chainlesschain 0.162.158 → 0.162.160

package/src/lib/exit-codes.cjs

@@ -0,0 +1,77 @@
+/**
+ * Headless exit-code taxonomy (gap-analysis 2026-07-11, P0 "确定性 Headless"):
+ * scripted callers can tell apart WHY a run ended without parsing stderr.
+ *
+ * Backward compatibility: every failure is still non-zero, 0 stays success,
+ * 2 stays "settings hook blocked the prompt" (pre-existing), 130/143 stay the
+ * signal-interrupt codes. The new codes carve budget/turn exhaustion and
+ * config errors out of the generic 1.
+ */
+
+const HEADLESS_EXIT_CODES = Object.freeze({
+  OK: 0,
+  /** generic failure (tool/loop/unclassified error) */
+  ERROR: 1,
+  /** a settings hook blocked the prompt (pre-existing semantic) */
+  HOOK_BLOCKED: 2,
+  /** the turn budget (--max-turns / loop iteration cap) ran out first */
+  MAX_TURNS: 3,
+  /** the --max-budget-usd cost cap stopped the run */
+  MAX_BUDGET: 4,
+  /** the LLM call itself failed (provider/model/network error) */
+  MODEL_ERROR: 5,
+  /** bad run configuration (--mcp-config / --permission-prompt-tool / settings) */
+  CONFIG_ERROR: 6,
+  /** user interrupt (SIGINT) — 128+2, shell convention */
+  INTERRUPT_SIGINT: 130,
+  /** termination (SIGTERM) — 128+15, shell convention */
+  INTERRUPT_SIGTERM: 143,
+});
+
+/**
+ * Best-effort classifier for errors thrown out of the agent loop: provider /
+ * transport failures → MODEL_ERROR, everything else → generic ERROR. Checks
+ * structural markers (HTTP status, network error codes) before falling back —
+ * never message-text guessing beyond the explicit LLM markers.
+ */
+function classifyLoopError(err) {
+  if (!err) return HEADLESS_EXIT_CODES.ERROR;
+  const status = err.status ?? err.statusCode ?? err.response?.status;
+  if (Number.isFinite(Number(status))) return HEADLESS_EXIT_CODES.MODEL_ERROR;
+  const code = err.code || err.cause?.code;
+  if (
+    typeof code === "string" &&
+    /^(ECONNREFUSED|ECONNRESET|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|UND_ERR)/.test(
+      code,
+    )
+  ) {
+    return HEADLESS_EXIT_CODES.MODEL_ERROR;
+  }
+  if (typeof err.name === "string" && /LLM|Provider|Api/i.test(err.name)) {
+    return HEADLESS_EXIT_CODES.MODEL_ERROR;
+  }
+  return HEADLESS_EXIT_CODES.ERROR;
+}
+
+/**
+ * Map a finished run's endReason (+ error flag) to an exit code.
+ * @param {string} endReason  "complete" | "max_turns" | "budget-exhausted" |
+ *                            "cost-budget-exhausted" | "no-response" | ...
+ * @param {boolean} isError
+ */
+function exitCodeForEndReason(endReason, isError) {
+  if (!isError) return HEADLESS_EXIT_CODES.OK;
+  if (endReason === "max_turns" || endReason === "budget-exhausted") {
+    return HEADLESS_EXIT_CODES.MAX_TURNS;
+  }
+  if (endReason === "cost-budget-exhausted") {
+    return HEADLESS_EXIT_CODES.MAX_BUDGET;
+  }
+  return HEADLESS_EXIT_CODES.ERROR;
+}
+
+module.exports = {
+  HEADLESS_EXIT_CODES,
+  classifyLoopError,
+  exitCodeForEndReason,
+};

package/src/lib/headless-manifest.js

@@ -0,0 +1,175 @@
+/**
+ * Deterministic-headless manifest helpers (gap-analysis 2026-07-11,
+ * docs/CLAUDE_CODE_CLI_GAP_ANALYSIS.md P0 "确定性 Headless").
+ *
+ * The stream-json init event carries a protocol version, whether this run
+ * persists its session, which ambient customization sources are live, and
+ * short digests of the resolved permission policy + tool surface — so a CI
+ * caller can assert "same run shape" across invocations without diffing the
+ * whole event stream.
+ *
+ * STREAM_PROTOCOL_VERSION mirrors packages/agent-sdk/src/protocol.ts
+ * PROTOCOL_VERSION — a BREAKING stream-json change must bump both in the same
+ * commit (see agent-sdk docs/PROTOCOL.md). Additive optional fields stay on
+ * the current version.
+ */
+
+import crypto from "node:crypto";
+import { createRequire } from "node:module";
+
+export const STREAM_PROTOCOL_VERSION = 1;
+
+const _require = createRequire(import.meta.url);
+
+function shortHash(value) {
+  return crypto
+    .createHash("sha256")
+    .update(JSON.stringify(value))
+    .digest("hex")
+    .slice(0, 16);
+}
+
+const sortedList = (v) =>
+  [...new Set((Array.isArray(v) ? v : []).filter(Boolean))].sort();
+
+// null = "no explicit list" (the default full tool set) — kept distinct from
+// an explicit empty list so the digest can tell the two apart.
+const sortedListOrNull = (v) => (Array.isArray(v) ? sortedList(v) : null);
+
+/**
+ * Digest of the resolved permission policy: permission mode + allow/deny tool
+ * lists + settings permission rules. Stable across key order / duplicates so
+ * two runs with the same effective policy produce the same digest.
+ *
+ * @param {object} p
+ * @param {string} [p.permissionMode]
+ * @param {string[]} [p.allowedTools]
+ * @param {string[]} [p.disallowedTools]
+ * @param {{allow?:string[],ask?:string[],deny?:string[]}|null} [p.permissionRules]
+ * @returns {string} 16-hex-char sha256 prefix
+ */
+export function computePolicyDigest({
+  permissionMode,
+  allowedTools,
+  disallowedTools,
+  permissionRules,
+} = {}) {
+  const rules = permissionRules
+    ? {
+        allow: sortedList(permissionRules.allow),
+        ask: sortedList(permissionRules.ask),
+        deny: sortedList(permissionRules.deny),
+      }
+    : null;
+  return shortHash({
+    v: 1,
+    permissionMode: permissionMode || "default",
+    allowedTools: sortedListOrNull(allowedTools),
+    disallowedTools: sortedList(disallowedTools),
+    rules,
+  });
+}
+
+/**
+ * Digest of the tool surface exposed to the model (name set, order-independent).
+ * @param {string[]} toolNames
+ * @returns {string} 16-hex-char sha256 prefix
+ */
+export function computeToolsHash(toolNames) {
+  return shortHash({ v: 1, tools: sortedListOrNull(toolNames) });
+}
+
+/**
+ * Which ambient customization sources are LIVE for this run. Reflects the
+ * kill-switch env vars (--safe-mode / --bare flip these) plus what the runner
+ * actually wired. Under `--bare` this collapses to at most
+ * ["settings-permissions"] (+ explicit MCP), which is the reproducibility
+ * signal CI wants.
+ *
+ * @param {object} p
+ * @param {object|null} [p.permissionRules]  resolved settings permission rules
+ * @param {object|null} [p.settingsHooks]    resolved settings hooks
+ * @param {boolean} [p.mcp]                  MCP surface enabled/connected
+ * @param {string[]} [p.enabledToolNames]
+ * @param {object} [p.env=process.env]
+ * @returns {string[]}
+ */
+export function buildLoadedSources({
+  permissionRules = null,
+  settingsHooks = null,
+  mcp = false,
+  enabledToolNames = null,
+  env = process.env,
+} = {}) {
+  const on = (k) => env[k] !== "0";
+  // null tool list = "default full set" → run_skill is available.
+  const skillToolAvailable =
+    !Array.isArray(enabledToolNames) || enabledToolNames.includes("run_skill");
+  const sources = [];
+  if (permissionRules) sources.push("settings-permissions");
+  if (settingsHooks) sources.push("settings-hooks");
+  if (on("CC_PROJECT_MEMORY")) sources.push("project-memory");
+  if (on("CC_MEMORY_INJECT")) sources.push("memory-recall");
+  if (on("CC_SKILLS") && skillToolAvailable) {
+    sources.push("skills");
+  }
+  if (on("CC_PLUGINS")) sources.push("plugins");
+  if (mcp) sources.push("mcp");
+  return sources;
+}
+
+/**
+ * Machine-readable capability manifest for `cc agent --capabilities`:
+ * everything a programmatic caller needs to know up front to drive this CLI
+ * (protocol version, tool names, permission modes, IO formats, exit codes,
+ * feature flags) without parsing --help text.
+ */
+export function buildAgentCapabilities() {
+  let version = null;
+  try {
+    version = _require("../../package.json").version || null;
+  } catch {
+    /* manifest stays usable without a version */
+  }
+  const contract = _require("../runtime/coding-agent-contract-shared.cjs");
+  const { HEADLESS_EXIT_CODES } = _require("./exit-codes.cjs");
+  return {
+    name: "chainlesschain-cli",
+    version,
+    protocol_version: STREAM_PROTOCOL_VERSION,
+    agent_tools: contract.listCodingAgentToolNames(),
+    permission_modes: [
+      "default",
+      "manual",
+      "auto",
+      "dontAsk",
+      "plan",
+      "acceptEdits",
+      "bypassPermissions",
+    ],
+    output_formats: ["text", "json", "stream-json"],
+    input_formats: ["text", "stream-json"],
+    exit_codes: HEADLESS_EXIT_CODES,
+    features: {
+      bare: true,
+      safe_mode: true,
+      ephemeral: true,
+      background: true,
+      worktree: true,
+      checkpoint: true,
+      json_schema_output: true,
+      partial_messages: true,
+      interactive_approvals: true,
+      permission_prompt_tool: true,
+      remote_control: true,
+      mcp: {
+        config_file: true,
+        registry: true,
+        tool_search: true,
+        oauth: true,
+        managed_allowlist: true,
+      },
+      sandbox_engines: ["docker", "bubblewrap"],
+    },
+  };
+}

package/src/lib/hook-runner.cjs

@@ -117,6 +117,69 @@ function tryParseDecision(stdout) {
  *            nonBlockingError?:boolean, error?:string }}
  */
 function runCommandHook(command, input = {}, opts = {}) {
+  if (!command) {
+    return { decision: HOOK_DECISIONS.CONTINUE, reason: null, exitCode: 0 };
+  }
+  // Circuit breaker (gap 2026-07-11 P2 "Hooks 硬化"): N consecutive
+  // non-blocking failures (spawn error / timeout / non-zero non-2 exit) of
+  // the SAME command trip an open state — further runs are skipped for a
+  // cooldown, then one half-open trial runs; success (or a real block/ask
+  // decision) closes it. CC_HOOK_BREAKER_THRESHOLD=0 disables.
+  const breaker = hookBreakerConfig();
+  if (breaker.threshold > 0) {
+    const st = _breaker.get(command);
+    if (st && st.fails >= breaker.threshold) {
+      const now = Date.now();
+      if (now - st.openedAt < breaker.cooldownMs) {
+        return {
+          decision: HOOK_DECISIONS.CONTINUE,
+          reason: `hook circuit breaker open (${st.fails} consecutive failures) — skipped for cooldown`,
+          exitCode: null,
+          skipped: true,
+          breakerOpen: true,
+        };
+      }
+      // half-open: let this one trial through; the outcome below decides.
+    }
+  }
+  const result = _runCommandHookInner(command, input, opts);
+  if (breaker.threshold > 0) {
+    if (result.nonBlockingError) {
+      const st = _breaker.get(command) || { fails: 0, openedAt: 0 };
+      st.fails += 1;
+      if (st.fails >= breaker.threshold) st.openedAt = Date.now();
+      _breaker.set(command, st);
+    } else {
+      _breaker.delete(command); // success / block / ask closes the breaker
+    }
+  }
+  return result;
+}
+
+// Payload schema version (gap 2026-07-11 P2): every hook's stdin JSON carries
+// schema_version so hook scripts can branch on future payload changes.
+// Additive-only changes keep the version; a breaking reshape must bump it.
+const HOOK_PAYLOAD_SCHEMA_VERSION = 1;
+
+// command → { fails, openedAt } (per process; hooks are per-run anyway)
+const _breaker = new Map();
+
+function hookBreakerConfig(env = process.env) {
+  const threshold = Number(env.CC_HOOK_BREAKER_THRESHOLD);
+  const cooldown = Number(env.CC_HOOK_BREAKER_COOLDOWN_MS);
+  return {
+    threshold:
+      Number.isFinite(threshold) && threshold >= 0 ? Math.floor(threshold) : 3,
+    cooldownMs: Number.isFinite(cooldown) && cooldown > 0 ? cooldown : 60000,
+  };
+}
+
+/** Test seam: clear breaker state between cases. */
+function _resetHookBreaker() {
+  _breaker.clear();
+}
+
+function _runCommandHookInner(command, input = {}, opts = {}) {
   const { cwd, event } = opts;
   // spawnSync is SYNCHRONOUS — it blocks the whole agent until the hook returns
   // or its timeout fires. Node treats a 0/undefined timeout as UNLIMITED, so a
@@ -128,15 +191,15 @@ function runCommandHook(command, input = {}, opts = {}) {
     Number.isFinite(_rawTimeout) && _rawTimeout > 0
       ? Math.min(_rawTimeout, 600000)
       : 60000;
-  if (!command) {
-    return { decision: HOOK_DECISIONS.CONTINUE, reason: null, exitCode: 0 };
-  }
   const shellKind = normalizeShellKind(opts.shell);
   const usePowershell = shellKind === "powershell" || shellKind === "pwsh";
   let res;
   try {
     const common = {
-      input: JSON.stringify(input),
+      input: JSON.stringify({
+        ...input,
+        schema_version: input.schema_version ?? HOOK_PAYLOAD_SCHEMA_VERSION,
+      }),
       cwd: cwd || process.cwd(),
       encoding: "utf-8",
       timeout,
@@ -258,5 +321,8 @@ module.exports = {
   runHooks,
   tryParseDecision,
   HOOK_DECISIONS,
+  HOOK_PAYLOAD_SCHEMA_VERSION,
+  hookBreakerConfig,
+  _resetHookBreaker,
   _deps,
 };

package/src/lib/ide-context-redaction.js

@@ -0,0 +1,130 @@
+/**
+ * IDE-context redaction — the implicit-context counterpart of the credential
+ * READ guard ([[credential-guard.js]]).
+ *
+ * The IDE bridge shares editor state (selection text, open-editor tabs,
+ * terminal output, diagnostics) with every prompt WITHOUT any tool-permission
+ * gate: nothing was "read" through read_file, so denyRead rules and the
+ * credential guard never fire. An open `.env` tab or an `export API_KEY=…`
+ * still visible in the integrated terminal would ride straight into model
+ * context. This module closes that side door:
+ *
+ *   1. `filterIdeFileEntry` — file-path entries (open editors, selection file,
+ *      diagnostics files) that name a credential file are dropped, reusing the
+ *      exact same `credentialFileReason` patterns the read guard enforces. The
+ *      non-resolved variant is deliberate: these paths come from the IDE, may
+ *      not exist locally, and a pure string check never touches the fs.
+ *   2. `redactSecretsInText` — free text (selection, terminal output,
+ *      diagnostic messages) is scrubbed with a conservative set of secret
+ *      shapes: AWS access-key ids, Bearer tokens, PEM private-key blocks,
+ *      well-known token prefixes, and `SECRET_NAME = value` assignments (only
+ *      the VALUE is swallowed — key names and ordinary code survive).
+ *
+ * Precision over recall, same posture as the guards: a redactor that mangles
+ * everyday code teaches users to turn it off. `CC_IDE_CONTEXT_REDACTION=0`
+ * disables (default ON).
+ */
+
+import {
+  credentialFileReason,
+  _internals as credentialGuardInternals,
+} from "./credential-guard.js";
+
+const REDACTED = "[REDACTED]";
+const REDACTED_FILE = "[redacted credential file]";
+
+// Boundary-delimited secret words (KEY / TOKEN / SECRET / PASSWORD / …) —
+// shared with the credential guard so both surfaces agree on what "looks
+// secret".
+const SECRET_VAR_RE = credentialGuardInternals.SECRET_VAR_RE;
+
+// AWS access-key ids are globally unique, fixed-shape strings.
+const AWS_ACCESS_KEY_RE = /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g;
+
+// `Bearer <token>` in headers / curl lines / pasted requests.
+const BEARER_RE = /\b(Bearer)\s+[A-Za-z0-9\-._~+/=]{8,}/g;
+
+// PEM private-key blocks — the bytes ARE the secret. A block whose END marker
+// was truncated off still redacts to the end of the text (fail toward safety).
+const PEM_PRIVATE_KEY_RE =
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/g;
+
+// High-precision vendor token prefixes (OpenAI/Anthropic sk-, GitHub PATs,
+// GitLab PATs, Slack xox*) — unambiguous even outside an assignment.
+const TOKEN_PREFIX_RE =
+  /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{16,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g;
+
+// `API_KEY = "value"` / `token: value` / JSON `"secret": "value"` — the key
+// must contain a boundary-delimited secret word, the value must be a bare
+// token-like run (≥8 chars, no spaces). The trailing lookahead rejects values
+// that continue into a call — `token = getToken()` is code, not a secret.
+// Only the value is replaced; the key and separator are kept so the agent
+// still sees WHAT was configured, just not the secret itself.
+const ASSIGNMENT_RE =
+  /\b([A-Za-z_][A-Za-z0-9_-]*)(["']?\s*[=:]\s*)(["']?)([A-Za-z0-9+/=_.\-]{8,})\3(?![A-Za-z0-9+/=_.\-(])/g;
+
+/**
+ * Env kill-switch: CC_IDE_CONTEXT_REDACTION=0|false|no|off disables all IDE
+ * context redaction. Default ON — only an explicit opt-out turns it off.
+ */
+export function ideRedactionEnabled(env = process.env) {
+  const raw = env && env.CC_IDE_CONTEXT_REDACTION;
+  return !(raw != null && /^(0|false|no|off)$/i.test(String(raw).trim()));
+}
+
+/**
+ * Gate one IDE-supplied file-path entry (open-editor tab, selection file,
+ * diagnostic file). Returns the path unchanged when it is fine to share, or
+ * null when it names a credential/secret file and the whole entry must be
+ * dropped (or replaced with the `REDACTED_FILE_PLACEHOLDER`).
+ *
+ * Pure string check by design (non-resolved `credentialFileReason`): IDE paths
+ * may be remote/virtual, and a context filter must never do fs I/O. `cwd` is
+ * accepted for signature parity with the resolved guards but unused here.
+ *
+ * @param {string} filePath
+ * @param {object} [opts] { cwd?, env? }
+ * @returns {string|null}
+ */
+export function filterIdeFileEntry(filePath, opts = {}) {
+  const p = String(filePath || "");
+  if (!p) return filePath ?? null;
+  if (!ideRedactionEnabled(opts.env || process.env)) return filePath;
+  return credentialFileReason(p) ? null : filePath;
+}
+
+/**
+ * Scrub secret-shaped substrings out of IDE-supplied free text (selection
+ * text, terminal output, diagnostic messages). Non-strings pass through
+ * untouched; with the kill-switch off the text is returned as-is.
+ *
+ * @param {string} text
+ * @param {object} [opts] { env? }
+ * @returns {string}
+ */
+export function redactSecretsInText(text, opts = {}) {
+  if (typeof text !== "string" || text.length === 0) return text;
+  if (!ideRedactionEnabled(opts.env || process.env)) return text;
+  let out = text;
+  out = out.replace(PEM_PRIVATE_KEY_RE, REDACTED);
+  out = out.replace(BEARER_RE, (_m, word) => `${word} ${REDACTED}`);
+  out = out.replace(AWS_ACCESS_KEY_RE, REDACTED);
+  out = out.replace(TOKEN_PREFIX_RE, REDACTED);
+  out = out.replace(ASSIGNMENT_RE, (m, key, sep, quote, _value) => {
+    // Hyphens count as segment boundaries too (api-key ≙ api_key).
+    if (!SECRET_VAR_RE.test(key.replace(/-/g, "_"))) return m;
+    return `${key}${sep}${quote}${REDACTED}${quote}`;
+  });
+  return out;
+}
+
+export const REDACTED_MARKER = REDACTED;
+export const REDACTED_FILE_PLACEHOLDER = REDACTED_FILE;
+
+export const _internals = {
+  AWS_ACCESS_KEY_RE,
+  BEARER_RE,
+  PEM_PRIVATE_KEY_RE,
+  TOKEN_PREFIX_RE,
+  ASSIGNMENT_RE,
+};

package/src/lib/ide-context.js

@@ -18,6 +18,10 @@
  */
 
 import { simpleDiff } from "./note-versioning.js";
+import {
+  filterIdeFileEntry,
+  redactSecretsInText,
+} from "./ide-context-redaction.js";
 
 /** Hard cap on the selected text we inline into the prompt. */
 const SELECTION_TEXT_CAP = 2000;
@@ -86,6 +90,61 @@ export function parseToolResultJson(result) {
   }
 }
 
+// ─── Redaction seams (see [[ide-context-redaction.js]]) ─────────────────────
+// IDE context bypasses the tool-permission layer entirely (nothing goes
+// through read_file), so credential files and secret-shaped text are filtered
+// HERE, at the collection boundary, before anything reaches the prompt.
+// CC_IDE_CONTEXT_REDACTION=0 disables (the filters below become pass-through).
+
+/** Drop the selection when it lives in a credential file; scrub its text. */
+function sanitizeIdeSelection(sel, env) {
+  if (!sel) return sel;
+  if (sel.file && filterIdeFileEntry(sel.file, { env }) === null) return null;
+  if (typeof sel.text === "string" && sel.text.length > 0) {
+    const scrubbed = redactSecretsInText(sel.text, { env });
+    if (scrubbed !== sel.text) return { ...sel, text: scrubbed };
+  }
+  return sel;
+}
+
+/** Drop open-editor entries whose file is a credential file. */
+function sanitizeIdeEditors(editors, env) {
+  if (!Array.isArray(editors)) return editors;
+  return editors.filter(
+    (e) => !(e && e.file && filterIdeFileEntry(e.file, { env }) === null),
+  );
+}
+
+/** Scrub secret-shaped text out of terminal commands and their output. */
+function sanitizeIdeTerminals(terms, env) {
+  if (!Array.isArray(terms)) return terms;
+  return terms.map((t) => {
+    if (!t || typeof t !== "object") return t;
+    const out = { ...t };
+    if (typeof out.command === "string") {
+      out.command = redactSecretsInText(out.command, { env });
+    }
+    if (typeof out.output === "string") {
+      out.output = redactSecretsInText(out.output, { env });
+    }
+    return out;
+  });
+}
+
+/** Drop diagnostics for credential files; scrub their message text. */
+function sanitizeIdeDiagnostics(diags, env) {
+  if (!Array.isArray(diags)) return diags;
+  return diags
+    .filter(
+      (d) => !(d && d.file && filterIdeFileEntry(d.file, { env }) === null),
+    )
+    .map((d) =>
+      d && typeof d.message === "string"
+        ? { ...d, message: redactSecretsInText(d.message, { env }) }
+        : d,
+    );
+}
+
 /** Resolve to the promise's value, or null after `ms` / on rejection. */
 function withTimeout(promise, ms) {
   return new Promise((resolve) => {
@@ -137,18 +196,22 @@ export async function collectIdeContext(mcp, opts = {}) {
       ? call("mcp__ide__getTerminalOutput", { limit: TERMINAL_LIMIT })
       : Promise.resolve(null),
   ]);
-  const openEditors = Array.isArray(editors?.editors) ? editors.editors : null;
-  const terminals = Array.isArray(terminalData?.terminals)
+  const env = opts.env || process.env;
+  const sel = sanitizeIdeSelection(selection || null, env);
+  let openEditors = Array.isArray(editors?.editors) ? editors.editors : null;
+  if (openEditors) openEditors = sanitizeIdeEditors(openEditors, env);
+  let terminals = Array.isArray(terminalData?.terminals)
     ? terminalData.terminals
     : null;
+  if (terminals) terminals = sanitizeIdeTerminals(terminals, env);
   if (
-    !selection &&
+    !sel &&
     !(openEditors && openEditors.length > 0) &&
     !(terminals && terminals.length > 0)
   ) {
     return null;
   }
-  return { selection: selection || null, openEditors, terminals };
+  return { selection: sel, openEditors, terminals };
 }
 
 /**
@@ -304,8 +367,11 @@ export async function collectIdeDiagnostics(mcp, filePath, opts = {}) {
   );
   const all = Array.isArray(data?.diagnostics) ? data.diagnostics : null;
   if (!all) return null;
-  const relevant = all.filter(
-    (d) => d && DIAG_SEVERITIES.has(String(d.severity).toLowerCase()),
+  const relevant = sanitizeIdeDiagnostics(
+    all.filter(
+      (d) => d && DIAG_SEVERITIES.has(String(d.severity).toLowerCase()),
+    ),
+    env,
   );
   return relevant.length > 0 ? relevant : null;
 }
@@ -653,6 +719,7 @@ export async function expandIdeMentions(text, mcp, opts = {}) {
   const mentions = findIdeMentions(src);
   if (mentions.length === 0) return out;
   const timeoutMs = opts.timeoutMs || DEFAULT_TIMEOUT_MS;
+  const env = opts.env || process.env;
   const blocks = [];
   for (const kind of mentions) {
     try {
@@ -663,11 +730,9 @@ export async function expandIdeMentions(text, mcp, opts = {}) {
           );
           continue;
         }
-        const sel = await callIdeToolJson(
-          mcp,
-          "mcp__ide__getSelection",
-          {},
-          timeoutMs,
+        const sel = sanitizeIdeSelection(
+          await callIdeToolJson(mcp, "mcp__ide__getSelection", {}, timeoutMs),
+          env,
         );
         const b = formatSelectionMention(sel);
         if (b) {
@@ -689,7 +754,14 @@ export async function expandIdeMentions(text, mcp, opts = {}) {
           {},
           timeoutMs,
         );
-        const b = formatDiagnosticsMention(data);
+        const safe =
+          data && Array.isArray(data.diagnostics)
+            ? {
+                ...data,
+                diagnostics: sanitizeIdeDiagnostics(data.diagnostics, env),
+              }
+            : data;
+        const b = formatDiagnosticsMention(safe);
         if (b) {
           blocks.push(b);
           out.expanded.push("diagnostics");
@@ -709,7 +781,11 @@ export async function expandIdeMentions(text, mcp, opts = {}) {
           { limit: TERMINAL_MENTION_LIMIT },
           timeoutMs,
         );
-        const b = formatTerminalMention(data);
+        const safe =
+          data && Array.isArray(data.terminals)
+            ? { ...data, terminals: sanitizeIdeTerminals(data.terminals, env) }
+            : data;
+        const b = formatTerminalMention(safe);
         if (b) {
           blocks.push(b);
           out.expanded.push("terminal");

package/src/lib/jsonl-session-store.js

@@ -15,11 +15,14 @@ export {
   appendUserMessage,
   appendAssistantMessage,
   appendToolCall,
+  appendToolCallCompact,
   appendToolResult,
   appendCompactEvent,
   readEvents,
   rebuildMessages,
   listJsonlSessions,
+  renameSession,
+  pruneJsonlSessions,
   forkSession,
   sessionExists,
   getLastSessionId,
@@ -33,4 +36,7 @@ export {
   isUnsafeSessionId,
   appendTokenUsage,
   toIsoSafe,
+  verifySession,
+  verifyAllSessions,
+  TRANSCRIPT_CHAIN_STATUS,
 } from "../harness/jsonl-session-store.js";