chainlesschain 0.162.148 → 0.162.150

package/src/commands/zkp.js

@@ -9,6 +9,7 @@ import { parseJsonOption } from "../lib/parse-json-option.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   ensureZKPTables,
+  loadFromDb as loadZkpFromDb,
   compileCircuit,
   generateProof,
   verifyProof,
@@ -64,6 +65,7 @@ export function registerZkpCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
 
         const def = options.definition || "{}";
         const circuit = compileCircuit(db, name, def);
@@ -100,6 +102,7 @@ export function registerZkpCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
 
         const privateInputs = parseJsonOption(options.private, "--private", {});
         const publicInputs = parseJsonOption(options.public, "--public", []);
@@ -142,6 +145,7 @@ export function registerZkpCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
 
         const result = verifyProof(db, proofId);
         if (options.json) {
@@ -212,6 +216,7 @@ export function registerZkpCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
 
         const stats = getZKPStats();
         if (options.json) {
@@ -266,6 +271,7 @@ export function registerZkpCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
 
         const circuits = listCircuits(db);
         if (options.json) {
@@ -304,6 +310,7 @@ export function registerZkpCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
 
         const proofs = listProofs(db, { circuitId: options.circuit });
         if (options.json) {
@@ -373,6 +380,7 @@ export function registerZkpCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
 
         const result = setCircuitStatus(db, circuitId, status);
         logger.success(
@@ -402,6 +410,7 @@ export function registerZkpCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
 
         const claims = parseJsonOption(options.claims, "--claims", {});
         const cred = registerCredential(db, {
@@ -444,6 +453,7 @@ export function registerZkpCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
 
         const disclosed = fields
           .split(",")
@@ -497,6 +507,7 @@ export function registerZkpCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
 
         const creds = listCredentials(db, { did: options.did });
         if (options.json) {
@@ -621,6 +632,7 @@ export function registerZkpCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
         const def = parseJsonOption(options.definition, "--definition", {});
         const circuit = compileCircuitV2(db, {
           name,
@@ -648,6 +660,7 @@ export function registerZkpCommand(program) {
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
         const patch = {};
         if (options.errorMessage !== undefined) {
           patch.errorMessage = options.errorMessage;
@@ -672,6 +685,7 @@ export function registerZkpCommand(program) {
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
         const proof = generateProofV2(db, {
           circuitId,
           privateInputs: parseJsonOption(options.private, "--private"),
@@ -699,6 +713,7 @@ export function registerZkpCommand(program) {
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
         const result = verifyProofV2(db, proofId);
         if (result.valid) {
           logger.success(`Proof ${proofId} VERIFIED`);
@@ -723,6 +738,7 @@ export function registerZkpCommand(program) {
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
         failProof(db, proofId, { reason: options.reason });
         logger.success(`Proof ${proofId} → invalid`);
         await shutdown();
@@ -741,6 +757,7 @@ export function registerZkpCommand(program) {
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
         const patch = {};
         if (options.errorMessage !== undefined) {
           patch.errorMessage = options.errorMessage;
@@ -762,6 +779,7 @@ export function registerZkpCommand(program) {
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
         const expired = autoExpireProofs(db);
         logger.success(`Expired ${expired.length} proofs`);
         await shutdown();
@@ -792,6 +810,7 @@ export function registerZkpCommand(program) {
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
         const disclosedFields = options.disclosed
           ? options.disclosed
               .split(",")
@@ -826,6 +845,7 @@ export function registerZkpCommand(program) {
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         const db = ctx.db.getDatabase();
         ensureZKPTables(db);
+        loadZkpFromDb(db);
         const stats = getZKPStatsV2();
         console.log(JSON.stringify(stats, null, 2));
         await shutdown();

package/src/gateways/ws/message-dispatcher.js

@@ -19,6 +19,52 @@ import {
   handleRemoteSessionPushRegister,
   handleRemoteSessionRevoke,
 } from "./remote-session-protocol.js";
+import { RemoteCommandLedger } from "../../harness/remote-command-ledger.js";
+
+/**
+ * Reconnect-safe command execution. When a message carries a stable
+ * `commandId`, route it through the server's RemoteCommandLedger so the side
+ * effect runs AT MOST ONCE: a client that re-sends the same command after a
+ * dropped ACK / reconnect gets a `replayed` ack instead of a second execution
+ * (Phase 5 acceptance "断网恢复后不会重复执行工具调用"). Messages WITHOUT a
+ * commandId are unchanged — they call `_executeCommand` directly, so existing
+ * clients behave exactly as before. A revoked device / stale-seq command is
+ * rejected without executing.
+ */
+async function executeWithIdempotency(server, id, ws, message, stream) {
+  const commandId = message.commandId;
+  if (!commandId) {
+    return server._executeCommand(id, ws, message.command, stream);
+  }
+  // Create the ledger SYNCHRONOUSLY (no await between the check and the assign)
+  // so two concurrent re-deliveries of the same commandId share ONE ledger and
+  // coalesce; a lazy `await import()` here would let each build its own ledger
+  // and both would execute — the exact double-exec this guards against.
+  if (!server._commandLedger) {
+    server._commandLedger = new RemoteCommandLedger();
+  }
+  const outcome = await server._commandLedger.apply(
+    { commandId, deviceId: message.deviceId ?? null, seq: message.seq },
+    () => server._executeCommand(id, ws, message.command, stream),
+  );
+  if (outcome.status === "replayed") {
+    server._send(ws, {
+      id,
+      type: "replayed",
+      commandId,
+      applyIndex: outcome.applyIndex,
+    });
+  } else if (outcome.status === "rejected") {
+    server._send(ws, {
+      id,
+      type: "error",
+      code: "COMMAND_REJECTED",
+      commandId,
+      message: outcome.reason,
+    });
+  }
+  return outcome;
+}
 
 export function createWsMessageDispatcher(server) {
   return {
@@ -52,8 +98,8 @@ export function createWsMessageDispatcher(server) {
         auth: () => server._handleAuth(clientId, ws, message),
         ping: () =>
           server._send(ws, { id, type: "pong", serverTime: Date.now() }),
-        execute: () => server._executeCommand(id, ws, message.command, false),
-        stream: () => server._executeCommand(id, ws, message.command, true),
+        execute: () => executeWithIdempotency(server, id, ws, message, false),
+        stream: () => executeWithIdempotency(server, id, ws, message, true),
         cancel: () => server._cancelRequest(id, ws),
         "session-create": () => server._handleSessionCreate(id, ws, message),
         "session-resume": () => server._handleSessionResume(id, ws, message),

package/src/gateways/ws/remote-session-protocol.js

@@ -7,6 +7,7 @@ import {
   RemoteSessionCryptoContext,
   createRemotePairingUri,
 } from "../../harness/remote-session-crypto.js";
+import { RemoteCommandLedger } from "../../harness/remote-command-ledger.js";
 
 const CLIENT_EVENT_SCOPES = Object.freeze({
   prompt: "prompt",
@@ -22,6 +23,55 @@ function audit(server, entry) {
   server.remoteSessionAudit?.record(entry);
 }
 
+/**
+ * Apply a remote-client control event (prompt / approval.resolve / interrupt)
+ * idempotently when it carries a stable `commandId`. This is the ACTUAL takeover
+ * path — a paired mobile/web device driving the host agent — and it does NOT
+ * flow through message-dispatcher's execute/stream ledger, so without this a
+ * prompt re-sent after a dropped connection would run the agent turn a SECOND
+ * time (Phase 5 acceptance "断网恢复后不会重复执行工具调用"). The side effect
+ * (audit + dispatch into the host session) runs AT MOST ONCE per commandId; a
+ * re-delivery gets a `replayed` ack instead. Byte-identical when the event
+ * carries no `commandId` (existing clients unchanged). deviceId is the
+ * AUTHENTICATED clientId, so a device can never spoof another's idempotency /
+ * ordering stream. A revoked device / stale seq is rejected without forwarding.
+ * Uses a ledger SEPARATE from the execute/stream one (`_commandLedger`) so the
+ * two paths keep independent per-device sequence spaces.
+ */
+async function applyControlIdempotent(server, clientId, ws, message, forward) {
+  const commandId = message.commandId;
+  if (!commandId) return forward();
+  // Create the ledger SYNCHRONOUSLY (no await between the check and the assign)
+  // so two concurrent re-deliveries of the same commandId share ONE ledger and
+  // coalesce — a lazy `await import()` here would let each build its own ledger
+  // and both would execute, defeating the whole guarantee.
+  if (!server._remoteControlLedger) {
+    server._remoteControlLedger = new RemoteCommandLedger();
+  }
+  const outcome = await server._remoteControlLedger.apply(
+    { commandId, deviceId: clientId, seq: message.seq },
+    async () => {
+      await forward();
+      return true;
+    },
+  );
+  if (outcome.status === "replayed") {
+    reply(server, ws, message.id, "remote-session-published", {
+      delivered: 0,
+      replayed: true,
+      commandId,
+      applyIndex: outcome.applyIndex,
+    });
+  } else if (outcome.status === "rejected") {
+    reply(server, ws, message.id, "error", {
+      code: "COMMAND_REJECTED",
+      commandId,
+      message: outcome.reason,
+    });
+  }
+  return outcome;
+}
+
 function attachPairingUri(server, result) {
   const relayUrl = server.remoteSessionRelayUrl;
   const hostPeerId = server.remoteSessionPeerId;
@@ -341,6 +391,43 @@ export async function handleRemoteSessionPublish(
     if (!message.event || typeof message.event.type !== "string") {
       throw new Error("event.type is required");
     }
+    // A paired device (incl. relay-only mobiles) refreshing its own vendor push
+    // token — e.g. after FCM onNewToken. Self-scoped: authorize proves
+    // membership and registerPush keys off the authenticated clientId, so a
+    // device can only ever set its OWN token. Omitting the token clears it.
+    if (message.event.type === "push.register") {
+      server.remoteSessions.authorize(
+        message.remoteSessionId,
+        clientId,
+        "observe",
+      );
+      const registered = server.remoteSessions.registerPush(
+        message.remoteSessionId,
+        clientId,
+        {
+          token: message.event.pushToken,
+          provider: message.event.pushProvider,
+        },
+      );
+      audit(server, {
+        sessionId: message.remoteSessionId,
+        actor: clientId,
+        action: "push.registered",
+        detail: {
+          hasPush: registered.hasPush,
+          provider: registered.provider,
+          via: "relay",
+        },
+      });
+      reply(
+        server,
+        ws,
+        message.id,
+        "remote-session-push-registered",
+        registered,
+      );
+      return;
+    }
     const requiredScope = CLIENT_EVENT_SCOPES[message.event.type];
     const { session } = server.remoteSessions.authorize(
       message.remoteSessionId,
@@ -358,49 +445,60 @@ export async function handleRemoteSessionPublish(
         id: message.id,
         sessionId: session.agentSessionId,
       };
-      if (message.event.type === "prompt") {
-        if (
-          typeof message.event.content !== "string" ||
-          !message.event.content.trim()
-        ) {
-          throw new Error("prompt content is required");
-        }
-        // Record the shape, not the content — the audit trail must stay useful
-        // without hoarding potentially sensitive session prompts.
-        audit(server, {
-          sessionId: message.remoteSessionId,
-          actor: clientId,
-          action: "control.prompt",
-          detail: { chars: message.event.content.length },
-        });
-        handleSessionMessage(server, message.id, ws, {
-          ...controlMessage,
-          content: message.event.content,
-        });
-      } else if (message.event.type === "approval.resolve") {
-        audit(server, {
-          sessionId: message.remoteSessionId,
-          actor: clientId,
-          action: "control.approval",
-          detail: {
-            requestId: message.event.requestId || message.event.approvalId,
-            approved: message.event.answer ?? message.event.approved,
-          },
-        });
-        await handleSessionAnswer(server, message.id, ws, {
-          ...controlMessage,
-          requestId: message.event.requestId || message.event.approvalId,
-          answer: message.event.answer ?? message.event.approved,
-        });
-      } else if (message.event.type === "interrupt") {
-        audit(server, {
-          sessionId: message.remoteSessionId,
-          actor: clientId,
-          action: "control.interrupt",
-          detail: null,
-        });
-        await handleSessionInterrupt(server, message.id, ws, controlMessage);
+      // Validate up-front so a malformed control event errors identically
+      // whether or not it carries a commandId — idempotency must never change
+      // validation semantics (a bad prompt must not consume a commandId slot).
+      if (
+        message.event.type === "prompt" &&
+        (typeof message.event.content !== "string" ||
+          !message.event.content.trim())
+      ) {
+        throw new Error("prompt content is required");
       }
+      // Idempotent forward: a control event with a stable commandId runs its
+      // side effect (audit + dispatch into the host agent) AT MOST ONCE, so a
+      // reconnecting device re-sending the same prompt/approval/interrupt gets a
+      // `replayed` ack instead of a second agent turn. No commandId → forwarded
+      // directly, byte-identical to before.
+      await applyControlIdempotent(server, clientId, ws, message, async () => {
+        if (message.event.type === "prompt") {
+          // Record the shape, not the content — the audit trail must stay
+          // useful without hoarding potentially sensitive session prompts.
+          audit(server, {
+            sessionId: message.remoteSessionId,
+            actor: clientId,
+            action: "control.prompt",
+            detail: { chars: message.event.content.length },
+          });
+          handleSessionMessage(server, message.id, ws, {
+            ...controlMessage,
+            content: message.event.content,
+          });
+        } else if (message.event.type === "approval.resolve") {
+          audit(server, {
+            sessionId: message.remoteSessionId,
+            actor: clientId,
+            action: "control.approval",
+            detail: {
+              requestId: message.event.requestId || message.event.approvalId,
+              approved: message.event.answer ?? message.event.approved,
+            },
+          });
+          await handleSessionAnswer(server, message.id, ws, {
+            ...controlMessage,
+            requestId: message.event.requestId || message.event.approvalId,
+            answer: message.event.answer ?? message.event.approved,
+          });
+        } else if (message.event.type === "interrupt") {
+          audit(server, {
+            sessionId: message.remoteSessionId,
+            actor: clientId,
+            action: "control.interrupt",
+            detail: null,
+          });
+          await handleSessionInterrupt(server, message.id, ws, controlMessage);
+        }
+      });
       return;
     }
 

package/src/gateways/ws/ws-server.js

@@ -37,7 +37,7 @@ import {
   RemoteSessionPushDispatcher,
   isApprovalRequestEvent,
 } from "../../harness/remote-session-push.js";
-import { createRemoteSessionPushSender } from "../../harness/remote-session-push-fcm.js";
+import { createRemoteSessionPushSender } from "../../harness/remote-session-push-senders.js";
 import { RemoteSessionRelay } from "../remote-session-relay.js";
 import { handleRemoteSessionPublish } from "./remote-session-protocol.js";
 import { handleTaskDetail, handleTaskHistory } from "./task-protocol.js";

package/src/harness/jsonl-session-store.js

@@ -438,12 +438,19 @@ function performLegacySessionMigration(sourcePath, options) {
     }
 
     const validation = validateJsonlSession(sessionId);
-    if (
-      !validation.valid ||
-      validation.messageCount !== legacy.messages.length
-    ) {
+    // Verify EVERY legacy message persisted, by event count — NOT by
+    // `messageCount`, which counts only user_message/assistant_message events.
+    // A legacy `system` message becomes a `system` event and a `tool` message a
+    // `tool_result` event (see appendLegacyMessage); neither is a "message" by
+    // that count, so comparing messageCount to legacy.messages.length wrongly
+    // FAILED migration for any session with a system prompt or tool call.
+    // appendLegacyMessage writes exactly one event per message, plus the leading
+    // session_start and an optional trailing summary event.
+    const expectedEvents =
+      1 + legacy.messages.length + (legacy.summary ? 1 : 0);
+    if (!validation.valid || validation.eventCount !== expectedEvents) {
       throw new Error(
-        `post-migration validation failed for ${sessionId} (${validation.messageCount}/${legacy.messages.length} messages)`,
+        `post-migration validation failed for ${sessionId} (${validation.eventCount}/${expectedEvents} events)`,
       );
     }
 

package/src/harness/plugin-manager.js

@@ -11,6 +11,7 @@ import crypto from "crypto";
 import fs from "fs";
 import path from "path";
 import { getElectronUserDataDir } from "../lib/paths.js";
+import { escapeLike } from "../lib/sql-like.js";
 
 /**
  * Ensure plugin tables exist.
@@ -288,11 +289,15 @@ export function registerInMarketplace(db, pluginInfo) {
  */
 export function searchRegistry(db, query) {
   ensurePluginTables(db);
+  // Escape LIKE metacharacters so a query containing % or _ is matched
+  // literally — otherwise `cc plugin search "%"` (or any term with _) is treated
+  // as a wildcard and matches EVERY registry row instead of the intended text.
+  const pattern = `%${escapeLike(query)}%`;
   return db
     .prepare(
-      "SELECT * FROM plugin_registry WHERE name LIKE ? OR description LIKE ? ORDER BY downloads DESC",
+      "SELECT * FROM plugin_registry WHERE name LIKE ? ESCAPE '\\' OR description LIKE ? ESCAPE '\\' ORDER BY downloads DESC",
     )
-    .all(`%${query}%`, `%${query}%`);
+    .all(pattern, pattern);
 }
 
 /**
@@ -352,7 +357,11 @@ export function installPluginSkills(db, pluginName, pluginPath, skills) {
   const installed = [];
 
   for (const skill of skills) {
-    if (!skill || typeof skill.name !== "string" || typeof skill.path !== "string") {
+    if (
+      !skill ||
+      typeof skill.name !== "string" ||
+      typeof skill.path !== "string"
+    ) {
       continue;
     }
     const srcDir = path.resolve(pluginPath, skill.path);
@@ -363,7 +372,10 @@ export function installPluginSkills(db, pluginName, pluginPath, skills) {
     if (!fs.existsSync(srcDir)) continue;
 
     const destDir = path.join(marketplaceDir, skill.name);
-    if (!_isWithin(marketplaceDir, destDir) || path.resolve(destDir) === path.resolve(marketplaceDir)) {
+    if (
+      !_isWithin(marketplaceDir, destDir) ||
+      path.resolve(destDir) === path.resolve(marketplaceDir)
+    ) {
       continue;
     }
     fs.mkdirSync(destDir, { recursive: true });

package/src/harness/prompt-compressor.js

@@ -251,8 +251,25 @@ export class PromptCompressor {
       };
     }
 
+    // Pinned facts — a DETERMINISTIC fact-retention guarantee. A message marked
+    // `pinned:true` (or matched by an `options.isPinned` predicate) MUST survive
+    // compaction verbatim regardless of any strategy or the non-deterministic LLM
+    // summary. Every other retention here is positional (system / recent-N / last
+    // user) or summary-dependent, so an important fact that scrolls out of the
+    // recent window would otherwise survive only if the summary happens to keep
+    // it. We pull pins out BEFORE any strategy runs (so nothing can drop them),
+    // then re-insert them as a sticky block right after the system messages.
+    const isPinned =
+      typeof options.isPinned === "function"
+        ? options.isPinned
+        : (m) => m && (m.pinned === true || m._pin === true);
+    const pinned = messages.filter((m) => isPinned(m));
+    const working = pinned.length
+      ? messages.filter((m) => !isPinned(m))
+      : messages;
+
     const originalTokens = estimateMessagesTokens(messages);
-    let result = [...messages];
+    let result = [...working];
     const applied = [];
 
     if (feature("CONTEXT_SNIP")) {
@@ -288,6 +305,15 @@ export class PromptCompressor {
       }
     }
 
+    // Re-insert pinned facts verbatim (order preserved) right after the leading
+    // system messages, so they end up as a sticky facts block at the top.
+    if (pinned.length) {
+      const sys = result.filter((m) => m.role === "system");
+      const nonSys = result.filter((m) => m.role !== "system");
+      result = [...sys, ...pinned, ...nonSys];
+      applied.push("pinned");
+    }
+
     // Tool-pair repair (opt-in) — callers compacting tool-laden histories
     // (e.g. the headless agent loop) pass this so truncation/snip never leaves
     // an orphaned tool result or unanswered tool_call for a strict API.