chainlesschain 0.162.149 → 0.162.150

package/src/lib/token-incentive.js

@@ -224,14 +224,15 @@ function _recordTransaction(db, config) {
     createdAt: now,
     _seq: ++_seq,
   };
-  _transactions.set(id, tx);
-
   if (db) {
     db.prepare(
       `INSERT INTO token_transactions (id, from_account, to_account, amount, reason, type, created_at)
        VALUES (?, ?, ?, ?, ?, ?, ?)`,
     ).run(id, tx.fromAccount, tx.toAccount, tx.amount, tx.reason, tx.type, now);
   }
+  // Register in the in-memory ledger only after the row is persisted, so a
+  // failed INSERT (e.g. inside a rolled-back transaction) leaves no phantom.
+  _transactions.set(id, tx);
   return tx;
 }
 
@@ -255,6 +256,21 @@ export function transfer(db, config = {}) {
     throw new Error(`Insufficient balance: ${fromAccount.balance} < ${amount}`);
   }
 
+  // The debit, the credit and the ledger row must all land or none of them.
+  // Without an enclosing transaction a mid-way failure would persist the debit
+  // but not the credit (tokens vanish) or move the balances yet never record
+  // the ledger — and the CLI re-hydrates from these tables, so it survives.
+  const fromSnap = {
+    balance: fromAccount.balance,
+    totalSpent: fromAccount.totalSpent,
+    updatedAt: fromAccount.updatedAt,
+  };
+  const toSnap = {
+    balance: toAccount.balance,
+    totalEarned: toAccount.totalEarned,
+    updatedAt: toAccount.updatedAt,
+  };
+
   fromAccount.balance -= amount;
   fromAccount.totalSpent += amount;
   fromAccount.updatedAt = now;
@@ -262,17 +278,33 @@ export function transfer(db, config = {}) {
   toAccount.totalEarned += amount;
   toAccount.updatedAt = now;
 
-  _persistAccount(db, fromAccount);
-  _persistAccount(db, toAccount);
+  let tx;
+  const applyWrites = () => {
+    _persistAccount(db, fromAccount);
+    _persistAccount(db, toAccount);
+    tx = _recordTransaction(db, {
+      from,
+      to,
+      amount,
+      reason: config.reason,
+      type: TX_TYPES.TRANSFER,
+      now,
+    });
+  };
+
+  try {
+    if (db && typeof db.transaction === "function") {
+      db.transaction(applyWrites)();
+    } else {
+      applyWrites();
+    }
+  } catch (err) {
+    // Roll the in-memory Maps back so they match the rolled-back DB.
+    Object.assign(fromAccount, fromSnap);
+    Object.assign(toAccount, toSnap);
+    throw err;
+  }
 
-  const tx = _recordTransaction(db, {
-    from,
-    to,
-    amount,
-    reason: config.reason,
-    type: TX_TYPES.TRANSFER,
-    now,
-  });
   return _strip(tx);
 }
 
@@ -425,28 +457,59 @@ export function rewardContribution(db, contributionId, opts = {}) {
 
   const now = Number(opts.now ?? Date.now());
   const account = _ensureAccount(db, contribution.userId, now);
+
+  // Credit the account, record the ledger row and mark the contribution
+  // rewarded atomically. A partial failure would otherwise credit the balance
+  // without flipping `rewarded`, letting the same contribution be rewarded
+  // again after the next re-hydrate (double-reward).
+  const acctSnap = {
+    balance: account.balance,
+    totalEarned: account.totalEarned,
+    updatedAt: account.updatedAt,
+  };
+  const contribSnap = {
+    rewarded: contribution.rewarded,
+    rewardAmount: contribution.rewardAmount,
+    txId: contribution.txId,
+  };
+
   account.balance += amount;
   account.totalEarned += amount;
   account.updatedAt = now;
-  _persistAccount(db, account);
-
-  const tx = _recordTransaction(db, {
-    from: null,
-    to: contribution.userId,
-    amount,
-    reason: `contribution:${contribution.type}:${contributionId.slice(0, 8)}`,
-    type: TX_TYPES.REWARD,
-    now,
-  });
 
-  contribution.rewarded = true;
-  contribution.rewardAmount = amount;
-  contribution.txId = tx.id;
+  let tx;
+  const applyWrites = () => {
+    _persistAccount(db, account);
+    tx = _recordTransaction(db, {
+      from: null,
+      to: contribution.userId,
+      amount,
+      reason: `contribution:${contribution.type}:${contributionId.slice(0, 8)}`,
+      type: TX_TYPES.REWARD,
+      now,
+    });
+    contribution.rewarded = true;
+    contribution.rewardAmount = amount;
+    contribution.txId = tx.id;
+    if (db) {
+      db.prepare(
+        `UPDATE contributions SET rewarded = ?, reward_amount = ?, tx_id = ? WHERE id = ?`,
+      ).run(1, amount, tx.id, contributionId);
+    }
+  };
 
-  if (db) {
-    db.prepare(
-      `UPDATE contributions SET rewarded = ?, reward_amount = ?, tx_id = ? WHERE id = ?`,
-    ).run(1, amount, tx.id, contributionId);
+  try {
+    if (db && typeof db.transaction === "function") {
+      db.transaction(applyWrites)();
+    } else {
+      applyWrites();
+    }
+  } catch (err) {
+    // Roll the in-memory Maps back to match the rolled-back DB.
+    Object.assign(account, acctSnap);
+    Object.assign(contribution, contribSnap);
+    if (tx) _transactions.delete(tx.id);
+    throw err;
   }
 
   return { contribution: _strip(contribution), tx: _strip(tx) };
@@ -512,6 +575,94 @@ export function _resetState() {
   _seq = 0;
 }
 
+/**
+ * Rehydrate the in-memory ledger Maps from the persisted token_* tables. The CLI
+ * runs each `cc incentive` subcommand in a fresh node process, so these
+ * module-level Maps start empty every invocation. Every write dual-writes (Map +
+ * INSERT into token_accounts/token_transactions/contributions) but every read
+ * (getBalance/listAccounts/getTransactionHistory/getContributions/
+ * getLeaderboard) is Map-only and nothing SELECTed the tables back.
+ *
+ * This is worse than mere invisibility: `_ensureAccount` does `_accounts.get`
+ * (miss on a cold Map) → creates balance 0 → `_persistAccount` INSERT OR REPLACE,
+ * so a second process minting/rewarding an existing account CLOBBERS the
+ * persisted balance to 0 before applying its delta — balances never accumulate
+ * and transfers fail with "Insufficient balance: 0". Call after
+ * ensureTokenTables(db).
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  ensureTokenTables(db);
+  _accounts.clear();
+  _transactions.clear();
+  _contributions.clear();
+
+  for (const r of db
+    .prepare(
+      `SELECT id, account_id, balance, total_earned, total_spent, created_at, updated_at
+         FROM token_accounts ORDER BY created_at ASC`,
+    )
+    .all()) {
+    _accounts.set(r.account_id, {
+      id: r.id,
+      accountId: r.account_id,
+      balance: Number(r.balance) || 0,
+      totalEarned: Number(r.total_earned) || 0,
+      totalSpent: Number(r.total_spent) || 0,
+      createdAt: Number(r.created_at),
+      updatedAt: Number(r.updated_at),
+      _seq: ++_seq,
+    });
+  }
+
+  for (const r of db
+    .prepare(
+      `SELECT id, from_account, to_account, amount, reason, type, created_at
+         FROM token_transactions ORDER BY created_at ASC`,
+    )
+    .all()) {
+    _transactions.set(r.id, {
+      id: r.id,
+      fromAccount: r.from_account ?? null,
+      toAccount: r.to_account ?? null,
+      amount: Number(r.amount),
+      reason: r.reason ?? null,
+      type: r.type,
+      createdAt: Number(r.created_at),
+      _seq: ++_seq,
+    });
+  }
+
+  for (const r of db
+    .prepare(
+      `SELECT id, user_id, type, value, metadata, rewarded, reward_amount, tx_id, created_at
+         FROM contributions ORDER BY created_at ASC`,
+    )
+    .all()) {
+    // One corrupt metadata cell must not sink the whole ledger load.
+    let metadata = null;
+    try {
+      metadata = r.metadata ? JSON.parse(r.metadata) : null;
+    } catch {
+      metadata = null;
+    }
+    _contributions.set(r.id, {
+      id: r.id,
+      userId: r.user_id,
+      type: r.type,
+      value: Number(r.value) || 0,
+      metadata,
+      rewarded: !!r.rewarded,
+      rewardAmount: Number(r.reward_amount) || 0,
+      txId: r.tx_id ?? null,
+      createdAt: Number(r.created_at),
+      _seq: ++_seq,
+    });
+  }
+
+  return _accounts.size + _transactions.size + _contributions.size;
+}
+
 // ═══════════════════════════════════════════════════════════════
 // Phase 66 V2 — Account + Claim lifecycle, per-user claim cap
 // ═══════════════════════════════════════════════════════════════

package/src/lib/wallet-manager.js

@@ -159,10 +159,23 @@ export function setDefaultWallet(db, address) {
   const wallet = getWallet(db, address);
   if (!wallet) return false;
 
-  db.prepare("UPDATE wallets SET is_default = 0 WHERE address LIKE ?").run("%");
-  db.prepare("UPDATE wallets SET is_default = 1 WHERE address = ?").run(
-    address,
-  );
+  // Clear the current default(s) then set the new one atomically. Without a
+  // transaction, a failure on the second UPDATE leaves every wallet non-default
+  // (the default signing/sending wallet silently disappears until re-set),
+  // breaking the exactly-one-default invariant.
+  const applyWrites = () => {
+    db.prepare("UPDATE wallets SET is_default = 0 WHERE address LIKE ?").run(
+      "%",
+    );
+    db.prepare("UPDATE wallets SET is_default = 1 WHERE address = ?").run(
+      address,
+    );
+  };
+  if (db && typeof db.transaction === "function") {
+    db.transaction(applyWrites)();
+  } else {
+    applyWrites();
+  }
   return true;
 }
 
@@ -171,21 +184,36 @@ export function setDefaultWallet(db, address) {
  */
 export function deleteWallet(db, address) {
   ensureWalletTables(db);
-  const result = db
-    .prepare("DELETE FROM wallets WHERE address = ?")
-    .run(address);
-  if (result.changes > 0) {
-    // Promote next wallet to default
-    const next = db
-      .prepare("SELECT address FROM wallets ORDER BY created_at ASC LIMIT 1")
-      .get();
-    if (next) {
-      db.prepare("UPDATE wallets SET is_default = 1 WHERE address = ?").run(
-        next.address,
-      );
+  const wallet = getWallet(db, address);
+  if (!wallet) return false;
+  const wasDefault = Number(wallet.is_default) === 1;
+
+  const doDelete = () => {
+    const result = db
+      .prepare("DELETE FROM wallets WHERE address = ?")
+      .run(address);
+    // Only promote a new default when the DELETED wallet was the default —
+    // otherwise the existing default is untouched and promoting the oldest
+    // remaining wallet would leave two defaults. Promote the oldest remaining
+    // so exactly one default survives.
+    if (result.changes > 0 && wasDefault) {
+      const next = db
+        .prepare("SELECT address FROM wallets ORDER BY created_at ASC LIMIT 1")
+        .get();
+      if (next) {
+        db.prepare("UPDATE wallets SET is_default = 1 WHERE address = ?").run(
+          next.address,
+        );
+      }
     }
-  }
-  return result.changes > 0;
+    return result.changes;
+  };
+
+  const changes =
+    db && typeof db.transaction === "function"
+      ? db.transaction(doDelete)()
+      : doDelete();
+  return changes > 0;
 }
 
 /**
@@ -278,28 +306,46 @@ export function transferAsset(db, assetId, toAddress, amount) {
   const asset = getAsset(db, assetId);
   if (!asset) throw new Error(`Asset not found: ${assetId}`);
 
+  // The destination must be a real local wallet — createAsset enforces the same
+  // invariant on the way in. Without this, a transfer to a bogus address moves
+  // the asset out of the sender's wallet to an address no wallet owns, so it
+  // disappears from every getAssets/getWalletSummary view (permanently orphaned).
+  const dest = getWallet(db, toAddress);
+  if (!dest) throw new Error(`Destination wallet not found: ${toAddress}`);
+
   const txId = `tx-${crypto.randomBytes(8).toString("hex")}`;
   const fromAddress = asset.wallet_address;
   const txAmount = amount || asset.amount;
 
-  db.prepare(
-    `INSERT INTO transactions (id, from_address, to_address, asset_id, amount, tx_type, status)
-     VALUES (?, ?, ?, ?, ?, ?, ?)`,
-  ).run(
-    txId,
-    fromAddress,
-    toAddress,
-    assetId,
-    txAmount,
-    "transfer",
-    "confirmed",
-  );
+  // Record the ledger row and move ownership atomically. Without a transaction,
+  // a failure on the ownership UPDATE would leave a "confirmed" transactions row
+  // for a transfer that never happened (the asset stays with the sender).
+  const applyWrites = () => {
+    db.prepare(
+      `INSERT INTO transactions (id, from_address, to_address, asset_id, amount, tx_type, status)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+    ).run(
+      txId,
+      fromAddress,
+      toAddress,
+      assetId,
+      txAmount,
+      "transfer",
+      "confirmed",
+    );
 
-  // Update asset ownership
-  db.prepare("UPDATE digital_assets SET wallet_address = ? WHERE id = ?").run(
-    toAddress,
-    assetId,
-  );
+    // Update asset ownership
+    db.prepare("UPDATE digital_assets SET wallet_address = ? WHERE id = ?").run(
+      toAddress,
+      assetId,
+    );
+  };
+
+  if (db && typeof db.transaction === "function") {
+    db.transaction(applyWrites)();
+  } else {
+    applyWrites();
+  }
 
   return {
     txId,

package/src/lib/zkp-engine.js

@@ -471,6 +471,93 @@ export function _resetState() {
   _proofExpiryMs = ZKP_DEFAULT_PROOF_EXPIRY_MS;
 }
 
+/**
+ * Rehydrate the in-memory Maps from the persisted zkp_* tables. The CLI runs
+ * each `cc zkp` subcommand in a fresh node process, so _circuits/_proofs/
+ * _verificationKeys/_credentials start empty every invocation. Every write
+ * dual-writes (Map + INSERT into zkp_circuits/zkp_proofs/zkp_credentials) but
+ * every read (listCircuits/listProofs/listCredentials/getZKPStats + the
+ * generateProof/verifyProof/selectiveDisclose lookups) is Map-only and nothing
+ * SELECTed the tables back — so `zkp circuits`/`proofs`/`credentials` were always
+ * empty, and `prove`/`verify`/`disclose` threw "not found" for a circuit/proof/
+ * credential that genuinely exists on disk. Call after ensureZKPTables(db).
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  ensureZKPTables(db);
+  _circuits.clear();
+  _proofs.clear();
+  _verificationKeys.clear();
+  _credentials.clear();
+
+  const parse = (v, fallback) => {
+    try {
+      return v ? JSON.parse(v) : fallback;
+    } catch {
+      return fallback;
+    }
+  };
+
+  for (const r of db
+    .prepare(
+      `SELECT id, name, definition, compiled, verification_key, status, created_at
+         FROM zkp_circuits ORDER BY created_at ASC`,
+    )
+    .all()) {
+    const definition = parse(r.definition, {});
+    const constraints = Array.isArray(definition.constraints)
+      ? definition.constraints
+      : [];
+    _circuits.set(r.id, {
+      id: r.id,
+      name: r.name,
+      definition,
+      compiled: parse(r.compiled, {}),
+      constraints: constraints.length || 1,
+      inputs: definition.inputs || [],
+      outputs: definition.outputs || [],
+      verificationKey: r.verification_key,
+      status: r.status,
+      createdAt: r.created_at,
+    });
+    if (r.verification_key) _verificationKeys.set(r.id, r.verification_key);
+  }
+
+  for (const r of db
+    .prepare(
+      `SELECT id, circuit_id, proof, public_inputs, verified, scheme, created_at
+         FROM zkp_proofs ORDER BY created_at ASC`,
+    )
+    .all()) {
+    _proofs.set(r.id, {
+      id: r.id,
+      circuitId: r.circuit_id,
+      scheme: r.scheme,
+      proof: parse(r.proof, {}),
+      publicInputs: parse(r.public_inputs, []),
+      verified: !!r.verified,
+      createdAt: r.created_at,
+    });
+  }
+
+  for (const r of db
+    .prepare(
+      `SELECT id, did, claims, merkle_root, created_at
+         FROM zkp_credentials ORDER BY created_at ASC`,
+    )
+    .all()) {
+    _credentials.set(r.id, {
+      id: r.id,
+      did: r.did ?? null,
+      claims: parse(r.claims, {}),
+      merkleRoot: r.merkle_root,
+      createdAt: r.created_at,
+    });
+  }
+
+  return _circuits.size + _proofs.size + _credentials.size;
+}
+
 /* ──────────────────────────────────────────────────────────
  *  V2 — Phase 88 surface (strictly additive)
  * ────────────────────────────────────────────────────────── */

package/src/repl/agent-repl.js

@@ -64,6 +64,7 @@ import {
   PromptCompressor,
   getContextWindow,
 } from "../harness/prompt-compressor.js";
+import { buildAutoPinPredicate } from "../runtime/auto-pin.js";
 import { feature } from "../lib/feature-flags.js";
 import { recordCompressionMetric } from "../lib/compression-telemetry.js";
 import {
@@ -416,10 +417,15 @@ export async function startAgentRepl(options = {}) {
   // Unset → agent-core's 180s default (matches cc chat/ask). Set to 0 to
   // disable. Left undefined here means "use the default".
   let _streamStallTimeoutMs;
+  // Auto-pin (OPT-IN, off by default): when set, compaction pins the original
+  // task. Resolved from config `context.autoPin` or CC_AUTO_PIN=1; falsy → the
+  // compress calls below pass no pin predicate (byte-identical default).
+  let _autoPinOpt;
   try {
     const { loadConfig } = await import("../lib/config-manager.js");
     const _cfg = loadConfig();
     _visionModel = _cfg?.llm?.visionModel || undefined;
+    _autoPinOpt = _cfg?.context?.autoPin;
     const raw = _cfg?.llm?.streamStallTimeoutMs;
     const t = Number(raw);
     // Accept 0 (explicit disable) — only ignore absent/invalid values.
@@ -477,6 +483,15 @@ export async function startAgentRepl(options = {}) {
   if (feature("PROMPT_COMPRESSOR")) {
     _compressor = new PromptCompressor({ model, provider });
   }
+  if (process.env.CC_AUTO_PIN === "1") _autoPinOpt = _autoPinOpt || true;
+  // Compaction options shared by /compact + auto-compact. Adds the opt-in
+  // pin predicate only when auto-pin is enabled; otherwise byte-identical.
+  const _compactOpts = (msgs) => {
+    const base = { preserveToolPairs: true };
+    if (!_autoPinOpt) return base;
+    const isPinned = buildAutoPinPredicate(msgs, _autoPinOpt);
+    return isPinned ? { ...base, isPinned } : base;
+  };
 
   // Initialize permanent memory
   let permanentMemory = null;
@@ -2533,7 +2548,7 @@ export async function startAgentRepl(options = {}) {
       if (_compressor && messages.length > 3) {
         const { messages: compacted, stats } = await _compressor.compress(
           messages,
-          { preserveToolPairs: true },
+          _compactOpts(messages),
         );
         messages.length = 0;
         messages.push(...compacted);
@@ -4460,7 +4475,7 @@ export async function startAgentRepl(options = {}) {
         try {
           const { messages: compacted, stats } = await _compressor.compress(
             messages,
-            { preserveToolPairs: true },
+            _compactOpts(messages),
           );
           messages.length = 0;
           messages.push(...compacted);

package/src/runtime/__tests__/auto-pin.test.js

@@ -0,0 +1,104 @@
+/**
+ * auto-pin policy tests — the OPT-IN compaction pin policy. Verifies it is off
+ * by default (returns null → caller passes no predicate → byte-identical), and
+ * when enabled pins the original task (first user turn) plus explicit pins,
+ * honoring the token cap.
+ */
+
+import { describe, it, expect } from "vitest";
+import {
+  resolveAutoPinConfig,
+  buildAutoPinPredicate,
+  describeAutoPin,
+} from "../auto-pin.js";
+
+const MSGS = [
+  { role: "system", content: "you are a coding agent" },
+  { role: "user", content: "Refactor the auth module to use async/await" },
+  { role: "assistant", content: "ok, reading files" },
+  { role: "user", content: "also add tests" },
+];
+
+describe("resolveAutoPinConfig", () => {
+  it("returns null when off (falsy)", () => {
+    expect(resolveAutoPinConfig(undefined)).toBeNull();
+    expect(resolveAutoPinConfig(false)).toBeNull();
+    expect(resolveAutoPinConfig(0)).toBeNull();
+  });
+  it("defaults firstUserGoal on when enabled with true", () => {
+    expect(resolveAutoPinConfig(true)).toMatchObject({ firstUserGoal: true });
+  });
+  it("accepts an object and can disable firstUserGoal", () => {
+    expect(resolveAutoPinConfig({ firstUserGoal: false })).toMatchObject({
+      firstUserGoal: false,
+    });
+    expect(resolveAutoPinConfig({ maxPinTokens: 50 }).maxPinTokens).toBe(50);
+  });
+});
+
+describe("buildAutoPinPredicate", () => {
+  it("returns null when auto-pin is off (→ default compaction, byte-identical)", () => {
+    expect(buildAutoPinPredicate(MSGS, false)).toBeNull();
+    expect(buildAutoPinPredicate(MSGS, undefined)).toBeNull();
+  });
+
+  it("pins the first user turn (the original task) when enabled", () => {
+    const isPinned = buildAutoPinPredicate(MSGS, true);
+    expect(isPinned(MSGS[1])).toBe(true); // first user
+    expect(isPinned(MSGS[3])).toBe(false); // second user NOT pinned
+    expect(isPinned(MSGS[0])).toBe(false); // system not pinned
+    expect(isPinned(MSGS[2])).toBe(false); // assistant not pinned
+  });
+
+  it("always honors explicit pins on top of the policy", () => {
+    const msgs = [
+      ...MSGS,
+      { role: "assistant", content: "important decision", pinned: true },
+      { role: "assistant", content: "legacy marker", _pin: true },
+    ];
+    const isPinned = buildAutoPinPredicate(msgs, true);
+    expect(isPinned(msgs[4])).toBe(true); // pinned:true
+    expect(isPinned(msgs[5])).toBe(true); // _pin
+  });
+
+  it("honors explicit pins even with firstUserGoal disabled", () => {
+    const msgs = [
+      MSGS[0],
+      MSGS[1],
+      { role: "user", content: "x", pinned: true },
+    ];
+    const isPinned = buildAutoPinPredicate(msgs, { firstUserGoal: false });
+    expect(isPinned(msgs[1])).toBe(false); // first user NOT auto-pinned
+    expect(isPinned(msgs[2])).toBe(true); // explicit pin still honored
+  });
+
+  it("skips a first user turn that exceeds the token cap", () => {
+    const big = { role: "user", content: "x".repeat(10_000) }; // ~2500 tokens
+    const msgs = [MSGS[0], big, MSGS[2]];
+    const isPinned = buildAutoPinPredicate(msgs, { maxPinTokens: 100 });
+    expect(isPinned(big)).toBe(false); // too big to pin
+  });
+
+  it("matches by identity, not by value (compaction filters the same array)", () => {
+    const isPinned = buildAutoPinPredicate(MSGS, true);
+    const clone = { ...MSGS[1] }; // same content, different object
+    expect(isPinned(clone)).toBe(false);
+  });
+});
+
+describe("describeAutoPin", () => {
+  it("reports disabled when off", () => {
+    expect(describeAutoPin(MSGS, false)).toEqual({
+      enabled: false,
+      reasons: [],
+    });
+  });
+  it("explains the original-task pin", () => {
+    const d = describeAutoPin(MSGS, true);
+    expect(d.enabled).toBe(true);
+    expect(d.reasons.some((r) => r.why.includes("original task"))).toBe(true);
+    expect(d.reasons[d.reasons.length - 1].preview).toContain(
+      "Refactor the auth",
+    );
+  });
+});