chainlesschain 0.162.151 → 0.162.153

package/src/lib/plugin-security.js

@@ -80,16 +80,19 @@ export function verifyPluginManifest({
 
   const wantsSignature = requireSignature || signatureFile || publicKeyFile;
   let signatureVerified = false;
+  let signature = null;
+  let publicKeyPem = null;
+  let publicKeySha256 = null;
   if (wantsSignature) {
     if (!signatureFile || !publicKeyFile) {
       throw new Error(
         "plugin signature verification requires --signature and --public-key",
       );
     }
-    const signature = readFileSync(signatureFile);
-    const publicKey = readFileSync(publicKeyFile, "utf8");
-    const keyObject = createPublicKey(publicKey);
-    const publicKeySha256 = createHash("sha256")
+    signature = readFileSync(signatureFile);
+    publicKeyPem = readFileSync(publicKeyFile, "utf8");
+    const keyObject = createPublicKey(publicKeyPem);
+    publicKeySha256 = createHash("sha256")
       .update(keyObject.export({ type: "spki", format: "der" }))
       .digest("hex");
     const trusted = stringSet(trustedKeySha256);
@@ -110,16 +113,12 @@ export function verifyPluginManifest({
     bytes,
     sha256,
     signatureVerified,
-    publicKeySha256: signatureVerified
-      ? createHash("sha256")
-          .update(
-            createPublicKey(readFileSync(publicKeyFile, "utf8")).export({
-              type: "spki",
-              format: "der",
-            }),
-          )
-          .digest("hex")
-      : null,
+    publicKeySha256: signatureVerified ? publicKeySha256 : null,
+    // The raw signature material, so the installer can persist it and load-time
+    // enforcement can CRYPTOGRAPHICALLY re-verify (not merely trust a recorded
+    // boolean, which a hand-written lock file could forge).
+    signatureBase64: signatureVerified ? signature.toString("base64") : null,
+    publicKeyPem: signatureVerified ? publicKeyPem : null,
   };
 }
 

package/src/lib/sub-agent-context.js

@@ -336,13 +336,19 @@ export class SubAgentContext {
 
         // Check abort signal
         if (this._signal?.aborted) {
-          this.forceComplete("cancelled");
+          this.forceComplete("cancelled", {
+            partialContent: lastContent,
+            artifacts,
+          });
           break;
         }
 
         // Enforce token budget
         if (this.tokenBudget && this._tokenCount >= this.tokenBudget) {
-          this.forceComplete("token-budget-exceeded");
+          this.forceComplete("token-budget-exceeded", {
+            partialContent: lastContent,
+            artifacts,
+          });
           break;
         }
 
@@ -355,9 +361,17 @@ export class SubAgentContext {
     } catch (err) {
       this.status = "failed";
       this.completedAt = new Date().toISOString();
+      // Return partial work to the parent instead of discarding it: the
+      // summary is the only channel the parent model sees, so a mid-run API
+      // error (rate limit, network drop) must not erase what was already
+      // produced. Artifacts collected before the failure are kept as-is.
+      const partial =
+        lastContent && lastContent.length > 0
+          ? `\n\nPartial output before failure:\n${this.summarize(lastContent)}`
+          : "";
       this.result = {
-        summary: `Sub-agent failed: ${err.message}`,
-        artifacts: [],
+        summary: `Sub-agent failed: ${err.message}${partial}`,
+        artifacts,
         tokenCount: this._tokenCount,
         toolsUsed: [...new Set(this._toolsUsed)],
         iterationCount: this._iterationCount,
@@ -447,15 +461,22 @@ export class SubAgentContext {
   /**
    * Force-complete this sub-agent (e.g. on timeout or parent cancellation).
    * @param {string} [reason] - Reason for force-completion
+   * @param {{partialContent?: string, artifacts?: Array}} [partial] - Work
+   *   produced before the cutoff; returned to the parent instead of being
+   *   discarded (a truncated run should still hand over what it has).
    */
-  forceComplete(reason = "forced") {
+  forceComplete(reason = "forced", partial = {}) {
     if (this.status === "active") {
       this.status = "completed";
       this.completedAt = new Date().toISOString();
       if (!this.result) {
+        const partialText =
+          partial.partialContent && partial.partialContent.length > 0
+            ? `\n\nPartial output before cutoff:\n${this.summarize(partial.partialContent)}`
+            : "";
         this.result = {
-          summary: `(Sub-agent force-completed: ${reason})`,
-          artifacts: [],
+          summary: `(Sub-agent force-completed: ${reason})${partialText}`,
+          artifacts: Array.isArray(partial.artifacts) ? partial.artifacts : [],
           tokenCount: this._tokenCount,
           toolsUsed: [...new Set(this._toolsUsed)],
           iterationCount: this._iterationCount,

package/src/lib/telemetry/span-recorder.js

@@ -22,27 +22,46 @@ function spanId() {
 
 // One trace per recorder (a "run"). The OTLP/OTel spec treats an ALL-ZERO
 // traceId as INVALID, so a strict collector would drop every span exported with
-// `"0".repeat(32)` — defeating toOtlp()'s purpose. Derive a non-zero, monotonic
-// (RNG-free, snapshot-replayable) 32-hex traceId per recorder instead.
+// `"0".repeat(32)` — defeating toOtlp()'s purpose. A bare counter is non-zero
+// but resets every PROCESS, so successive CLI runs all exported trace
+// `000…001` and a collector merged them into one giant trace. Prefix the
+// counter with per-process entropy (start time + pid — RNG-free, so ids stay
+// deterministic WITHIN a run) to make traces practically unique ACROSS runs.
+const _traceBase = (
+  Date.now().toString(16).padStart(12, "0") +
+  (process.pid >>> 0).toString(16).padStart(8, "0")
+).slice(0, 20);
 let _traceSeq = 0;
 function newTraceId() {
   _traceSeq = (_traceSeq + 1) % Number.MAX_SAFE_INTEGER;
-  return _traceSeq.toString(16).padStart(32, "0"); // never all-zero (starts at 1)
+  return _traceBase + _traceSeq.toString(16).padStart(12, "0"); // 32 hex, never all-zero
 }
 
 export class TelemetryRecorder {
   constructor({
     now = () => Date.now(),
     serviceName = "chainlesschain-cli",
+    defaultAttributes = {},
   } = {}) {
     this._now = typeof now === "function" ? now : () => now;
     this.serviceName = serviceName;
     this.traceId = newTraceId(); // one trace per recorder (valid non-zero id)
+    // Stamped onto EVERY span (per-span attributes win on key collision).
+    // Used for run-level correlation: workflow.run_id / workflow.name let a
+    // collector group all model/tool/task spans of one run (Claude-Code
+    // 2.1.202 workflow-tracing attributes).
+    this.defaultAttributes = { ...defaultAttributes };
     this._spans = []; // completed spans
     this._counters = new Map(); // name → { total, byAttr }
     this._failures = new Map(); // category → count
   }
 
+  /** Set (or overwrite) an attribute stamped onto every span from now on. */
+  setDefaultAttribute(key, value) {
+    this.defaultAttributes[key] = value;
+    return this;
+  }
+
   /**
    * Start a span. Returns a handle; call `.end()` (optionally with a status /
    * extra attributes) to record it. Nesting is expressed via `parentId`.
@@ -50,7 +69,7 @@ export class TelemetryRecorder {
   startSpan(name, attributes = {}, { parentId = null } = {}) {
     const id = spanId();
     const start = this._now();
-    const attrs = { ...attributes };
+    const attrs = { ...this.defaultAttributes, ...attributes };
     const events = [];
     const self = this;
     let ended = false;
@@ -186,8 +205,12 @@ export class TelemetryRecorder {
                 spanId: s.id,
                 parentSpanId: s.parentId || "",
                 name: s.name,
-                startTimeUnixNano: s.startTime * 1e6,
-                endTimeUnixNano: s.endTime * 1e6,
+                // proto3 JSON mapping: (s)fixed64/(u)int64 fields MUST be
+                // decimal STRINGS — ms×1e6 ≈ 1.8e18 exceeds 2^53, so a JSON
+                // number both violates the OTLP/JSON spec (strict collectors
+                // reject the span) and quantizes (~256 ns spacing).
+                startTimeUnixNano: String(Math.round(s.startTime * 1e6)),
+                endTimeUnixNano: String(Math.round(s.endTime * 1e6)),
                 status: { code: s.status === "error" ? 2 : 1 },
                 attributes: Object.entries(s.attributes).map(([k, v]) => ({
                   key: k,
@@ -200,7 +223,7 @@ export class TelemetryRecorder {
                 })),
                 events: s.events.map((e) => ({
                   name: e.name,
-                  timeUnixNano: e.time * 1e6,
+                  timeUnixNano: String(Math.round(e.time * 1e6)),
                   attributes: Object.entries(e.attributes).map(([k, v]) => ({
                     key: k,
                     value: { stringValue: String(v) },

package/src/repl/agent-repl.js

@@ -64,7 +64,10 @@ import {
   PromptCompressor,
   getContextWindow,
 } from "../harness/prompt-compressor.js";
-import { buildAutoPinPredicate } from "../runtime/auto-pin.js";
+import {
+  buildAutoPinPredicate,
+  resolveAutoPinOption,
+} from "../runtime/auto-pin.js";
 import { feature } from "../lib/feature-flags.js";
 import { recordCompressionMetric } from "../lib/compression-telemetry.js";
 import {
@@ -102,7 +105,11 @@ import { parseThinkCommand, parseEffortCommand } from "./think-command.js";
 import { parseBtwCommand, buildAsideBlock, applyAside } from "./btw-command.js";
 import { shouldStreamLive } from "./stream-decision.js";
 import { emptyTurnNotice } from "./empty-turn-notice.js";
-import { buildPermissionPrompt } from "./permission-prompt.js";
+import {
+  buildPermissionPrompt,
+  resolveAskIdleTimeoutMs,
+  questionWithIdleTimeout,
+} from "./permission-prompt.js";
 import {
   parsePermissionTier,
   describeTier,
@@ -417,15 +424,22 @@ export async function startAgentRepl(options = {}) {
   // Unset → agent-core's 180s default (matches cc chat/ask). Set to 0 to
   // disable. Left undefined here means "use the default".
   let _streamStallTimeoutMs;
-  // Auto-pin (OPT-IN, off by default): when set, compaction pins the original
-  // task. Resolved from config `context.autoPin` or CC_AUTO_PIN=1; falsy → the
-  // compress calls below pass no pin predicate (byte-identical default).
-  let _autoPinOpt;
+  // Auto-pin (default ON since 2026-07-07): compaction pins the original task
+  // (first user turn) so it survives context compression. Resolution order:
+  // CC_AUTO_PIN env ("1"/"0") > config `context.autoPin` (true/false/object) >
+  // default on. See resolveAutoPinOption.
+  let _autoPinCfgValue;
+  // Idle timeout for interactive permission prompts (0 = wait forever).
+  // CC_PERMISSION_ASK_TIMEOUT_MS env > config permissions.askTimeoutMs > off.
+  let _askIdleTimeoutMs = resolveAskIdleTimeoutMs();
   try {
     const { loadConfig } = await import("../lib/config-manager.js");
     const _cfg = loadConfig();
     _visionModel = _cfg?.llm?.visionModel || undefined;
-    _autoPinOpt = _cfg?.context?.autoPin;
+    _autoPinCfgValue = _cfg?.context?.autoPin;
+    _askIdleTimeoutMs = resolveAskIdleTimeoutMs({
+      config: _cfg?.permissions?.askTimeoutMs,
+    });
     const raw = _cfg?.llm?.streamStallTimeoutMs;
     const t = Number(raw);
     // Accept 0 (explicit disable) — only ignore absent/invalid values.
@@ -483,8 +497,8 @@ export async function startAgentRepl(options = {}) {
   if (feature("PROMPT_COMPRESSOR")) {
     _compressor = new PromptCompressor({ model, provider });
   }
-  if (process.env.CC_AUTO_PIN === "1") _autoPinOpt = _autoPinOpt || true;
-  // Compaction options shared by /compact + auto-compact. Adds the opt-in
+  const _autoPinOpt = resolveAutoPinOption({ config: _autoPinCfgValue });
+  // Compaction options shared by /compact + auto-compact. Adds the
   // pin predicate only when auto-pin is enabled; otherwise byte-identical.
   const _compactOpts = (msgs) => {
     const base = { preserveToolPairs: true };
@@ -555,17 +569,24 @@ export async function startAgentRepl(options = {}) {
         });
         const q = (p) => new Promise((res) => rlConfirm.question(p, res));
         const cmd = args?.command ? ` ${args.command}` : "";
-        const ans = (
-          await q(
+        const res = await questionWithIdleTimeout(
+          q,
+          chalk.yellow(
+            `\n[ApprovalGate] ${riskLevel || "medium"} risk command:${cmd}\n` +
+              `  Proceed? [y]es once / [a]lways allow / [N]o: `,
+          ),
+          _askIdleTimeoutMs,
+        );
+        rlConfirm.close();
+        if (res.timedOut) {
+          process.stdout.write(
             chalk.yellow(
-              `\n[ApprovalGate] ${riskLevel || "medium"} risk command:${cmd}\n` +
-                `  Proceed? [y]es once / [a]lways allow / [N]o: `,
+              `\n  ⏱ no response in ${_askIdleTimeoutMs}ms — auto-denied\n`,
             ),
-          )
-        )
-          .trim()
-          .toLowerCase();
-        rlConfirm.close();
+          );
+          return false;
+        }
+        const ans = res.answer.trim().toLowerCase();
         if (ans === "a" || ans === "always") {
           const saved = await _persistAlwaysAllow(tool || "run_shell", args);
           if (saved) {
@@ -621,10 +642,21 @@ export async function startAgentRepl(options = {}) {
       // (settings/hook ask) or a `reason` (destructive-git / sensitive-file
       // guards) — avoids the literal "null" the old template printed.
       const header = buildPermissionPrompt({ tool, args, rule, reason });
-      const ans = (await q(chalk.yellow(`\n${header}\n  Proceed? (y/N) `)))
-        .trim()
-        .toLowerCase();
+      const res = await questionWithIdleTimeout(
+        q,
+        chalk.yellow(`\n${header}\n  Proceed? (y/N) `),
+        _askIdleTimeoutMs,
+      );
       rl.close();
+      if (res.timedOut) {
+        process.stdout.write(
+          chalk.yellow(
+            `\n  ⏱ no response in ${_askIdleTimeoutMs}ms — auto-denied\n`,
+          ),
+        );
+        return false;
+      }
+      const ans = res.answer.trim().toLowerCase();
       return ans === "y" || ans === "yes";
     };
   } catch (_err) {
@@ -2379,6 +2411,17 @@ export async function startAgentRepl(options = {}) {
           const expanded = target.replace(/^~(?=$|[\\/])/, os.homedir());
           process.chdir(path.resolve(process.cwd(), expanded));
           logger.log(chalk.green(`cwd → ${process.cwd()}`));
+          // MCP roots derive from cwd — tell connected servers to re-query
+          // roots/list (Claude-Code 2.1.203 change-notification parity).
+          for (const c of [_adhocMcp?.mcpClient, _bundleMcpClient]) {
+            if (c && typeof c.notifyRootsListChanged === "function") {
+              try {
+                c.notifyRootsListChanged();
+              } catch {
+                /* best-effort */
+              }
+            }
+          }
         } catch (err) {
           logger.error(`/cd failed: ${err.message}`);
         }

package/src/repl/permission-prompt.js

@@ -24,3 +24,61 @@ export function buildPermissionPrompt({ tool, args, rule, reason } = {}) {
   if (reason) return `[Permission] ${reason}`;
   return `[Permission] confirm ${tool}:${detail}`;
 }
+
+/**
+ * Resolve the idle timeout (ms) for interactive permission prompts.
+ *
+ * An unanswered prompt blocks the whole agent turn forever (e.g. the user
+ * walked away mid-run). With a timeout configured, the prompt auto-denies
+ * after `ms` of silence — deny is the only safe unattended answer.
+ *
+ * Precedence: CC_PERMISSION_ASK_TIMEOUT_MS env > config
+ * `permissions.askTimeoutMs` > default 0 (disabled — waits forever, the
+ * historical behavior). Non-finite / non-positive values disable it.
+ *
+ * @param {{env?: string, config?: unknown}} [opts] - injectable for tests
+ * @returns {number} timeout in ms, 0 = disabled
+ */
+export function resolveAskIdleTimeoutMs({ env, config } = {}) {
+  const envRaw =
+    env !== undefined ? env : process.env.CC_PERMISSION_ASK_TIMEOUT_MS;
+  const candidate =
+    envRaw !== undefined && envRaw !== null && envRaw !== ""
+      ? Number(envRaw)
+      : typeof config === "number" || typeof config === "string"
+        ? Number(config)
+        : NaN; // booleans/objects are not a timeout — disabled
+  return Number.isFinite(candidate) && candidate > 0 ? candidate : 0;
+}
+
+/**
+ * Race an interactive question against an idle timeout.
+ *
+ * `ask` is the readline-question-as-promise (never rejects). On timeout the
+ * caller must still close its readline interface; the stranded question
+ * callback becomes a no-op once the interface is closed.
+ *
+ * @param {(prompt: string) => Promise<string>} ask
+ * @param {string} prompt
+ * @param {number} timeoutMs - 0/negative = no timeout (plain await)
+ * @returns {Promise<{answer: string|null, timedOut: boolean}>}
+ */
+export async function questionWithIdleTimeout(ask, prompt, timeoutMs) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    return { answer: await ask(prompt), timedOut: false };
+  }
+  let timer = null;
+  try {
+    return await Promise.race([
+      ask(prompt).then((answer) => ({ answer, timedOut: false })),
+      new Promise((res) => {
+        timer = setTimeout(
+          () => res({ answer: null, timedOut: true }),
+          timeoutMs,
+        );
+      }),
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}

package/src/runtime/__tests__/auto-pin.test.js

@@ -1,13 +1,14 @@
 /**
- * auto-pin policy tests — the OPT-IN compaction pin policy. Verifies it is off
- * by default (returns null → caller passes no predicate → byte-identical), and
- * when enabled pins the original task (first user turn) plus explicit pins,
- * honoring the token cap.
+ * auto-pin policy tests. The PREDICATE layer stays opt-valued (null when the
+ * resolved option is falsy → byte-identical compaction); the EFFECTIVE default
+ * is decided by resolveAutoPinOption — ON since 2026-07-07, opt out via
+ * CC_AUTO_PIN=0 or config context.autoPin=false.
  */
 
 import { describe, it, expect } from "vitest";
 import {
   resolveAutoPinConfig,
+  resolveAutoPinOption,
   buildAutoPinPredicate,
   describeAutoPin,
 } from "../auto-pin.js";
@@ -102,3 +103,25 @@ describe("describeAutoPin", () => {
     );
   });
 });
+
+describe("resolveAutoPinOption (effective default — ON since 2026-07-07)", () => {
+  it("defaults ON when nothing is set", () => {
+    expect(resolveAutoPinOption({ env: undefined, config: undefined })).toBe(
+      true,
+    );
+  });
+  it("CC_AUTO_PIN=0 opts out; =1 forces on over a config false", () => {
+    expect(resolveAutoPinOption({ env: "0", config: true })).toBe(false);
+    expect(resolveAutoPinOption({ env: "1", config: false })).toBe(true);
+  });
+  it("config false opts out; a config object passes through", () => {
+    expect(resolveAutoPinOption({ env: undefined, config: false })).toBe(false);
+    const cfg = { maxPinTokens: 99 };
+    expect(resolveAutoPinOption({ env: undefined, config: cfg })).toBe(cfg);
+  });
+  it("an explicit --auto-pin flag wins over everything", () => {
+    expect(resolveAutoPinOption({ flag: true, env: "0", config: false })).toBe(
+      true,
+    );
+  });
+});