the file args, so `grep KEY .env` is caught but `grep "id_rsa"
+    //      notes.txt` (searching FOR that text) is not a false positive.
+    if (GREP_COMMANDS.has(first)) {
+      for (const tok of nonFlagArgs.slice(1)) {
+        const r = credentialFileReason(tok);
+        if (r)
+          return {
+            reason: `reads ${r}`,
+            kind: "file",
+            target: tok,
+            segment: seg,
+          };
+      }
+    }
+
     // (c) printing / reading a secret-looking env var (via $VAR / %VAR% / env:).
     if (PRINT_COMMANDS.has(first) || READ_COMMANDS.has(first)) {
       const vars = referencedSecretVars(seg);

package/src/lib/git-integration.js

@@ -105,6 +105,11 @@ export function gitExec(args, cwd) {
     return execSync(`git ${args}`, {
       cwd,
       encoding: "utf-8",
+      // git diff/log/worktree-list output on a large repo easily exceeds
+      // execSync's 1 MB default → ENOBUFS. Match gitExecArgs' 64 MB ceiling so
+      // a big diff/log doesn't spuriously fail (e.g. worktree-diff's --numstat
+      // pass, which isn't wrapped in a degrade-gracefully try/catch).
+      maxBuffer: 64 * 1024 * 1024,
       stdio: ["pipe", "pipe", "pipe"],
     }).trim();
   } catch (err) {

package/src/lib/interaction-adapter.js

@@ -159,7 +159,15 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
         },
         options.timeoutMs || 5 * 60 * 1000,
       );
-      this._pending.set(requestId, { resolve, reject, timeoutId });
+      // `kind` tags what KIND of response settles this request ("question" vs
+      // "host-tool"). Checked in _resolvePending so a peer's session-answer can
+      // never resolve a host-tool call with a plain string (or vice versa).
+      this._pending.set(requestId, {
+        resolve,
+        reject,
+        timeoutId,
+        kind: options.kind || null,
+      });
 
       this._sendWs({
         ...message,
@@ -170,12 +178,15 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
   }
 
   _ask(questionType, question, extra = {}) {
-    return this._request({
-      type: "question",
-      questionType,
-      question,
-      ...extra,
-    });
+    return this._request(
+      {
+        type: "question",
+        questionType,
+        question,
+        ...extra,
+      },
+      { kind: "question" },
+    );
   }
 
   async askInput(question, options = {}) {
@@ -200,7 +211,7 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
    * Resolves the corresponding pending promise.
    */
   resolveAnswer(requestId, answer) {
-    this._resolvePending(requestId, answer);
+    this._resolvePending(requestId, answer, "question");
   }
 
   async requestHostTool(toolName, args = {}, extra = {}) {
@@ -211,12 +222,12 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
         args,
         ...extra,
       },
-      { timeoutMs: extra.timeoutMs || 60 * 1000 },
+      { timeoutMs: extra.timeoutMs || 60 * 1000, kind: "host-tool" },
     );
   }
 
   resolveHostTool(requestId, payload) {
-    this._resolvePending(requestId, payload);
+    this._resolvePending(requestId, payload, "host-tool");
   }
 
   rejectAllPending(reason = createAbortError("Interaction interrupted")) {
@@ -310,11 +321,21 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
     }
   }
 
-  _resolvePending(requestId, payload) {
+  _resolvePending(requestId, payload, expectedKind = null) {
     const pending = this._pending.get(requestId);
     if (!pending) {
       return;
     }
+    // Kind guard: a question-answer must not settle a host-tool request (or
+    // vice versa). On a mismatch, IGNORE the message — leave the request pending
+    // so its correct resolver (or its timeout) can still settle it. Prevents a
+    // peer from resolving a host-tool call with a plain question string, or a
+    // question with a structured tool payload (type confusion of the awaited
+    // value). Backward-compatible: callers passing no expectedKind, and
+    // pre-kind pending entries, behave exactly as before.
+    if (expectedKind && pending.kind && pending.kind !== expectedKind) {
+      return;
+    }
 
     this._pending.delete(requestId);
     if (pending.timeoutId) {

package/src/lib/jsonl-session-store.js

@@ -32,4 +32,5 @@ export {
   sessionPath,
   isUnsafeSessionId,
   appendTokenUsage,
+  toIsoSafe,
 } from "../harness/jsonl-session-store.js";

package/src/lib/llm-config-defaults.js

@@ -17,6 +17,43 @@
  *    lesson as the --settings "opus"→404 vision trap.
  *  - No configured provider → unchanged (runner defaults apply: ollama).
  */
+/**
+ * Reconcile a MISLABELED llm config/options object. The `baseUrl` is the
+ * authoritative signal of which provider you actually reach, so when `provider`
+ * disagrees with the provider its `baseUrl` belongs to, the config is simply
+ * mislabeled — the recurring "provider:anthropic + volces baseUrl + model:haiku"
+ * corruption that makes runnable-provider relabel (and emit "provider 配置与
+ * baseUrl 不一致") on EVERY run because the on-disk config never gets fixed.
+ *
+ * Correct `provider` to match the endpoint, and if the model is foreign to the
+ * corrected provider, replace it with that provider's default. Pure: the input
+ * is never mutated — returns `{ llm, changed }` where `llm` is the original
+ * object (changed:false) or a corrected shallow copy (changed:true). Works for
+ * both a `config.llm` block and a resolved request-`options` (same shape).
+ *
+ * `inferProviderFromBaseUrl` returns null for unknown/custom hosts (proxies),
+ * so an intentionally-custom endpoint is left untouched.
+ */
+export async function reconcileConfigLlmProvider(cfgLlm = {}) {
+  if (!cfgLlm || !cfgLlm.provider || !cfgLlm.baseUrl) {
+    return { llm: cfgLlm, changed: false };
+  }
+  const { inferProviderFromBaseUrl, modelForeignToProvider } =
+    await import("./runnable-provider.js");
+  const inferred = inferProviderFromBaseUrl(cfgLlm.baseUrl);
+  if (!inferred || inferred === cfgLlm.provider) {
+    return { llm: cfgLlm, changed: false };
+  }
+  const corrected = { ...cfgLlm, provider: inferred };
+  if (modelForeignToProvider(inferred, cfgLlm.model)) {
+    const { selectModelForTask, TaskType } =
+      await import("./task-model-selector.js");
+    const def = selectModelForTask(inferred, TaskType.CHAT);
+    if (def) corrected.model = def;
+  }
+  return { llm: corrected, changed: true };
+}
+
 export function applyConfigLlmDefaults(options = {}, cfgLlm = {}, opts = {}) {
   // The IDE chat panel pins --provider/--model (read from config) but DROPS
   // --base-url/--api-key. With an explicit --provider the block below bails, so

package/src/lib/mcp-oauth.js

@@ -38,6 +38,10 @@ export const _deps = {
   now: () => Date.now(),
   // Backoff sleep seam (tests override with a no-op so the retry doesn't wait).
   sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  // Visible-warning seam (silent under vitest; tests override to assert).
+  warn: (msg) => {
+    if (!process.env.VITEST) process.stderr.write(msg);
+  },
 };
 
 /** Discovery/token requests retry ONCE after a transient error (CC 2.1.191). */
@@ -371,17 +375,56 @@ export function tokenStorePath() {
   return pathDefault.join(_deps.homedir(), ".chainlesschain", "mcp-oauth.json");
 }
 
-export function loadTokenStore() {
-  const file = tokenStorePath();
+/**
+ * Read the token store, distinguishing "absent / empty" (ok) from "exists but
+ * unreadable / corrupt" (ok:false). The distinction matters on the WRITE path:
+ * a read-modify-write that treats an unreadable store as `{}` would overwrite
+ * and silently destroy every other server's token.
+ */
+function _readStore(file) {
+  if (!_deps.fs.existsSync(file)) return { ok: true, store: {} };
   try {
-    if (!_deps.fs.existsSync(file)) return {};
     const data = JSON.parse(_deps.fs.readFileSync(file, "utf-8"));
-    return data && typeof data === "object" ? data : {};
+    return { ok: true, store: data && typeof data === "object" ? data : {} };
+  } catch (err) {
+    return { ok: false, store: {}, err };
+  }
+}
+
+const _warnedCorruptStore = new Set();
+function _warnCorruptStoreOnce(file, err, archived) {
+  if (_warnedCorruptStore.has(file)) return;
+  _warnedCorruptStore.add(file);
+  _deps.warn(
+    `⚠️  MCP OAuth token store at ${file} is unreadable (${err?.message || "parse error"}). ` +
+      `Saved MCP logins are unavailable${archived ? `; the unreadable file was preserved as ${archived}` : ""} — ` +
+      "re-run `cc mcp login <url>` for the servers you use.\n",
+  );
+}
+
+/** Move an unreadable store aside so a fresh write doesn't destroy it. Returns
+ *  the archive path, or "" when it couldn't be moved (best-effort). */
+function _archiveCorruptStore(file) {
+  if (typeof _deps.fs.renameSync !== "function") return "";
+  const ts = typeof _deps.now === "function" ? _deps.now() : Date.now();
+  const dest = `${file}.corrupt-${ts}`;
+  try {
+    _deps.fs.renameSync(file, dest);
+    return dest;
   } catch {
-    return {};
+    return "";
   }
 }
 
+export function loadTokenStore() {
+  const file = tokenStorePath();
+  const r = _readStore(file);
+  // Read callers (getStoredToken) treat an unreadable store as "no token", but
+  // the user should still know their saved logins silently vanished.
+  if (!r.ok) _warnCorruptStoreOnce(file, r.err, "");
+  return r.store;
+}
+
 export function getStoredToken(serverUrl) {
   return loadTokenStore()[serverKey(serverUrl)] || null;
 }
@@ -527,7 +570,15 @@ function withStoreLock(file, fn) {
 export function saveStoredToken(serverUrl, record) {
   const file = tokenStorePath();
   return withStoreLock(file, () => {
-    const store = loadTokenStore(); // re-read inside the lock (latest state)
+    const r = _readStore(file); // re-read inside the lock (latest state)
+    if (!r.ok) {
+      // The existing store is unreadable. Writing a fresh single-entry store
+      // here would silently destroy every other server's token — move the
+      // unreadable file aside first so it can be recovered, and surface it.
+      const archived = _archiveCorruptStore(file);
+      _warnCorruptStoreOnce(file, r.err, archived);
+    }
+    const store = r.store;
     store[serverKey(serverUrl)] = { server: serverKey(serverUrl), ...record };
     _writeStoreSecure(file, store);
     return store[serverKey(serverUrl)];
@@ -560,13 +611,28 @@ export function isTokenExpired(record, { skewMs = 60_000 } = {}) {
 /**
  * Return a valid bearer token for a server, refreshing if expired. Returns the
  * access_token string, or null if there's no stored token / refresh failed.
+ *
+ * `forceRefresh` bypasses the local-expiry check and exchanges the refresh
+ * token unconditionally. Use it when the server REJECTED a stored token that
+ * still looked unexpired locally (mid-session 401/403 from a rotated/revoked
+ * grant): the cached access_token is known-bad, so reusing it is pointless —
+ * we either mint a fresh one or return null to signal "re-login needed".
+ *
+ * @param {string} serverUrl
+ * @param {{ forceRefresh?: boolean }} [opts]
  */
-export async function ensureValidToken(serverUrl) {
+export async function ensureValidToken(
+  serverUrl,
+  { forceRefresh = false } = {},
+) {
   const record = getStoredToken(serverUrl);
   if (!record) return null;
-  if (!isTokenExpired(record)) return record.access_token;
+  if (!forceRefresh && !isTokenExpired(record)) return record.access_token;
   if (!record.refresh_token || !record.endpoints?.token_endpoint) {
-    return record.access_token || null; // can't refresh → use what we have
+    // Can't refresh. On a forced refresh the cached token is known-rejected, so
+    // hand back null (caller should stop retrying and prompt re-login); on the
+    // proactive path keep the existing behaviour of using what we have.
+    return forceRefresh ? null : record.access_token || null;
   }
   try {
     const tok = await refreshAccessToken(
@@ -576,7 +642,7 @@ export async function ensureValidToken(serverUrl) {
     const updated = saveStoredToken(serverUrl, { ...record, ...tok });
     return updated.access_token;
   } catch {
-    return record.access_token || null;
+    return forceRefresh ? null : record.access_token || null;
   }
 }
 

package/src/lib/permission-engine.js

@@ -4,6 +4,7 @@
  */
 
 import crypto from "crypto";
+import { safeJsonParse } from "./safe-json.js";
 
 function generateId() {
   return crypto.randomUUID();
@@ -160,7 +161,9 @@ export function getRoles(db) {
     .all();
   return rows.map((r) => ({
     ...r,
-    permissions: JSON.parse(r.permissions || "[]"),
+    // `|| "[]"` only guarded null — a corrupt permissions cell still threw out
+    // of the whole role list (and could break permission checks). Skip it.
+    permissions: safeJsonParse(r.permissions, []),
     isBuiltin: r.is_builtin === 1,
   }));
 }

package/src/lib/personal-data-hub-wiring.js

@@ -62,6 +62,7 @@ let LocalVault,
   SystemDataAndroidAdapter,
   BrowserHistoryChromeAdapter,
   BrowserHistoryEdgeAdapter,
+  BrowserHistoryAospAdapter,
   VSCodeAdapter,
   WinRecentAdapter,
   GitActivityAdapter,
@@ -184,6 +185,7 @@ function ensurePdhLoaded() {
         SystemDataAndroidAdapter,
         BrowserHistoryChromeAdapter,
         BrowserHistoryEdgeAdapter,
+        BrowserHistoryAospAdapter,
         VSCodeAdapter,
         WinRecentAdapter,
         GitActivityAdapter,
@@ -626,6 +628,18 @@ async function initHub() {
     // Continue boot
   }
 
+  // AOSP / MIUI stock browser (com.android.browser → browser2.db). No host
+  // default — needs a device-pulled browser2.db via opts.dbPath at sync time
+  // (cc hub sync-adapter browser-history-aosp --db-path <pulled>), so bare
+  // registration is inert (healthCheck ok:false) until input is supplied,
+  // exactly like the snapshot adapters.
+  try {
+    const aospBrowser = new BrowserHistoryAospAdapter();
+    if (!registry.has(aospBrowser.name)) registry.register(aospBrowser);
+  } catch (_err) {
+    // Continue boot
+  }
+
   // VS Code workspace history + global terminal history. Reads
   // %APPDATA%\Code\User\workspaceStorage and \globalStorage\state.vscdb
   // on Win; equivalents on macOS/Linux.

package/src/lib/pipeline-orchestrator.js

@@ -553,7 +553,25 @@ export function retryStage(db, pipelineId, stageIndex) {
   const pipeline = _getPipelineRow(db, pipelineId);
   if (!pipeline) throw new Error(`Pipeline not found: ${pipelineId}`);
 
-  const stage = _getStageRow(db, pipelineId, stageIndex);
+  // A retry may only re-open the CURRENT stage or an EARLIER one. A forward
+  // jump would move current_stage past the intervening stages — skipping their
+  // approval GATES (CODE_REVIEW / DEPLOY) — and let a caller (`cc pipeline retry
+  // --stage N`, user-supplied) reach a later stage without the gates that guard
+  // it. Going backward is safe: advancing from there re-runs through every gate
+  // again. Mirrors the state-machine rigor of completeStage / approveGate.
+  const idx = Number(stageIndex);
+  if (!Number.isInteger(idx) || idx < 0) {
+    throw new Error(`Invalid stage index: ${stageIndex}`);
+  }
+  if (idx > pipeline.current_stage) {
+    throw new Error(
+      `Cannot retry stage ${idx}: it is ahead of the current stage ` +
+        `(${pipeline.current_stage}) — retrying forward would skip the ` +
+        `intervening stages and their approval gates`,
+    );
+  }
+
+  const stage = _getStageRow(db, pipelineId, idx);
   if (!stage) throw new Error(`Stage ${stageIndex} not found`);
 
   const now = _now();
@@ -572,7 +590,7 @@ export function retryStage(db, pipelineId, stageIndex) {
   });
   _updatePipelineFields(db, pipelineId, {
     status: PIPELINE_STATUS.RUNNING,
-    current_stage: stageIndex,
+    current_stage: idx,
     error_message: null,
     completed_at: null,
   });

package/src/lib/project-detector.js

@@ -28,19 +28,60 @@ export function findProjectRoot(startDir) {
   return null;
 }
 
+// mtime-keyed parse cache. `config.json` is loaded on EVERY agent tool call
+// (via _loadProjectPersona) and every buildSystemPrompt, so re-reading +
+// re-parsing it each time is wasted syscalls + parse work on the agent hot
+// path. We cache the parsed object keyed by absolute configPath and invalidate
+// when the file's mtimeMs changes — so an external edit or a `persona set`
+// write (which rewrites the file → new mtime) is always picked up on the next
+// call. A cache HIT costs one statSync instead of readFileSync + JSON.parse.
+//
+// The cached object is SHARED across callers — treat the return value as
+// READ-ONLY. Every current caller only reads it; `persona set` reads+writes the
+// file directly (bypassing this loader), so it never aliases the cache.
+const _configCache = new Map(); // configPath -> { mtimeMs, value }
+
 /**
  * Load project configuration from .chainlesschain/config.json
+ *
+ * The returned object is cached and shared — do not mutate it. To change the
+ * config, read+write the file directly (see `cc persona set`).
+ *
  * @param {string} projectRoot - Project root directory
- * @returns {object|null} Parsed config or null on error
+ * @returns {object|null} Parsed config (READ-ONLY) or null on error
  */
 export function loadProjectConfig(projectRoot) {
   const configPath = path.join(projectRoot, ".chainlesschain", "config.json");
+  let mtimeMs;
   try {
-    const content = fs.readFileSync(configPath, "utf-8");
-    return JSON.parse(content);
+    mtimeMs = fs.statSync(configPath).mtimeMs;
   } catch {
+    // Missing / unreadable → no config. Drop any stale entry so a file that
+    // reappears later is re-read rather than served from a dead cache slot.
+    _configCache.delete(configPath);
     return null;
   }
+  const cached = _configCache.get(configPath);
+  if (cached && cached.mtimeMs === mtimeMs) return cached.value;
+  let value;
+  try {
+    value = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+  } catch {
+    // Malformed JSON / read race → null (same as before). Cache it against the
+    // current mtime so a persistently-broken file isn't re-read every tool call;
+    // a later fix bumps mtime and invalidates this entry.
+    value = null;
+  }
+  _configCache.set(configPath, { mtimeMs, value });
+  return value;
+}
+
+/**
+ * Test seam: clear the loadProjectConfig mtime cache. Not used in production —
+ * the cache is process-lifetime and self-invalidates on mtime change.
+ */
+export function _clearProjectConfigCache() {
+  _configCache.clear();
 }
 
 /**