chainlesschain 0.162.151 → 0.162.153

package/src/data/changelog.json

@@ -3,11 +3,26 @@
   "releases": [
     {
       "productVersion": "Unreleased",
-      "cliVersion": "0.162.151",
-      "cliVersions": ["0.162.150", "0.162.151"],
+      "cliVersion": "0.162.153",
+      "cliVersions": [
+        "0.4.46",
+        "0.37.4",
+        "0.162.150",
+        "0.162.151",
+        "0.162.152",
+        "0.162.153"
+      ],
       "date": null,
       "title": "",
       "sections": [
+        {
+          "heading": "Added — cc CLI 0.162.153：上游 Claude Code parity 封顶 2.1.191 → 2.1.204（6 项，CLI-only npm 发版）",
+          "body": "> `chainlesschain` 0.162.152 → **0.162.153** 已发 npm `latest`（经 `npm-publish.yml`，`--provenance --access public`）。纯 `packages/cli/src` 增量，未触 `pdh/lib` → 无 Android cc bundle rollover / 无 USR_VERSION 改动。逐项经 Explore-agent grep 坐实上游 changelog（2.1.192→2.1.204）后落地，全部带回归测试（新增约 30 项）；发版前本机三层全绿（unit+integration+e2e）。命令数不变（164；`cc team run --otlp` 只新增 option 非新命令）。判定明细 + N-A 清单见项目记忆 `cli-parity-gap-backlog`。\n\n- **`spawn_sub_agent` 后台模式（2.1.198）**：`background:true` 令子代理立即返回「running」句柄、父循环继续工作，结果在后续轮自动注水为 user-role 消息喂给模型；若模型想收尾但仍有后台子代理未决，循环**等待全部完成 + 注入结果 + 再给一轮**——后台成果永不静默丢失（迭代预算仍是兜底）。父 abort 信号前传防孤儿；settle-capture 包装永不 reject（未消费句柄不会变未处理 rejection）；SubagentStop 钩子改在结果送达时 fire。opt-in 逐调用，省略 `background` 则阻塞路径字节不变。\n- **子代理中途失败/预算截断返回部分成果（2.1.199）**：被 API 错误（限流/掉线）或 token 预算截断的子代理此前丢弃已产出的一切（父级只见 `Sub-agent failed: <msg>` + 空 artifacts）；现失败/强制完成结果把已产出内容摘要并入 summary（父模型唯一可见的通道）并保留截断前收集的 artifacts。\n- **交互权限询问 idle timeout（2.1.200）**：无人应答的权限询问此前永久阻塞整个 agent turn（`rl.question` 无超时）；两个交互确认点（settings/hook `ask` + ApprovalGate）现把询问与可配置的空闲超时竞速，静默时**自动 DENY**（无人值守下 deny 是唯一安全答案）。默认关（行为字节不变），`CC_PERMISSION_ASK_TIMEOUT_MS` 环境变量或 config `permissions.askTimeoutMs` 开启；布尔/对象配置值按「非超时」拒绝。\n- **MCP roots 能力（2.1.203）**：roots 是**客户端**能力——服务器向客户端发 `roots/list` 请求索要工作区根、并订阅 `notifications/roots/list_changed`。此前**任何**服务器发起的请求都落进 `_handleMessage` 的通知分支、永不应答 → 服务器挂到自己超时。现客户端在 `initialize` 声明 `roots(listChanged)`、以会话工作目录（显式 `roots` 或 `process.cwd()`，`file://` URI）应答 `roots/list`、ack `ping`、未知服务器请求回 JSON-RPC `-32601` 而非静默；`setRoots()`/`notifyRootsListChanged()` 广播变更通知，REPL `/cd` 成功 chdir 后通知已连服务器。\n- **workflow 级 OTel 追踪属性 + `cc team run --otlp`（2.1.202）**：`TelemetryRecorder` 加 `defaultAttributes`（构造）+ `setDefaultAttribute()`——盖在每个 span 上，per-span 键优先；`agentLoop` 把 `workflow.run_id`（run id）+ 可选 `options.workflowName` 盖到本 run 全部 model/tool span。`TeamRunner` 接可选 recorder、每次执行发一个 `team.task` span（task key/holder/attempts；被丢弃的完成打标；失败记为 `task_failure` + error 状态）。新 `cc team run --otlp <file>` 写出以 team run id + 任务图文件名标记的 OTLP/JSON。真机验证：2 任务图 dry-run 产出 2 个共享同一 `workflow.run_id` 的 span。\n- **config.json 损坏先备份再降级（2.1.199）**：`loadConfig` 遇坏 config 此前已优雅降级（warn 一次 + 内存默认，读时不覆盖），但随后一跑 `cc config set` 的 load-modify-**save** 会原子替换坏文件为默认+新值，静默销毁用户仍留在坏 JSON 里的东西（API key / 自定义 baseUrl）。现首次失败加载把文件复制到 `config.json.corrupted`（固定同名、best-effort、每进程一次），警告指向它。"
+        },
+        {
+          "heading": "Fixed — cc CLI 0.162.152：全面体检 13 修复 + auto-pin 默认开 + 远控幂等激活 + 多语言 LSP/内核沙箱 CI 真机验证（CLI-only npm 发版）",
+          "body": "> `chainlesschain` 0.162.151 → **0.162.152** 已发 npm `latest`（经 `npm-publish.yml`，`--provenance --access public`）。纯 `packages/cli/src` + `packages/web-panel`（随 `prepublishOnly build:web-panel` 打入包）增量，未触 `pdh/lib` → 无 Android cc bundle rollover / 无 USR_VERSION 改动。发版前本机三层全绿（unit+integration+e2e 23,167 passed / 0 fail）+ 新 `env-blocked-verification.yml` CI 门（真 gopls/rust-analyzer/jdtls 三语言 LSP + 真 bubblewrap 内核隔离，ubuntu）跑通。命令数不变（164）。\n\n- **安全（HIGH）插件签名锁可伪造绕过 `requireSignedPlugins`**：`.plugin-lock.json` 原是可写目录里的自断言 JSON（布尔字段+自选哈希，load 只重哈希不验签；install 还会把源目录自带的伪造 lock 原样拷入；组织没配 `trustedPluginKeySha256` 时 key 检查整个跳过）。改为 lock v2 落真 Ed25519 签名+公钥、load 时**真验签**、trust 指纹从嵌入公钥现算（永不信 lock 字段）、install 无条件剥离源自带 lock、`requireSignedPlugins`+空 key 名单 fail-closed 全拒。3 条 ATTACK 回归测试。\n- **安全：插件远程 registry 拒纯 HTTP**（registry 同时供 source+sha256，MITM 二者全控=完整性检查空转；loopback 豁免、`--allow-insecure-registry`/`CC_PLUGIN_REGISTRY_ALLOW_HTTP=1` 显式 opt-in）+ **fetchGitRepo 拒 `-` 开头 url/ref**（git argv 注入：registry 供的 ref=\"-f\" 在 full-clone retry 路径被 `checkout` 当选项；注意 `checkout -- <ref>` 是错修——`--` 后是 pathspec）。\n- **eval 反作弊三连**：`fix-failing-test`/`fix-build`/`upgrade-dependency` 的 do-not-edit harness 文件从 presence-regex（可被「文本还在但不执行」绕过：前插 `ALL OK`+exit(0)、重写 build.mjs 自定义 banner、run.mjs 干脆零守卫）改为逐字节比对模块常量；4 条作弊回归全在 pre-fix 代码上验 RED。\n- **远控账本双修**：`_perDeviceSeq` 乱序完成回退水位（新 commandId 复用旧 seq 本应拒 stale 实际 applied，真机复现）改 advance-only `Math.max`；`_applied/_order` 随 `cc serve` 无界涨（实测 5 万条 snapshot 14.3MB）加保留窗口（默认 1 万条、分块淘汰、`_baseIndex` 保 applyIndex 全局单调、snapshot 兼容旧格式，实测封顶 4.3MB）。\n- **`cc team` 三修**：runner 层 lease 心跳（内建 shell/agent executor 从不 renew → 超 TTL 长任务被 peer steal **并发双跑**，真时钟回归测试 pre-fix 红）；`dependsOn` 拼错 key 现在 load 时报错（原静默 exit 1 + plan 波次悄悄少块）；`--state` 快照 tmp+rename 原子写（写中崩溃不再截断唯一 resume 文件）。\n- **eval 基建双修**：超时改整树击杀（POSIX detached 组 / Win `taskkill /T /F`）+ 等 `close` 再 settle（原 kill 后立即 resolve，agent 还活着写文件时就快照/check/删目录）；`--dry-run --history` 记录打 `dryRun:true` 且 `--trend` 排除（dry-run 恒 0%，原污染 CI 回归门造成全任务假回归）。\n- **OTLP 合规双修**：`*UnixNano` 时间戳改十进制字符串（ms×1e6≈1.8e18 超 2^53，JSON number 违 proto3 mapping、严格 collector 拒收）；traceId 掺进程启动时间+pid（原裸计数器每进程重置 → 连续 run 全是 `0…01` 被 collector 并成一条 trace）。\n- **LSP 双修（多语言 CI 真机验证抓获）**：`normalizeUri` 统一盘符冒号编码（gopls 把 publish URI 重写成裸 `C:/` 而客户端 didOpen 用 `C%3A/`，诊断 Map key 永不相遇 → **Go 诊断恒空**；tsserver/pyright 原样回显故此前未暴露）；读查询（def/refs/hover/symbols/diag/rename-preview）对 LSP `-32801 ContentModified` 有界重试（rust-analyzer 索引未稳时高频抛出，语义即「请重试」）。\n- **bwrap 沙箱挂载顺序**：`--tmpfs /tmp` 原在工作区 bind 之后挂载，遮蔽任何位于 /tmp 下的工作区（chdir 直接失败、沙箱不可用）；tmpfs 移到 bind 之前（bwrap 顺序挂载、后挂者胜）。\n- **Added：auto-pin 默认开启（产品拍板）**：compaction 现在默认 pin 原始任务（首个 user 轮，token 上限 2000）防长会话跑偏；优先级 `--auto-pin` flag > `CC_AUTO_PIN`(\"1\"/\"0\") > config `context.autoPin` > 默认开；关= `CC_AUTO_PIN=0` 或 config false。\n- **Added：远控客户端发送 commandId/seq，Phase 5 幂等保护端到端激活**：web-panel 直连 `execute` 带顶层 uuid commandId + 抗页面重载单调 seq + per-TAB deviceId，断线后**同 id 重发一次**（服务端 ledger 保至多一次，`replayed` ack 如实上报）；web/Android 的 E2EE 控制事件（prompt/approval/interrupt）把 commandId+per-pairing seq 打进加密明文（relay 本身 at-least-once 补投 offline-message——无 id 时补投的 prompt 会多跑一整个 agent turn）。勘误：所谓 Terminal 远程客户端不存在（cli 包内无此进程），客户端发送侧已全覆盖。\n- **Added：`env-blocked-verification.yml` CI 门**：ubuntu 真机跑三语言 LSP live 套（gopls/rust-analyzer/jdtls 各 def/refs/diag，`CC_LSP_LIVE_REQUIRE` 使装失败=红而非静默 skip）+ 真 bubblewrap 内核隔离套（netns 断网证明「无视 proxy env 的工具」也被拦、rootfs 只读、denyRead tmpfs 掩蔽）；零 `continue-on-error`。\n- **desktop（不随 npm 包，同批落 main）**：SSO IPC 四 handler 端到端修复（refresh-token 传参形状错+读错 store、logout 把 providerId 当 sessionId 致 provider 侧撤销从未发生、handle-callback 会话 id 不达 renderer、get-sessions 恒空——统一路由到权威 SSOManager store）。"
+        },
         {
           "heading": "Added — cc CLI `cc changelog`（别名 `cc whatsnew`）命令：npm 包每版更新说明离线可查",
           "body": "> CLI-only 发版（`chainlesschain` 0.162.150 → **0.162.151**，经 `npm-publish.yml` 发 npm `latest`，`--provenance --access public`）。纯 `packages/cli/src` 增量（新增 `commands/changelog.js` + `lib/changelog.js` 解析器 + `scripts/build-changelog.mjs` 构建器 + 生成的 `src/data/changelog.json`），未触 `pdh/lib` → 无 Android cc bundle rollover / 无 USR_VERSION 改动。命令数 163 → **164**（清单已重生）。新增解析器 + 命令共 39 项单测本机全绿。\n\n- **命令**：`cc changelog` 显示当前版本 + 最近 5 条 CLI 更新（`← installed` 标出装机版）；`--all` 全部历史、`<version>` 指定版本（吃 CLI 版本 `0.162.150` 或产品版本 `v5.0.3.134` / 裸 `134`）、`-n/--limit` 控制条数、`--json` 机器可读。数据**离线随包**，无网络依赖、永远和装机版本对齐。\n- **数据源与「只显示 CLI 相关条目」**：唯一权威更新记录是根 `CHANGELOG.md`（按**产品版本** `v5.0.3.x` 组织），解析器把它蒸馏成 **CLI 专属**子集。难点是区分「真·CLI 发版」与「只捎带 bump 了 cli 版本号的 PDH/安卓采集器发版」，三道闸：① CLI npm 在 `0.x` alpha 轨、产品在 `5.x` → 版本 token 只取 `0.x`，天然滤掉 `v5.0.3.x` 误抓；② 大小写敏感的 `CLI` → 真 CLI 标题写大写「CLI/cc CLI」，捎带的 bundle note 写小写「cli 0.162.x」；③ 无 `###` 子标题的块只看 `##` 标题（每块都有 `Version surfaces: CLI 0.x` 样板行，信正文会全放行）。从 112 个产品版本块精准抽出 11 个真 CLI 发版（拼多多采集 / 浏览历史等 PDH 发版正确排除）。\n- **打包**：`build:changelog` 脚本在发版时（挂进 `prepublishOnly`）把 CHANGELOG 解析成 `src/data/changelog.json`（~30KB，CLI 子集），随 `src/` 一起发 npm；in-repo dev 无 JSON 时 `loadChangelog()` 回退直接解析根 CHANGELOG。"

package/src/harness/mcp-client.js

@@ -10,6 +10,7 @@
 
 import { spawn } from "child_process";
 import { EventEmitter } from "events";
+import { pathToFileURL } from "url";
 import { safeJsonParse } from "../lib/safe-json.js";
 
 /**
@@ -147,6 +148,8 @@ export class MCPClient extends EventEmitter {
    * @param {object} [options]
    * @param {string|null} [options.sessionId] agent session id advertised to
    *   spawned stdio MCP servers (CC_SESSION_ID / CLAUDE_CODE_SESSION_ID env).
+   * @param {string[]} [options.roots] workspace root directories exposed to
+   *   servers via the MCP roots capability. Defaults to the process cwd.
    */
   constructor(options = {}) {
     super();
@@ -156,6 +159,13 @@ export class MCPClient extends EventEmitter {
     this._reconnecting = new Map(); // name → in-flight reconnect promise
     this._sessionId =
       options && options.sessionId != null ? String(options.sessionId) : null;
+    // MCP roots capability (Claude-Code 2.1.203 parity): servers may ask the
+    // client for its workspace roots (`roots/list`, a server→client request).
+    // null = derive from process.cwd() at answer time.
+    this._roots =
+      options && Array.isArray(options.roots) && options.roots.length > 0
+        ? options.roots.map(String)
+        : null;
   }
 
   /**
@@ -168,6 +178,52 @@ export class MCPClient extends EventEmitter {
     this._sessionId = id != null && id !== "" ? String(id) : null;
   }
 
+  /**
+   * Current workspace roots in MCP wire shape (`file://` URIs). Falls back to
+   * the process cwd when no explicit roots were configured, so every session
+   * always advertises its working directory.
+   * @returns {Array<{uri: string, name: string}>}
+   */
+  listRoots() {
+    const dirs = this._roots || [process.cwd()];
+    const roots = [];
+    for (const dir of dirs) {
+      try {
+        roots.push({ uri: pathToFileURL(dir).href, name: dir });
+      } catch {
+        // An unconvertible path (bad injected value) is skipped, not fatal.
+      }
+    }
+    return roots;
+  }
+
+  /**
+   * Replace the advertised workspace roots and notify every connected server
+   * (`notifications/roots/list_changed`) so it can re-query `roots/list`.
+   * Call on working-directory changes (e.g. the REPL's /cd).
+   * @param {string[]|null} dirs - absolute directories; null/[] = cwd default
+   */
+  setRoots(dirs) {
+    const next =
+      Array.isArray(dirs) && dirs.length > 0 ? dirs.map(String) : null;
+    const changed = JSON.stringify(next) !== JSON.stringify(this._roots);
+    this._roots = next;
+    if (changed) this.notifyRootsListChanged();
+  }
+
+  /**
+   * Broadcast `notifications/roots/list_changed` to every connected server.
+   * Also for callers whose roots derive from process.cwd() (the default):
+   * after a chdir the root LIST is different even though `_roots` (null =
+   * "derive from cwd") did not change, so setRoots can't detect it.
+   */
+  notifyRootsListChanged() {
+    for (const [name, entry] of this.servers) {
+      if (entry.state !== ServerState.CONNECTED) continue;
+      this._sendNotification(name, "notifications/roots/list_changed", {});
+    }
+  }
+
   /**
    * Environment a spawned stdio MCP server inherits to identify the agent it
    * runs under (Claude-Code 2.1.154 / 2.1.163 parity). `CLAUDECODE` (parity)
@@ -338,7 +394,14 @@ export class MCPClient extends EventEmitter {
       // Initialize MCP protocol (retried on transient network errors).
       const initResult = await this._requestWithRetry(name, "initialize", {
         protocolVersion: "2024-11-05",
-        capabilities: { tools: {}, resources: {}, prompts: {} },
+        capabilities: {
+          tools: {},
+          resources: {},
+          prompts: {},
+          // Client-side roots capability: servers may request roots/list and
+          // subscribe to list_changed notifications (Claude-Code 2.1.203).
+          roots: { listChanged: true },
+        },
         clientInfo: { name: "chainlesschain-cli", version: "0.37.9" },
       });
 
@@ -969,6 +1032,15 @@ export class MCPClient extends EventEmitter {
       return;
     }
 
+    // Server → client REQUEST (has both an id and a method, and the id is not
+    // one of ours). Previously these fell into the notification branch and
+    // never got a response, so a server calling e.g. roots/list hung until its
+    // own timeout. Answer the ones our advertised capabilities invite.
+    if (msg.id !== undefined && msg.method) {
+      this._handleServerRequest(serverName, msg);
+      return;
+    }
+
     // Server notification
     if (msg.method) {
       this.emit("notification", {
@@ -978,6 +1050,48 @@ export class MCPClient extends EventEmitter {
       });
     }
   }
+
+  /**
+   * Answer a server-initiated JSON-RPC request. `roots/list` returns the
+   * session's workspace roots (we advertise the roots capability); `ping`
+   * gets an empty ack per spec. Anything else is answered with a JSON-RPC
+   * method-not-found error instead of silence, so the server fails fast.
+   */
+  _handleServerRequest(serverName, msg) {
+    const { id, method } = msg;
+    if (method === "roots/list") {
+      this._sendResponse(serverName, id, { roots: this.listRoots() });
+      return;
+    }
+    if (method === "ping") {
+      this._sendResponse(serverName, id, {});
+      return;
+    }
+    this._sendResponse(serverName, id, undefined, {
+      code: -32601,
+      message: `method not found: ${method}`,
+    });
+  }
+
+  /**
+   * Write a JSON-RPC response back to a stdio server. HTTP transports cannot
+   * deliver server-initiated requests to this client (no persistent SSE GET
+   * stream is held), so there is never a response to send there.
+   */
+  _sendResponse(serverName, id, result, error) {
+    const entry = this.servers.get(serverName);
+    if (!entry || !entry.process) return;
+    const message = JSON.stringify(
+      error !== undefined
+        ? { jsonrpc: "2.0", id, error }
+        : { jsonrpc: "2.0", id, result },
+    );
+    try {
+      entry.process.stdin.write(message + "\n");
+    } catch {
+      // Ignore response write errors (server may have just exited)
+    }
+  }
 }
 
 /**

package/src/harness/remote-command-ledger.js

@@ -22,10 +22,21 @@
  */
 
 export class RemoteCommandLedger {
-  constructor({ now = () => Date.now(), revokedDevices = [] } = {}) {
+  constructor({
+    now = () => Date.now(),
+    revokedDevices = [],
+    maxApplied = 10000,
+  } = {}) {
     this._now = typeof now === "function" ? now : () => now;
     this._applied = new Map(); // commandId → { applyIndex, result, deviceId, ts }
-    this._order = []; // applyIndex → commandId (total order)
+    this._order = []; // retained tail; applyIndex of _order[i] = _baseIndex + i
+    this._baseIndex = 0; // applyIndex of _order[0] (advances as old entries evict)
+    // Retention window: a long-lived `cc serve` would otherwise grow the ledger
+    // (and its snapshot) without bound — ~14 MB per 50k commands measured. The
+    // window must stay large relative to the reconnect-redelivery horizon: a
+    // commandId evicted from the window loses idempotency protection and would
+    // re-execute if re-delivered afterwards.
+    this._maxApplied = Math.max(1, Number(maxApplied) || 10000);
     this._revoked = new Set(revokedDevices);
     this._perDeviceSeq = new Map(); // deviceId → highest accepted seq
     this._inFlight = new Map(); // commandId → Promise<record> for an in-progress apply
@@ -113,13 +124,22 @@ export class RemoteCommandLedger {
     // on success and rejects on failure (so a retry can re-run the side effect).
     const runPromise = (async () => {
       const result = await execute(command);
-      const applyIndex = this._order.length;
+      const applyIndex = this._baseIndex + this._order.length;
       const rec = { applyIndex, result, deviceId, ts: this._now() };
       this._applied.set(commandId, rec);
       this._order.push(commandId);
       if (deviceId != null && Number.isFinite(command.seq)) {
-        this._perDeviceSeq.set(deviceId, command.seq);
+        // Advance-only watermark. Two in-flight commands from one device can
+        // RECORD out of order (seq 6 settles before seq 5 — both passed the
+        // stale check while nothing was recorded); a plain set() would regress
+        // the watermark to 5 and let a NEW commandId reuse seq 6.
+        const cur = this._perDeviceSeq.get(deviceId);
+        this._perDeviceSeq.set(
+          deviceId,
+          cur == null ? command.seq : Math.max(cur, command.seq),
+        );
       }
+      this._evictBeyondWindow();
       return rec;
     })();
     this._inFlight.set(commandId, runPromise);
@@ -140,15 +160,31 @@ export class RemoteCommandLedger {
     }
   }
 
+  /** Chunked eviction of the oldest applied entries beyond the window. */
+  _evictBeyondWindow() {
+    // Amortized: only compact once we're 50% past the cap, then cut back to
+    // exactly the cap — avoids an O(n) splice on every insert at steady state.
+    if (this._order.length <= this._maxApplied * 1.5) return;
+    const excess = this._order.length - this._maxApplied;
+    const evicted = this._order.splice(0, excess);
+    for (const id of evicted) this._applied.delete(id);
+    this._baseIndex += excess;
+  }
+
   /**
    * The ordered tail of applied commands after `cursor` (an applyIndex), so a
    * reconnecting endpoint can replay missed state in the one agreed order.
+   * Entries older than the retention window are gone — a caller can detect the
+   * gap by comparing the first element's applyIndex against its cursor+1 (see
+   * `oldestRetainedIndex()`), and should then resync full state instead.
    * @returns {Array<{applyIndex, commandId, result, deviceId}>}
    */
   appliedSince(cursor = -1) {
     const out = [];
-    for (let i = cursor + 1; i < this._order.length; i++) {
-      const commandId = this._order[i];
+    const start = Math.max(cursor + 1, this._baseIndex);
+    const end = this._baseIndex + this._order.length;
+    for (let i = start; i < end; i++) {
+      const commandId = this._order[i - this._baseIndex];
       const rec = this._applied.get(commandId);
       out.push({
         applyIndex: i,
@@ -160,27 +196,41 @@ export class RemoteCommandLedger {
     return out;
   }
 
+  /** Lowest applyIndex still retained (entries below it were evicted). */
+  oldestRetainedIndex() {
+    return this._baseIndex;
+  }
+
   /** Highest assigned applyIndex (−1 when nothing applied). */
   cursor() {
-    return this._order.length - 1;
+    return this._baseIndex + this._order.length - 1;
   }
 
+  /** Total commands ever applied (including evicted ones). */
   appliedCount() {
-    return this._order.length;
+    return this._baseIndex + this._order.length;
   }
 
   snapshot() {
     return {
       order: [...this._order],
+      baseIndex: this._baseIndex,
+      maxApplied: this._maxApplied,
       applied: Array.from(this._applied.entries()),
       revoked: Array.from(this._revoked),
       perDeviceSeq: Array.from(this._perDeviceSeq.entries()),
     };
   }
 
-  static restore(snap, { now = () => Date.now() } = {}) {
-    const l = new RemoteCommandLedger({ now });
+  static restore(snap, { now = () => Date.now(), maxApplied } = {}) {
+    const l = new RemoteCommandLedger({
+      now,
+      // Restore keeps the snapshot's window unless the caller overrides it;
+      // old (pre-window) snapshots fall back to the default.
+      maxApplied: maxApplied ?? snap?.maxApplied,
+    });
     l._order = [...(snap?.order || [])];
+    l._baseIndex = Number.isFinite(snap?.baseIndex) ? snap.baseIndex : 0;
     l._applied = new Map(snap?.applied || []);
     l._revoked = new Set(snap?.revoked || []);
     l._perDeviceSeq = new Map(snap?.perDeviceSeq || []);

package/src/lib/agent-sandbox.js

@@ -151,6 +151,12 @@ export function executeSandboxedShell(command, sandbox, options = {}) {
 }
 
 function executeBubblewrapShell(command, sandbox, options, hostCwd, policy) {
+  // Mount ORDER matters: bwrap applies mounts sequentially and a later mount
+  // shadows an earlier one. `--tmpfs /tmp` must come BEFORE the workspace
+  // bind — with the old order (bind first, tmpfs last) any workspace living
+  // UNDER /tmp was wiped by the tmpfs overlay and the --chdir failed with
+  // "Can't chdir …: No such file or directory" (caught by the live bwrap CI
+  // suite, whose temp workspace is exactly such a directory).
   const args = [
     "--die-with-parent",
     "--new-session",
@@ -158,17 +164,17 @@ function executeBubblewrapShell(command, sandbox, options, hostCwd, policy) {
     "--ro-bind",
     "/",
     "/",
-    "--bind",
-    hostCwd,
-    hostCwd,
-    "--chdir",
-    hostCwd,
     "--proc",
     "/proc",
     "--dev",
     "/dev",
     "--tmpfs",
     "/tmp",
+    "--bind",
+    hostCwd,
+    hostCwd,
+    "--chdir",
+    hostCwd,
   ];
   if (sandbox.network) args.push("--share-net");
   for (const target of policy.allowWrite) args.push("--bind", target, target);

package/src/lib/agent-team/task-lease.js

@@ -324,6 +324,34 @@ export class TaskLeaseRegistry {
     return reclaimed;
   }
 
+  /**
+   * Reclaim EVERY task that currently holds a lease back to PENDING, regardless
+   * of expiry. Used on RESUME: a persisted snapshot comes from a prior process,
+   * so every lease holder is by definition dead. `reclaimExpired` alone would
+   * SKIP a lease still inside its TTL window (a crash seconds after acquiring) —
+   * that task is then neither claimable (the "valid" lease blocks it) nor
+   * reclaimed, so it strands forever and the run can never reach `allDone`.
+   * Returns the reclaimed keys.
+   */
+  reclaimAll() {
+    const reclaimed = [];
+    for (const t of this._tasks.list()) {
+      const lease = t.metadata?.lease || null;
+      if (!lease) continue;
+      const fresh = this._tasks.get(t.id); // re-read for current rev
+      if (
+        this._write(fresh, {
+          status: TASK_STATUS.PENDING,
+          assignee: null,
+          metadata: { ...fresh.metadata, lease: null },
+        })
+      ) {
+        reclaimed.push(fresh.metadata?.key);
+      }
+    }
+    return reclaimed;
+  }
+
   stats({ now = this._now() } = {}) {
     const base = this._tasks.stats();
     let leased = 0;

package/src/lib/agent-team/team-runner.js

@@ -30,6 +30,8 @@ export class TeamRunner {
     this.runTask = opts.runTask;
     this.teammates = opts.teammates > 0 ? Math.floor(opts.teammates) : 2;
     this.ttlMs = opts.ttlMs;
+    // Lease-renewal heartbeat cadence while a task runs (default ttl/3).
+    this.renewEveryMs = opts.renewEveryMs;
     this.onEvent = typeof opts.onEvent === "function" ? opts.onEvent : () => {};
     this.maxTasks = opts.maxTasks > 0 ? opts.maxTasks : 1000;
     this._now = opts.now || registry._now || (() => Date.now());
@@ -38,6 +40,10 @@ export class TeamRunner {
     this.budget = opts.budget || null;
     // Directed/broadcast messaging between teammates (null → disabled).
     this.mailbox = opts.mailbox || null;
+    // Optional TelemetryRecorder: emits a `team.task` span per execution (and
+    // inherits the recorder's default workflow.run_id/name attributes) so
+    // `cc team run --otlp` traces the whole graph. Null → zero cost.
+    this.recorder = opts.recorder || null;
     this._executions = 0;
     this._inFlight = 0;
     this._maxInFlight = 0;
@@ -198,6 +204,28 @@ export class TeamRunner {
     this._setState(holder, "running", { key });
     this._emit("task:claimed", { key, holder, attempts: task.attempts });
     const renew = () => this.registry.renew(key, { holder, ttlMs: this.ttlMs });
+    // Heartbeat: the built-in executors (shell / agent / worktree) never call
+    // `renew` themselves, so before this ANY task outliving the lease TTL was
+    // indistinguishable from a crash — a peer could steal it and the SAME task
+    // would run twice concurrently. The runner owns the TTL, so it renews here
+    // for every executor. Stops itself once the lease is lost (renew rejected —
+    // keeping a lost lease alive would be lying to the registry).
+    const effectiveTtl =
+      this.ttlMs > 0 ? this.ttlMs : this.registry.defaultTtlMs || 60000;
+    const every = Math.max(
+      25,
+      Math.floor(this.renewEveryMs > 0 ? this.renewEveryMs : effectiveTtl / 3),
+    );
+    const heartbeat = setInterval(() => {
+      try {
+        const r = renew();
+        if (!r || r.ok !== true) clearInterval(heartbeat);
+      } catch {
+        clearInterval(heartbeat);
+      }
+    }, every);
+    // Never hold the process open just for a heartbeat.
+    if (typeof heartbeat.unref === "function") heartbeat.unref();
     // A teammate-scoped messaging handle: post to a peer / broadcast, and read
     // its own inbox (direct messages + unseen broadcasts).
     const inbox = this.mailbox ? this.mailbox.drain(holder) : [];
@@ -206,6 +234,13 @@ export class TeamRunner {
         ? this.mailbox.send({ from: holder, to, subject, body })
         : null;
     const startedAt = this._now();
+    const span = this.recorder
+      ? this.recorder.startSpan("team.task", {
+          "team.task.key": key,
+          "team.holder": holder,
+          "team.attempts": task.attempts,
+        })
+      : null;
     try {
       const result = await this.runTask({
         key,
@@ -232,6 +267,7 @@ export class TeamRunner {
         );
       }
       if (done.ok) {
+        if (span) span.end();
         this._setState(holder, "completed-task");
         this._emit("task:completed", {
           key,
@@ -239,6 +275,10 @@ export class TeamRunner {
           ms: this._now() - startedAt,
         });
       } else {
+        if (span) {
+          span.setAttribute("team.completion_discarded", true);
+          span.end();
+        }
         // The registry REJECTED the completion — the lease expired mid-run (the
         // task outran its TTL without renewing), so a peer may already own it.
         // Reporting `task:completed` + bumping the completed counter here would
@@ -253,6 +293,10 @@ export class TeamRunner {
         });
       }
     } catch (err) {
+      if (span) {
+        span.recordException(err, "task_failure");
+        span.end({ status: "error" });
+      }
       // A failed task still consumed a task-count slot (and any wall-clock) — fold
       // it so a doomed retry loop can't dodge the budget.
       if (this.budget) this.budget.record({ usage: null }, this._now());
@@ -271,6 +315,7 @@ export class TeamRunner {
         attempts: outcome?.attempts,
       });
     } finally {
+      clearInterval(heartbeat);
       this._inFlight--;
     }
   }

package/src/lib/config-manager.js

@@ -5,6 +5,7 @@ import {
   mkdirSync,
   renameSync,
   unlinkSync,
+  copyFileSync,
 } from "node:fs";
 import { dirname } from "node:path";
 import { getConfigPath } from "./paths.js";
@@ -39,10 +40,22 @@ export function loadConfig() {
     // keeps working.
     if (!_warnedConfigPaths.has(configPath)) {
       _warnedConfigPaths.add(configPath);
+      // Back up the broken file before anything can clobber it: a later
+      // `cc config set` load-modify-saves DEFAULTS over this path, silently
+      // destroying whatever the user still had in the broken JSON (API keys,
+      // custom baseUrl). The copy gives them something to repair from.
+      // Fixed sibling name (no timestamp) so repeated runs don't accumulate.
+      let backupNote = "";
+      try {
+        copyFileSync(configPath, `${configPath}.corrupted`);
+        backupNote = ` A copy was saved to ${configPath}.corrupted.`;
+      } catch {
+        /* backup is best-effort — the warning still fires without it */
+      }
       _deps.warn(
         `⚠️  Could not read config at ${configPath} (${err.message}). ` +
           `Using defaults — your saved settings (provider / model / API key) are being IGNORED. ` +
-          `Fix the JSON to restore them.\n`,
+          `Fix the JSON to restore them.${backupNote}\n`,
       );
     }
     return { ...structuredClone(DEFAULT_CONFIG) };