chainlesschain 0.162.158 → 0.162.159

package/src/runtime/headless-runner.js

@@ -42,10 +42,12 @@ import {
   appendUserMessage as jsonlAppendUserMessage,
   appendAssistantMessage as jsonlAppendAssistantMessage,
   appendTokenUsage as jsonlAppendTokenUsage,
+  appendToolCallCompact as jsonlAppendToolCallCompact,
   appendCompactEvent as jsonlAppendCompactEvent,
   rebuildMessages as jsonlRebuildMessages,
   sessionExists as jsonlSessionExists,
   getLastSessionId as jsonlGetLastSessionId,
+  verifySession as jsonlVerifySession,
 } from "../harness/jsonl-session-store.js";
 import { expandFileRefsAsync } from "./file-ref-expander.js";
 import { composeSystemPrompt } from "./system-prompt.js";
@@ -436,8 +438,11 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     appendAssistantMessage:
       deps.appendAssistantMessage || jsonlAppendAssistantMessage,
     appendTokenUsage: deps.appendTokenUsage || jsonlAppendTokenUsage,
+    appendToolCallCompact:
+      deps.appendToolCallCompact || jsonlAppendToolCallCompact,
     appendCompactEvent: deps.appendCompactEvent || jsonlAppendCompactEvent,
     getLastSessionId: deps.getLastSessionId || jsonlGetLastSessionId,
+    verifySession: deps.verifySession || jsonlVerifySession,
   };
   const isStream = outputFormat === "stream-json";
   const isJson = outputFormat === "json";
@@ -626,6 +631,30 @@ export async function runAgentHeadless(options = {}, deps = {}) {
   // never duplicated.
   let history = [];
   if (resumeId && store.sessionExists(resumeId)) {
+    // Tamper gate: a broken transcript hash chain means the file was edited
+    // outside the store. Headless runs fail closed — a tampered transcript is
+    // never silently rebuilt into trusted model context. Escape hatch:
+    // CC_ALLOW_TAMPERED_RESUME=1 resumes with a stderr warning.
+    let trust = null;
+    try {
+      trust = store.verifySession(resumeId);
+    } catch {
+      trust = null; // verification unavailable → keep legacy behaviour
+    }
+    if (trust && trust.status === "tampered") {
+      if (process.env.CC_ALLOW_TAMPERED_RESUME !== "1") {
+        const msg =
+          `Session ${resumeId} transcript failed integrity verification (${trust.reason}` +
+          (trust.firstInvalidLine ? ` at line ${trust.firstInvalidLine}` : "") +
+          `). Refusing to resume tampered context; run 'cc session verify ${resumeId}', or set CC_ALLOW_TAMPERED_RESUME=1 to override.`;
+        emitHeadlessError(msg);
+        writeErr(msg + "\n");
+        return { exitCode: 1, result: msg, isError: true };
+      }
+      writeErr(
+        `⚠ Resuming a TAMPERED transcript (${trust.reason}) — restored context is untrusted.\n`,
+      );
+    }
     try {
       history = (store.rebuildMessages(resumeId) || []).filter(
         (m) => m && m.role !== "system",
@@ -1114,6 +1143,12 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     cache_read_input_tokens: 0,
     cache_creation_input_tokens: 0,
   };
+  // 用量归因: attributed child-loop usage (spawn_sub_agent / isolated
+  // run_skill). Kept OUT of the `usage` accumulator above so the result
+  // envelope and the end-of-run aggregate token_usage event keep their
+  // long-standing "main loop only" semantics — the attributed records are
+  // persisted as their own token_usage events instead (no double count).
+  const attributedUsage = [];
   let finalText = "";
   let endReason = "complete";
   let stopForCost = false;
@@ -1274,13 +1309,26 @@ export async function runAgentHeadless(options = {}, deps = {}) {
             break;
           }
           case "token-usage": {
-            usage.input_tokens += event.usage?.input_tokens || 0;
-            usage.output_tokens += event.usage?.output_tokens || 0;
-            // Carry prompt-cache tokens into accumulated usage (cost accuracy).
-            usage.cache_read_input_tokens +=
-              event.usage?.cache_read_input_tokens || 0;
-            usage.cache_creation_input_tokens +=
-              event.usage?.cache_creation_input_tokens || 0;
+            if (event.attribution) {
+              // Child-loop (sub-agent / isolated-skill) spend: excluded from
+              // the main `usage` envelope, persisted with its attribution
+              // frame below, but still counted toward the cost budget — it
+              // is real money on the same key.
+              attributedUsage.push({
+                provider: event.provider ?? null,
+                model: event.model ?? null,
+                usage: event.usage || null,
+                attribution: event.attribution,
+              });
+            } else {
+              usage.input_tokens += event.usage?.input_tokens || 0;
+              usage.output_tokens += event.usage?.output_tokens || 0;
+              // Carry prompt-cache tokens into accumulated usage (cost accuracy).
+              usage.cache_read_input_tokens +=
+                event.usage?.cache_read_input_tokens || 0;
+              usage.cache_creation_input_tokens +=
+                event.usage?.cache_creation_input_tokens || 0;
+            }
             emitStream({ type: "token_usage", usage: event.usage });
             if (costBudget) {
               costBudget.add({
@@ -1539,6 +1587,22 @@ export async function runAgentHeadless(options = {}, deps = {}) {
   if (persist && !isError) {
     try {
       if (finalText) store.appendAssistantMessage(sessionId, finalText);
+      // 用量归因: compact per-tool records (name + error flag + skill hint —
+      // never args) so `cc session usage --by tool|mcp` can aggregate
+      // headless sessions too.
+      for (const tc of toolCalls) {
+        store.appendToolCallCompact(sessionId, {
+          tool: tc.tool,
+          isError: Boolean(tc.is_error),
+          skill:
+            tc.tool === "run_skill" ? tc.args?.skill_name || null : undefined,
+        });
+      }
+      // Attributed child-loop usage first (chronology: it happened during
+      // the run), then the unchanged main-loop aggregate.
+      for (const au of attributedUsage) {
+        store.appendTokenUsage(sessionId, au);
+      }
       store.appendTokenUsage(sessionId, usage);
     } catch {
       // Persistence is best-effort — never fail the run over it.

package/src/runtime/headless-stream.js

@@ -494,14 +494,20 @@ async function runTurn(messages, loopOptions, { runLoop, emit, costBudget }) {
         break;
       }
       case "token-usage":
-        usage.input_tokens += event.usage?.input_tokens || 0;
-        usage.output_tokens += event.usage?.output_tokens || 0;
-        // Carry prompt-cache tokens into the turn's accumulated usage so the
-        // final `result` envelope (read by IDE panels) reflects caching too.
-        usage.cache_read_input_tokens +=
-          event.usage?.cache_read_input_tokens || 0;
-        usage.cache_creation_input_tokens +=
-          event.usage?.cache_creation_input_tokens || 0;
+        // 用量归因: attributed child-loop usage (sub-agent / isolated skill)
+        // is forwarded on the stream (same wire shape) and counted toward the
+        // cost budget, but stays out of the turn's `usage` envelope, which
+        // keeps its long-standing main-loop-only semantics.
+        if (!event.attribution) {
+          usage.input_tokens += event.usage?.input_tokens || 0;
+          usage.output_tokens += event.usage?.output_tokens || 0;
+          // Carry prompt-cache tokens into the turn's accumulated usage so the
+          // final `result` envelope (read by IDE panels) reflects caching too.
+          usage.cache_read_input_tokens +=
+            event.usage?.cache_read_input_tokens || 0;
+          usage.cache_creation_input_tokens +=
+            event.usage?.cache_creation_input_tokens || 0;
+        }
         emit({ type: "token_usage", usage: event.usage });
         if (costBudget) {
           costBudget.add({

package/src/runtime/policies/agent-policy.js

@@ -59,6 +59,9 @@ export function resolveAgentPolicy({
     // --remote-control also applies interactively: the REPL starts the
     // paired-device approval bridge at startup (批26).
     remoteControl: overrides.remoteControl === true,
+    // --channels: inbound channel listeners (webhook/telegram) whose events
+    // become user turns in the interactive session (gap-2026-07-11 P0#5).
+    channels: overrides.channels || null,
   };
 }
 

package/src/assets/web-panel/assets/Artifacts-DQvJoQ6E.js

@@ -1 +0,0 @@
-import{E as J,b as z,r as C,I as k,J as y,U as _,c as r,K as o,S,V as B,o as V,f as D,P as d,Q as f,R as p,F as j}from"./vendor-Bn1JzzAn.js";import{M as Q}from"./MarkdownRenderer-7agE3Or1.js";import{u as F,_ as W,d as R}from"./index-DV-Rfmfx.js";import{R as q}from"./icons-DG5UD-6K.js";import"./markdown-Yo_c6Krv.js";import"./markdown-CsiA8-E5.js";const K=J("artifacts",()=>{const h=C([]),t=C(!1),u=C(""),e=C(""),w=C(null),b=C(!1),A=z(()=>[...new Set(h.value.map(a=>a.kind).filter(Boolean))].sort());async function l(){const n=F();t.value=!0;try{const a={type:"artifact-list"};u.value&&(a.kind=u.value),e.value&&(a.session=e.value);const s=await n.sendRaw(a);s&&Array.isArray(s.artifacts)&&(h.value=[...s.artifacts].reverse())}catch{}finally{t.value=!1}}async function g(n){const a=F();b.value=!0,w.value={entry:n,previewable:!1};try{const s=await a.sendRaw({type:"artifact-content",artifactId:n.id});w.value={entry:n,previewable:s?.previewable===!0,encoding:s?.encoding||null,content:s?.content||"",truncated:s?.truncated===!0,reason:s?.reason||null}}catch(s){w.value={entry:n,previewable:!1,reason:s?.message||"preview failed"}}finally{b.value=!1}}function i(){w.value=null}const m=z(()=>{const n=w.value;return!n?.previewable||n.encoding!=="base64"?null:`data:${n.entry?.mime||"image/png"};base64,${n.content}`}),O=z(()=>{const n=w.value;return n?.previewable===!0&&n.encoding==="utf8"&&String(n.entry?.mime||"").toLowerCase()==="text/markdown"});async function P(n,a={}){if(!n?.id)return!1;const s=a.fetch||globalThis.fetch,L=a.document||globalThis.document,T=a.URL||globalThis.URL,N=(a.config||globalThis.window?.__CC_CONFIG__)??{};try{const U=await s(`/api/artifacts/${n.id}/download`,{headers:N.wsToken?{Authorization:`Bearer ${N.wsToken}`}:{}});if(!U.ok)return!1;const G=await U.blob(),E=T.createObjectURL(G),I=L.createElement("a");return I.href=E,I.download=n.title||n.id,L.body.appendChild(I),I.click(),I.remove(),T.revokeObjectURL(E),!0}catch{return!1}}async function M(n){const a=F();if(!n)return!1;try{const s=await a.sendRaw({type:"artifact-remove",artifactId:n});return w.value?.entry?.id===n&&(w.value=null),await l(),s?.found===!0}catch{return!1}}async function c(){const n=F();try{const a=await n.sendRaw({type:"artifact-clean"});return await l(),Number(a?.removed)||0}catch{return 0}}function v(n){const a=Number(n)||0;return a<1024?`${a} B`:a<1024*1024?`${(a/1024).toFixed(1)} KB`:`${(a/(1024*1024)).toFixed(1)} MB`}function x(n){switch(n){case"report":return"blue";case"patch":return"purple";case"screenshot":return"cyan";case"log":return"default";case"data":return"green";default:return"default"}}return{artifacts:h,loading:t,kindFilter:u,sessionFilter:e,kinds:A,preview:w,previewLoading:b,previewImageSrc:m,previewIsMarkdown:O,fetchArtifacts:l,openPreview:g,closePreview:i,removeArtifact:M,cleanExpired:c,downloadArtifact:P,formatSize:v,kindColor:x}}),H={__name:"Artifacts",setup(h,{expose:t}){t();const u=K(),e=[{title:"标题",key:"title",dataIndex:"title",ellipsis:!0},{title:"类型",key:"kind",dataIndex:"kind",width:110},{title:"MIME",dataIndex:"mime",width:160,ellipsis:!0},{title:"大小",key:"size",dataIndex:"size",width:90},{title:"发布时间",key:"createdAt",dataIndex:"createdAt",width:170},{title:"会话",dataIndex:"sessionId",width:160,ellipsis:!0},{title:"操作",key:"actions",width:150}],w=z(()=>u.kinds.map(i=>({label:i,value:i})));async function b(i){await u.removeArtifact(i)?R.success("已删除"):R.error("删除失败")}async function A(){const i=await u.cleanExpired();R.info(i>0?`清理了 ${i} 个过期交付物`:"没有过期交付物")}async function l(i){await u.downloadArtifact(i)||R.error("下载失败")}V(()=>{u.fetchArtifacts()}),D(()=>{u.closePreview()});const g={store:u,columns:e,kindOptions:w,onRemove:b,onClean:A,onDownload:l,computed:z,onBeforeUnmount:D,onMounted:V,get ReloadOutlined(){return q},get message(){return R},MarkdownRenderer:Q,get useArtifactsStore(){return K}};return Object.defineProperty(g,"__isScriptSetup",{enumerable:!1,value:!0}),g}},X={class:"page-header"},Y=["onClick"],Z=["src"],$={key:1,class:"preview-markdown"},ee={key:2,class:"preview-text"},te={class:"preview-meta"},ne={key:0};function ae(h,t,u,e,w,b){const A=k("a-select"),l=k("a-button"),g=k("a-popconfirm"),i=k("a-space"),m=k("a-tag"),O=k("a-table"),P=k("a-empty"),M=k("a-card");return d(),y("div",null,[_("div",X,[t[7]||(t[7]=_("div",null,[_("h2",{class:"page-title"},"交付物"),_("p",{class:"page-sub"}," agent 用 publish_artifact 发布的交付物（报告 / patch / 截图 / 日志），在这里预览与管理（cc artifacts 同源）。 ")],-1)),r(i,null,{default:o(()=>[r(A,{value:e.store.kindFilter,"onUpdate:value":t[0]||(t[0]=c=>e.store.kindFilter=c),style:{"min-width":"120px"},placeholder:"全部类型","allow-clear":"",options:e.kindOptions,onChange:t[1]||(t[1]=c=>e.store.fetchArtifacts())},null,8,["value","options"]),r(g,{title:"删除所有过期交付物？",onConfirm:e.onClean},{default:o(()=>[r(l,null,{default:o(()=>[...t[5]||(t[5]=[f("清理过期",-1)])]),_:1})]),_:1}),r(l,{ghost:"",loading:e.store.loading,onClick:t[2]||(t[2]=c=>e.store.fetchArtifacts())},{icon:o(()=>[r(e.ReloadOutlined)]),default:o(()=>[t[6]||(t[6]=f(" 刷新 ",-1))]),_:1},8,["loading"])]),_:1})]),r(O,{"data-source":e.store.artifacts,columns:e.columns,"row-key":"id",size:"small",pagination:{pageSize:10,hideOnSinglePage:!0}},{bodyCell:o(({column:c,record:v})=>[c.key==="title"?(d(),y("a",{key:0,onClick:x=>e.store.openPreview(v)},p(v.title),9,Y)):c.key==="kind"?(d(),S(m,{key:1,color:e.store.kindColor(v.kind)},{default:o(()=>[f(p(v.kind),1)]),_:2},1032,["color"])):c.key==="size"?(d(),y(j,{key:2},[f(p(e.store.formatSize(v.size)),1)],64)):c.key==="createdAt"?(d(),y(j,{key:3},[f(p((v.createdAt||"").replace("T"," ").slice(0,19)),1)],64)):c.key==="actions"?(d(),S(i,{key:4},{default:o(()=>[r(l,{size:"small",onClick:x=>e.store.openPreview(v)},{default:o(()=>[...t[8]||(t[8]=[f("预览",-1)])]),_:1},8,["onClick"]),r(l,{size:"small",onClick:x=>e.onDownload(v)},{default:o(()=>[...t[9]||(t[9]=[f("下载",-1)])]),_:1},8,["onClick"]),r(g,{title:"删除该交付物？",onConfirm:x=>e.onRemove(v.id)},{default:o(()=>[r(l,{size:"small",danger:""},{default:o(()=>[...t[10]||(t[10]=[f("删除",-1)])]),_:1})]),_:1},8,["onConfirm"])]),_:2},1024)):B("v-if",!0)]),_:1},8,["data-source"]),e.store.preview?(d(),S(M,{key:0,size:"small",class:"preview-card",loading:e.store.previewLoading},{title:o(()=>[r(i,null,{default:o(()=>[_("span",null,p(e.store.preview.entry?.title),1),r(m,{color:e.store.kindColor(e.store.preview.entry?.kind)},{default:o(()=>[f(p(e.store.preview.entry?.kind),1)]),_:1},8,["color"]),r(m,{color:"default"},{default:o(()=>[f(p(e.store.preview.entry?.mime),1)]),_:1}),e.store.preview.truncated?(d(),S(m,{key:0,color:"warning"},{default:o(()=>[...t[11]||(t[11]=[f("已截断预览",-1)])]),_:1})):B("v-if",!0)]),_:1})]),extra:o(()=>[r(i,null,{default:o(()=>[r(l,{size:"small",onClick:t[3]||(t[3]=c=>e.onDownload(e.store.preview.entry))},{default:o(()=>[...t[12]||(t[12]=[f("下载",-1)])]),_:1}),r(l,{size:"small",onClick:t[4]||(t[4]=c=>e.store.closePreview())},{default:o(()=>[...t[13]||(t[13]=[f("关闭",-1)])]),_:1})]),_:1})]),default:o(()=>[e.store.previewImageSrc?(d(),y("img",{key:0,src:e.store.previewImageSrc,class:"preview-image",alt:"artifact preview"},null,8,Z)):e.store.previewIsMarkdown?(d(),y("div",$,[r(e.MarkdownRenderer,{content:e.store.preview.content||""},null,8,["content"])])):e.store.preview.previewable?(d(),y("pre",ee,p(e.store.preview.content||"（空文件）"),1)):(d(),S(P,{key:3,description:e.store.preview.reason||"该类型不支持在线预览，可在本机用 cc artifacts open <id> 打开"},null,8,["description"])),_("div",te,[_("span",null,p(e.store.preview.entry?.id),1),e.store.preview.entry?.sessionId?(d(),y("span",ne," · session "+p(e.store.preview.entry.sessionId),1)):B("v-if",!0),_("span",null," · sha256 "+p((e.store.preview.entry?.sha256||"").slice(0,12))+"…",1)])]),_:1},8,["loading"])):B("v-if",!0)])}const de=W(H,[["render",ae],["__scopeId","data-v-c8b48f8c"],["__file","/tmp/cc-web-panel-StwILP/repo/packages/web-panel/src/views/Artifacts.vue"]]);export{de as default};

package/src/assets/web-panel/assets/OrderTableRenderer-h1A0XB2a.js

@@ -1 +0,0 @@
-import{I as b,P as l,J as u,U as s,R as n,c as i,K as v,Q as _,V as g,b as a}from"./vendor-Bn1JzzAn.js";import{_ as h}from"./index-DV-Rfmfx.js";import"./icons-DG5UD-6K.js";const k={__name:"OrderTableRenderer",props:{event:{type:Object,required:!0}},setup(p,{expose:r}){r();const o=p,e=a(()=>o.event.content||{}),d=a(()=>o.event.extra||{}),m=a(()=>d.value.merchant||e.value.merchant||e.value.counterparty||"—"),c=a(()=>e.value.title||e.value.name||e.value.itemName||e.value.text||"—"),y=a(()=>{const t=e.value.amount??e.value.price??e.value.total;return t==null?"—":`${e.value.currency||"¥"} ${typeof t=="number"?t.toFixed(2):t}`}),T=a(()=>d.value.orderNo||e.value.orderNo||e.value.orderId),f=a(()=>e.value.status||e.value.state),w=a(()=>{const t=(f.value||"").toLowerCase();return t.includes("成功")||t.includes("succe")||t.includes("paid")?"green":t.includes("退")||t.includes("refund")?"orange":t.includes("失败")||t.includes("fail")?"red":"default"}),S=a(()=>{if(!o.event.occurredAt)return"";const t=new Date(o.event.occurredAt);return`${t.getFullYear()}-${String(t.getMonth()+1).padStart(2,"0")}-${String(t.getDate()).padStart(2,"0")} ${String(t.getHours()).padStart(2,"0")}:${String(t.getMinutes()).padStart(2,"0")}`}),x={props:o,c:e,e:d,merchantText:m,itemText:c,amountText:y,orderNo:T,statusText:f,statusColor:w,formattedTime:S,computed:a};return Object.defineProperty(x,"__isScriptSetup",{enumerable:!1,value:!0}),x}},N={class:"order-card"},C={class:"head"},O={class:"time"},V={class:"row"},I={class:"val"},R={class:"row"},B={class:"val"},D={class:"row amount-row"},P={class:"val amount"},j={key:0,class:"row"},A={class:"val mono"},F={key:1,class:"row"};function L(p,r,o,e,d,m){const c=b("a-tag");return l(),u("div",N,[s("div",C,[s("span",O,n(e.formattedTime),1),i(c,{color:"gold"},{default:v(()=>[_(n(o.event.source.adapter),1)]),_:1}),i(c,null,{default:v(()=>[_(n(o.event.subtype),1)]),_:1})]),s("div",V,[r[0]||(r[0]=s("span",{class:"key"},"商户",-1)),s("span",I,n(e.merchantText),1)]),s("div",R,[r[1]||(r[1]=s("span",{class:"key"},"商品/项目",-1)),s("span",B,n(e.itemText),1)]),s("div",D,[r[2]||(r[2]=s("span",{class:"key"},"金额",-1)),s("span",P,n(e.amountText),1)]),e.orderNo?(l(),u("div",j,[r[3]||(r[3]=s("span",{class:"key"},"单号",-1)),s("span",A,n(e.orderNo),1)])):g("v-if",!0),e.statusText?(l(),u("div",F,[r[4]||(r[4]=s("span",{class:"key"},"状态",-1)),i(c,{color:e.statusColor},{default:v(()=>[_(n(e.statusText),1)]),_:1},8,["color"])])):g("v-if",!0)])}const J=h(k,[["render",L],["__scopeId","data-v-5ed5524d"],["__file","/tmp/cc-web-panel-StwILP/repo/packages/web-panel/src/components/pdh/renderers/OrderTableRenderer.vue"]]);export{J as default};

package/src/assets/web-panel/assets/devWarning-nDB--2xr.js

@@ -1 +0,0 @@
-import{Q as r}from"./index-DV-Rfmfx.js";const o=((n,a,e)=>{r(n,`[ant-design-vue: ${a}] ${e}`)});export{o as d};

package/src/assets/web-panel/assets/index-B1_pRTtB.js

@@ -1 +0,0 @@
-import{A as o}from"./Row-B6Q7QkMG.js";import{a0 as t}from"./index-DV-Rfmfx.js";import"./vendor-Bn1JzzAn.js";import"./responsiveObserve-ksEGZ2Wf.js";import"./useFlexGapSupport-DpGnMmPc.js";import"./styleChecker-7yQmQGZ4.js";import"./index-CDGLdn12.js";import"./icons-DG5UD-6K.js";const l=t(o);export{l as default};

package/src/assets/web-panel/assets/index-TMM9FuW-.js

@@ -1 +0,0 @@
-import{C as o}from"./Col-xPSvqdN8.js";import{a0 as t}from"./index-DV-Rfmfx.js";import"./vendor-Bn1JzzAn.js";import"./index-CDGLdn12.js";import"./icons-DG5UD-6K.js";const s=t(o);export{s as default};