chainlesschain 0.162.149 → 0.162.151

package/src/gateways/ws/remote-session-protocol.js

@@ -7,6 +7,7 @@ import {
   RemoteSessionCryptoContext,
   createRemotePairingUri,
 } from "../../harness/remote-session-crypto.js";
+import { RemoteCommandLedger } from "../../harness/remote-command-ledger.js";
 
 const CLIENT_EVENT_SCOPES = Object.freeze({
   prompt: "prompt",
@@ -22,6 +23,62 @@ function audit(server, entry) {
   server.remoteSessionAudit?.record(entry);
 }
 
+/**
+ * Apply a remote-client control event (prompt / approval.resolve / interrupt)
+ * idempotently when it carries a stable `commandId`. This is the ACTUAL takeover
+ * path — a paired mobile/web device driving the host agent — and it does NOT
+ * flow through message-dispatcher's execute/stream ledger, so without this a
+ * prompt re-sent after a dropped connection would run the agent turn a SECOND
+ * time (Phase 5 acceptance "断网恢复后不会重复执行工具调用"). The side effect
+ * (audit + dispatch into the host session) runs AT MOST ONCE per commandId; a
+ * re-delivery gets a `replayed` ack instead. Byte-identical when the event
+ * carries no `commandId` (existing clients unchanged). deviceId is the
+ * AUTHENTICATED clientId, so a device can never spoof another's idempotency /
+ * ordering stream. A revoked device / stale seq is rejected without forwarding.
+ * Uses a ledger SEPARATE from the execute/stream one (`_commandLedger`) so the
+ * two paths keep independent per-device sequence spaces.
+ */
+async function applyControlIdempotent(server, clientId, ws, message, forward) {
+  // A direct-WS client puts the idempotency key at the message top level, but
+  // the RELAY path (`_handleRemoteEncryptedControl`) decrypts the whole mobile
+  // control payload into `message.event`, so a relay-paired mobile's commandId
+  // lands at `event.commandId`. Read either — otherwise the primary takeover
+  // path (relay-paired mobile) never consults the ledger and a reconnect
+  // re-runs the agent turn, defeating the entire Phase 5 guarantee.
+  const commandId = message.commandId ?? message.event?.commandId;
+  const seq = message.seq ?? message.event?.seq;
+  if (!commandId) return forward();
+  // Create the ledger SYNCHRONOUSLY (no await between the check and the assign)
+  // so two concurrent re-deliveries of the same commandId share ONE ledger and
+  // coalesce — a lazy `await import()` here would let each build its own ledger
+  // and both would execute, defeating the whole guarantee.
+  if (!server._remoteControlLedger) {
+    server._remoteControlLedger = new RemoteCommandLedger();
+  }
+  const outcome = await server._remoteControlLedger.apply(
+    { commandId, deviceId: clientId, seq },
+    async () => {
+      await forward();
+      return true;
+    },
+  );
+  if (outcome.status === "replayed") {
+    reply(server, ws, message.id, "remote-session-published", {
+      delivered: 0,
+      replayed: true,
+      commandId,
+      applyIndex: outcome.applyIndex,
+    });
+  } else if (outcome.status === "rejected") {
+    reply(server, ws, message.id, "error", {
+      code: "COMMAND_REJECTED",
+      commandId,
+      message: outcome.reason,
+    });
+  }
+  return outcome;
+}
+
 function attachPairingUri(server, result) {
   const relayUrl = server.remoteSessionRelayUrl;
   const hostPeerId = server.remoteSessionPeerId;
@@ -395,49 +452,60 @@ export async function handleRemoteSessionPublish(
         id: message.id,
         sessionId: session.agentSessionId,
       };
-      if (message.event.type === "prompt") {
-        if (
-          typeof message.event.content !== "string" ||
-          !message.event.content.trim()
-        ) {
-          throw new Error("prompt content is required");
-        }
-        // Record the shape, not the content — the audit trail must stay useful
-        // without hoarding potentially sensitive session prompts.
-        audit(server, {
-          sessionId: message.remoteSessionId,
-          actor: clientId,
-          action: "control.prompt",
-          detail: { chars: message.event.content.length },
-        });
-        handleSessionMessage(server, message.id, ws, {
-          ...controlMessage,
-          content: message.event.content,
-        });
-      } else if (message.event.type === "approval.resolve") {
-        audit(server, {
-          sessionId: message.remoteSessionId,
-          actor: clientId,
-          action: "control.approval",
-          detail: {
-            requestId: message.event.requestId || message.event.approvalId,
-            approved: message.event.answer ?? message.event.approved,
-          },
-        });
-        await handleSessionAnswer(server, message.id, ws, {
-          ...controlMessage,
-          requestId: message.event.requestId || message.event.approvalId,
-          answer: message.event.answer ?? message.event.approved,
-        });
-      } else if (message.event.type === "interrupt") {
-        audit(server, {
-          sessionId: message.remoteSessionId,
-          actor: clientId,
-          action: "control.interrupt",
-          detail: null,
-        });
-        await handleSessionInterrupt(server, message.id, ws, controlMessage);
+      // Validate up-front so a malformed control event errors identically
+      // whether or not it carries a commandId — idempotency must never change
+      // validation semantics (a bad prompt must not consume a commandId slot).
+      if (
+        message.event.type === "prompt" &&
+        (typeof message.event.content !== "string" ||
+          !message.event.content.trim())
+      ) {
+        throw new Error("prompt content is required");
       }
+      // Idempotent forward: a control event with a stable commandId runs its
+      // side effect (audit + dispatch into the host agent) AT MOST ONCE, so a
+      // reconnecting device re-sending the same prompt/approval/interrupt gets a
+      // `replayed` ack instead of a second agent turn. No commandId → forwarded
+      // directly, byte-identical to before.
+      await applyControlIdempotent(server, clientId, ws, message, async () => {
+        if (message.event.type === "prompt") {
+          // Record the shape, not the content — the audit trail must stay
+          // useful without hoarding potentially sensitive session prompts.
+          audit(server, {
+            sessionId: message.remoteSessionId,
+            actor: clientId,
+            action: "control.prompt",
+            detail: { chars: message.event.content.length },
+          });
+          handleSessionMessage(server, message.id, ws, {
+            ...controlMessage,
+            content: message.event.content,
+          });
+        } else if (message.event.type === "approval.resolve") {
+          audit(server, {
+            sessionId: message.remoteSessionId,
+            actor: clientId,
+            action: "control.approval",
+            detail: {
+              requestId: message.event.requestId || message.event.approvalId,
+              approved: message.event.answer ?? message.event.approved,
+            },
+          });
+          await handleSessionAnswer(server, message.id, ws, {
+            ...controlMessage,
+            requestId: message.event.requestId || message.event.approvalId,
+            answer: message.event.answer ?? message.event.approved,
+          });
+        } else if (message.event.type === "interrupt") {
+          audit(server, {
+            sessionId: message.remoteSessionId,
+            actor: clientId,
+            action: "control.interrupt",
+            detail: null,
+          });
+          await handleSessionInterrupt(server, message.id, ws, controlMessage);
+        }
+      });
       return;
     }
 

package/src/harness/jsonl-session-store.js

@@ -438,12 +438,19 @@ function performLegacySessionMigration(sourcePath, options) {
     }
 
     const validation = validateJsonlSession(sessionId);
-    if (
-      !validation.valid ||
-      validation.messageCount !== legacy.messages.length
-    ) {
+    // Verify EVERY legacy message persisted, by event count — NOT by
+    // `messageCount`, which counts only user_message/assistant_message events.
+    // A legacy `system` message becomes a `system` event and a `tool` message a
+    // `tool_result` event (see appendLegacyMessage); neither is a "message" by
+    // that count, so comparing messageCount to legacy.messages.length wrongly
+    // FAILED migration for any session with a system prompt or tool call.
+    // appendLegacyMessage writes exactly one event per message, plus the leading
+    // session_start and an optional trailing summary event.
+    const expectedEvents =
+      1 + legacy.messages.length + (legacy.summary ? 1 : 0);
+    if (!validation.valid || validation.eventCount !== expectedEvents) {
       throw new Error(
-        `post-migration validation failed for ${sessionId} (${validation.messageCount}/${legacy.messages.length} messages)`,
+        `post-migration validation failed for ${sessionId} (${validation.eventCount}/${expectedEvents} events)`,
       );
     }
 

package/src/harness/plugin-manager.js

@@ -11,6 +11,7 @@ import crypto from "crypto";
 import fs from "fs";
 import path from "path";
 import { getElectronUserDataDir } from "../lib/paths.js";
+import { escapeLike } from "../lib/sql-like.js";
 
 /**
  * Ensure plugin tables exist.
@@ -288,11 +289,15 @@ export function registerInMarketplace(db, pluginInfo) {
  */
 export function searchRegistry(db, query) {
   ensurePluginTables(db);
+  // Escape LIKE metacharacters so a query containing % or _ is matched
+  // literally — otherwise `cc plugin search "%"` (or any term with _) is treated
+  // as a wildcard and matches EVERY registry row instead of the intended text.
+  const pattern = `%${escapeLike(query)}%`;
   return db
     .prepare(
-      "SELECT * FROM plugin_registry WHERE name LIKE ? OR description LIKE ? ORDER BY downloads DESC",
+      "SELECT * FROM plugin_registry WHERE name LIKE ? ESCAPE '\\' OR description LIKE ? ESCAPE '\\' ORDER BY downloads DESC",
     )
-    .all(`%${query}%`, `%${query}%`);
+    .all(pattern, pattern);
 }
 
 /**
@@ -352,7 +357,11 @@ export function installPluginSkills(db, pluginName, pluginPath, skills) {
   const installed = [];
 
   for (const skill of skills) {
-    if (!skill || typeof skill.name !== "string" || typeof skill.path !== "string") {
+    if (
+      !skill ||
+      typeof skill.name !== "string" ||
+      typeof skill.path !== "string"
+    ) {
       continue;
     }
     const srcDir = path.resolve(pluginPath, skill.path);
@@ -363,7 +372,10 @@ export function installPluginSkills(db, pluginName, pluginPath, skills) {
     if (!fs.existsSync(srcDir)) continue;
 
     const destDir = path.join(marketplaceDir, skill.name);
-    if (!_isWithin(marketplaceDir, destDir) || path.resolve(destDir) === path.resolve(marketplaceDir)) {
+    if (
+      !_isWithin(marketplaceDir, destDir) ||
+      path.resolve(destDir) === path.resolve(marketplaceDir)
+    ) {
       continue;
     }
     fs.mkdirSync(destDir, { recursive: true });

package/src/harness/remote-command-ledger.js

@@ -28,6 +28,7 @@ export class RemoteCommandLedger {
     this._order = []; // applyIndex → commandId (total order)
     this._revoked = new Set(revokedDevices);
     this._perDeviceSeq = new Map(); // deviceId → highest accepted seq
+    this._inFlight = new Map(); // commandId → Promise<record> for an in-progress apply
   }
 
   isRevoked(deviceId) {
@@ -73,6 +74,28 @@ export class RemoteCommandLedger {
       };
     }
 
+    // Coalesce CONCURRENT deliveries of the same commandId. `execute` is awaited
+    // below, so without this a second delivery arriving while the first is still
+    // running would ALSO pass the `prior` check (nothing is recorded until
+    // execute resolves) and run the side effect a SECOND time — the exact
+    // double-exec this ledger exists to prevent on reconnect. An already-in-flight
+    // same-commandId delivery waits for it and returns its result as `replayed`.
+    const inflight = this._inFlight.get(commandId);
+    if (inflight) {
+      try {
+        const rec = await inflight;
+        return {
+          status: "replayed",
+          result: rec.result,
+          applyIndex: rec.applyIndex,
+        };
+      } catch {
+        // The in-flight execution failed → it recorded nothing and is retryable;
+        // report rejection to this caller too (it can retry the same commandId).
+        return { status: "rejected", reason: "concurrent execution failed" };
+      }
+    }
+
     // Optional per-device monotonic sequence check: a STALE seq (below what we've
     // already accepted from this device) with a NEW commandId is a protocol
     // violation (a genuine reconnect resends the SAME commandId, caught above).
@@ -85,28 +108,36 @@ export class RemoteCommandLedger {
       return { status: "rejected", reason: "stale sequence" };
     }
 
-    let result;
+    // Reserve the commandId BEFORE the first await so a concurrent same-id
+    // delivery (above) sees it in flight. The promise records the applied result
+    // on success and rejects on failure (so a retry can re-run the side effect).
+    const runPromise = (async () => {
+      const result = await execute(command);
+      const applyIndex = this._order.length;
+      const rec = { applyIndex, result, deviceId, ts: this._now() };
+      this._applied.set(commandId, rec);
+      this._order.push(commandId);
+      if (deviceId != null && Number.isFinite(command.seq)) {
+        this._perDeviceSeq.set(deviceId, command.seq);
+      }
+      return rec;
+    })();
+    this._inFlight.set(commandId, runPromise);
     try {
-      result = await execute(command);
+      const rec = await runPromise;
+      return {
+        status: "applied",
+        result: rec.result,
+        applyIndex: rec.applyIndex,
+      };
     } catch (err) {
       // A failed execution is NOT recorded as applied — the command may be
       // retried (with the same commandId) and will run again. Surfacing the
       // error lets the caller decide; idempotency only protects SUCCESSES.
       return { status: "rejected", reason: `execute failed: ${err.message}` };
+    } finally {
+      this._inFlight.delete(commandId);
     }
-
-    const applyIndex = this._order.length;
-    this._applied.set(commandId, {
-      applyIndex,
-      result,
-      deviceId,
-      ts: this._now(),
-    });
-    this._order.push(commandId);
-    if (deviceId != null && Number.isFinite(command.seq)) {
-      this._perDeviceSeq.set(deviceId, command.seq);
-    }
-    return { status: "applied", result, applyIndex };
   }
 
   /**

package/src/harness/worktree-isolator.js

@@ -629,19 +629,29 @@ function _conflictStatusCode(repoDir, filePath) {
 }
 
 function _mapConflictType(statusCode) {
+  // NOTE: the porcelain XY code is reported relative to the ACTUAL merge, which
+  // previewWorktreeMerge/applyWorktreeAutomationCandidate run as `git merge
+  // <base>` INSIDE the agent worktree — i.e. ours=agent, theirs=base, the
+  // REVERSE of the "current merges in the agent branch" direction the candidate
+  // labels/suggestions describe. For symmetric codes (UU/AA) direction is
+  // irrelevant. For the asymmetric delete/add codes the U/D (us/them) halves
+  // must be swapped back to the label direction, otherwise the "keep the file"
+  // candidate checks out the side that DELETED it (`git checkout --ours/--theirs`
+  // → "path does not have our/their version") and throws — leaving no automated
+  // way to preserve the surviving file.
   switch (statusCode) {
     case "UU":
       return "both_modified";
     case "AA":
       return "both_added";
-    case "DU":
-      return "deleted_by_us";
-    case "UD":
+    case "DU": // ours(agent) deleted, theirs(base) modified
       return "deleted_by_them";
-    case "AU":
-      return "added_by_us";
-    case "UA":
+    case "UD": // ours(agent) modified, theirs(base) deleted
+      return "deleted_by_us";
+    case "AU": // added by ours(agent)
       return "added_by_them";
+    case "UA": // added by theirs(base)
+      return "added_by_us";
     default:
       return "unmerged";
   }

package/src/index.js

@@ -7,6 +7,7 @@ import { registerStatusCommand } from "./commands/status.js";
 import { registerServicesCommand } from "./commands/services.js";
 import { registerConfigCommand } from "./commands/config.js";
 import { registerUpdateCommand } from "./commands/update.js";
+import { registerChangelogCommand } from "./commands/changelog.js";
 import { registerDoctorCommand } from "./commands/doctor.js";
 import { registerPairCommand } from "./commands/pair.js";
 import { registerNotificationCommand } from "./commands/notification.js";
@@ -418,6 +419,7 @@ export function createProgram(opts = {}) {
   registerServicesCommand(program);
   registerConfigCommand(program);
   registerUpdateCommand(program);
+  registerChangelogCommand(program);
   registerDoctorCommand(program);
   registerPairCommand(program);
   registerNotificationCommand(program);

package/src/lib/__tests__/logger.test.js

@@ -70,9 +70,12 @@ describe("quiet mode", () => {
     expect(logSpy).not.toHaveBeenCalled();
   });
 
-  it("does NOT suppress warn (still console.log)", () => {
+  it("does NOT suppress warn (writes to console.error/stderr)", () => {
     warn("careful");
-    expect(logSpy).toHaveBeenCalledTimes(1);
+    // warn goes to stderr (not stdout) so it never pollutes machine-readable
+    // stdout like `--json`; still never suppressed by quiet mode.
+    expect(errSpy).toHaveBeenCalledTimes(1);
+    expect(logSpy).not.toHaveBeenCalled();
   });
 
   it("does NOT suppress error", () => {

package/src/lib/a2a-protocol.js

@@ -5,7 +5,6 @@
  * capability negotiation, and peer discovery.
  */
 
-
 // Safe JSON-array parse for values read back from the DB (capabilities / skills /
 // history / artifacts are stored as JSON strings). Written via JSON.stringify so
 // normally valid, but a corrupted or externally-edited DB must not crash agent
@@ -523,6 +522,31 @@ export function getCardStatusV2(cardId) {
   return _v2Cards.get(cardId)?.status || "active";
 }
 
+/**
+ * Hydrate the in-memory _v2Cards Map from the DB. The CLI is one-shot: _v2Cards
+ * starts empty every process, so getCardStatusV2 always fell back to "active"
+ * and setCardStatus validated transitions against a phantom "active" prev-state
+ * — even though setCardStatus dual-writes the real status to a2a_agent_cards
+ * (which `peers`/`discover` read correctly). Call after ensureA2ATables(db)
+ * before reading or transitioning a persisted card's status.
+ */
+export function loadCardsFromDb(db) {
+  if (!db) return 0;
+  ensureA2ATables(db);
+  _v2Cards.clear();
+  const rows = db
+    .prepare(`SELECT id, status, updated_at FROM a2a_agent_cards`)
+    .all();
+  for (const r of rows) {
+    _v2Cards.set(r.id, {
+      cardId: r.id,
+      status: r.status || "active",
+      updatedAt: r.updated_at,
+    });
+  }
+  return _v2Cards.size;
+}
+
 // ─── Task lifecycle V2 ───────────────────────────────────────────
 
 /**

package/src/lib/activitypub-bridge.js

@@ -62,6 +62,67 @@ export function ensureActivityPubTables(db) {
   `);
 }
 
+/**
+ * Rehydrate _actors/_activities/_follows from the persisted ap_actors/
+ * ap_activities/ap_follows tables. The `cc` CLI runs every command in a fresh
+ * process, so without this the Maps start empty and an actor created / note
+ * published / follow made in a prior invocation is invisible (`cc ap actor
+ * list`/`outbox`/`followers`/`search` return nothing, and read paths first hit
+ * _requireActor against the empty _actors → "Actor not found"). Call after
+ * ensureActivityPubTables(db).
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  _actors.clear();
+  _activities.clear();
+  _follows.clear();
+
+  const actorRows = db.prepare(`SELECT * FROM ap_actors`).all();
+  for (const row of actorRows) {
+    const id = row.id;
+    // Derived fields (type/preferredUsername/inbox/outbox/followers/following)
+    // are not persisted — reconstruct them from id exactly as createActor does.
+    _actors.set(id, {
+      id,
+      type: "Person",
+      username: row.username ?? null,
+      preferredUsername: row.username ?? null,
+      name: row.name ?? null,
+      summary: row.summary ?? null,
+      inbox: row.inbox_url ?? `${id}/inbox`,
+      outbox: row.outbox_url ?? `${id}/outbox`,
+      followers: `${id}/followers`,
+      following: `${id}/following`,
+      isLocal: !!row.is_local,
+      createdAt: row.created_at ?? null,
+    });
+  }
+
+  const activityRows = db.prepare(`SELECT * FROM ap_activities`).all();
+  for (const row of activityRows) {
+    let activity;
+    try {
+      activity = row.object_json ? JSON.parse(row.object_json) : null;
+    } catch {
+      activity = null;
+    }
+    if (!activity || !activity.id) continue; // can't reconstruct without it
+    _activities.set(activity.id, {
+      direction: row.direction,
+      ownerId: row.owner_id,
+      activity,
+    });
+  }
+
+  const followRows = db.prepare(`SELECT * FROM ap_follows`).all();
+  for (const row of followRows) {
+    const key = `${row.follower_id}|${row.followee_id}`;
+    _follows.set(key, { state: row.state, createdAt: row.created_at ?? null });
+  }
+
+  return _actors.size + _activities.size + _follows.size;
+}
+
 /* ── Helpers ───────────────────────────────────────────────── */
 
 function _now() {

package/src/lib/agent-core.js

@@ -28,6 +28,7 @@ export {
   listBackgroundShellTasks,
   killBackgroundShellTask,
   killAllBackgroundShellTasks,
+  killAllBackgroundShellTasksSync,
   reapIdleBackgroundShellTasks,
   _ingestSearchOutput,
   writeFileVerified,
@@ -43,5 +44,6 @@ export {
   _anthropicThinkingParams,
   _normalizeAnthropicResponse,
   _resetFileFreshness,
+  _getSharedCodeIntel,
   disposeSharedCodeIntel,
 } from "../runtime/agent-core.js";