chainlesschain 0.162.159 → 0.162.161

package/src/lib/headless-manifest.js

@@ -0,0 +1,188 @@
+/**
+ * Deterministic-headless manifest helpers (gap-analysis 2026-07-11,
+ * docs/CLAUDE_CODE_CLI_GAP_ANALYSIS.md P0 "确定性 Headless").
+ *
+ * The stream-json init event carries a protocol version, whether this run
+ * persists its session, which ambient customization sources are live, and
+ * short digests of the resolved permission policy + tool surface — so a CI
+ * caller can assert "same run shape" across invocations without diffing the
+ * whole event stream.
+ *
+ * STREAM_PROTOCOL_VERSION mirrors packages/agent-sdk/src/protocol.ts
+ * PROTOCOL_VERSION — a BREAKING stream-json change must bump both in the same
+ * commit (see agent-sdk docs/PROTOCOL.md). Additive optional fields stay on
+ * the current version.
+ */
+
+import crypto from "node:crypto";
+import { createRequire } from "node:module";
+import { PROTOCOL_MIN_VERSION } from "./capability-negotiation.js";
+
+export const STREAM_PROTOCOL_VERSION = 1;
+
+const _require = createRequire(import.meta.url);
+
+function shortHash(value) {
+  return crypto
+    .createHash("sha256")
+    .update(JSON.stringify(value))
+    .digest("hex")
+    .slice(0, 16);
+}
+
+const sortedList = (v) =>
+  [...new Set((Array.isArray(v) ? v : []).filter(Boolean))].sort();
+
+// null = "no explicit list" (the default full tool set) — kept distinct from
+// an explicit empty list so the digest can tell the two apart.
+const sortedListOrNull = (v) => (Array.isArray(v) ? sortedList(v) : null);
+
+/**
+ * Digest of the resolved permission policy: permission mode + allow/deny tool
+ * lists + settings permission rules. Stable across key order / duplicates so
+ * two runs with the same effective policy produce the same digest.
+ *
+ * @param {object} p
+ * @param {string} [p.permissionMode]
+ * @param {string[]} [p.allowedTools]
+ * @param {string[]} [p.disallowedTools]
+ * @param {{allow?:string[],ask?:string[],deny?:string[]}|null} [p.permissionRules]
+ * @returns {string} 16-hex-char sha256 prefix
+ */
+export function computePolicyDigest({
+  permissionMode,
+  allowedTools,
+  disallowedTools,
+  permissionRules,
+} = {}) {
+  const rules = permissionRules
+    ? {
+        allow: sortedList(permissionRules.allow),
+        ask: sortedList(permissionRules.ask),
+        deny: sortedList(permissionRules.deny),
+      }
+    : null;
+  return shortHash({
+    v: 1,
+    permissionMode: permissionMode || "default",
+    allowedTools: sortedListOrNull(allowedTools),
+    disallowedTools: sortedList(disallowedTools),
+    rules,
+  });
+}
+
+/**
+ * Digest of the tool surface exposed to the model (name set, order-independent).
+ * @param {string[]} toolNames
+ * @returns {string} 16-hex-char sha256 prefix
+ */
+export function computeToolsHash(toolNames) {
+  return shortHash({ v: 1, tools: sortedListOrNull(toolNames) });
+}
+
+/**
+ * Which ambient customization sources are LIVE for this run. Reflects the
+ * kill-switch env vars (--safe-mode / --bare flip these) plus what the runner
+ * actually wired. Under `--bare` this collapses to at most
+ * ["settings-permissions"] (+ explicit MCP), which is the reproducibility
+ * signal CI wants.
+ *
+ * @param {object} p
+ * @param {object|null} [p.permissionRules]  resolved settings permission rules
+ * @param {object|null} [p.settingsHooks]    resolved settings hooks
+ * @param {boolean} [p.mcp]                  MCP surface enabled/connected
+ * @param {string[]} [p.enabledToolNames]
+ * @param {object} [p.env=process.env]
+ * @returns {string[]}
+ */
+export function buildLoadedSources({
+  permissionRules = null,
+  settingsHooks = null,
+  mcp = false,
+  enabledToolNames = null,
+  env = process.env,
+} = {}) {
+  const on = (k) => env[k] !== "0";
+  // null tool list = "default full set" → run_skill is available.
+  const skillToolAvailable =
+    !Array.isArray(enabledToolNames) || enabledToolNames.includes("run_skill");
+  const sources = [];
+  if (permissionRules) sources.push("settings-permissions");
+  if (settingsHooks) sources.push("settings-hooks");
+  if (on("CC_PROJECT_MEMORY")) sources.push("project-memory");
+  if (on("CC_MEMORY_INJECT")) sources.push("memory-recall");
+  if (on("CC_SKILLS") && skillToolAvailable) {
+    sources.push("skills");
+  }
+  if (on("CC_PLUGINS")) sources.push("plugins");
+  if (mcp) sources.push("mcp");
+  return sources;
+}
+
+/**
+ * Machine-readable capability manifest for `cc agent --capabilities`:
+ * everything a programmatic caller needs to know up front to drive this CLI
+ * (protocol version, tool names, permission modes, IO formats, exit codes,
+ * feature flags) without parsing --help text.
+ */
+export function buildAgentCapabilities() {
+  let version = null;
+  try {
+    version = _require("../../package.json").version || null;
+  } catch {
+    /* manifest stays usable without a version */
+  }
+  const contract = _require("../runtime/coding-agent-contract-shared.cjs");
+  const { HEADLESS_EXIT_CODES } = _require("./exit-codes.cjs");
+  return {
+    name: "chainlesschain-cli",
+    version,
+    protocol_version: STREAM_PROTOCOL_VERSION,
+    // Oldest wire version this CLI can still negotiate down to (the N-1 in the
+    // capability handshake, agent-sdk docs/PROTOCOL.md §1.3). At v1 there is no
+    // older line shape, so min === current.
+    min_protocol_version: PROTOCOL_MIN_VERSION,
+    agent_tools: contract.listCodingAgentToolNames(),
+    permission_modes: [
+      "default",
+      "manual",
+      "auto",
+      "dontAsk",
+      "plan",
+      "acceptEdits",
+      "bypassPermissions",
+    ],
+    output_formats: ["text", "json", "stream-json"],
+    input_formats: ["text", "stream-json"],
+    exit_codes: HEADLESS_EXIT_CODES,
+    features: {
+      bare: true,
+      safe_mode: true,
+      ephemeral: true,
+      background: true,
+      worktree: true,
+      checkpoint: true,
+      json_schema_output: true,
+      partial_messages: true,
+      interactive_approvals: true,
+      permission_prompt_tool: true,
+      remote_control: true,
+      // Additive protocol-v1 stream fields (agent-sdk docs/PROTOCOL.md §1.2.1):
+      // every stream-json stdout line carries a monotonic `seq` and a
+      // run-scoped `trace_id`, and tool_use/tool_result lines carry a pairing
+      // `id` ("tu-<n>"). `trace_id` is caller-injectable (--trace-id /
+      // CC_TRACE_ID) for end-to-end IDE ↔ CLI correlation.
+      tool_use_id: true,
+      event_seq: true,
+      trace_id: true,
+      mcp: {
+        config_file: true,
+        registry: true,
+        tool_search: true,
+        oauth: true,
+        managed_allowlist: true,
+      },
+      sandbox_engines: ["docker", "bubblewrap"],
+    },
+  };
+}

package/src/lib/hook-runner.cjs

@@ -117,6 +117,69 @@ function tryParseDecision(stdout) {
  *            nonBlockingError?:boolean, error?:string }}
  */
 function runCommandHook(command, input = {}, opts = {}) {
+  if (!command) {
+    return { decision: HOOK_DECISIONS.CONTINUE, reason: null, exitCode: 0 };
+  }
+  // Circuit breaker (gap 2026-07-11 P2 "Hooks 硬化"): N consecutive
+  // non-blocking failures (spawn error / timeout / non-zero non-2 exit) of
+  // the SAME command trip an open state — further runs are skipped for a
+  // cooldown, then one half-open trial runs; success (or a real block/ask
+  // decision) closes it. CC_HOOK_BREAKER_THRESHOLD=0 disables.
+  const breaker = hookBreakerConfig();
+  if (breaker.threshold > 0) {
+    const st = _breaker.get(command);
+    if (st && st.fails >= breaker.threshold) {
+      const now = Date.now();
+      if (now - st.openedAt < breaker.cooldownMs) {
+        return {
+          decision: HOOK_DECISIONS.CONTINUE,
+          reason: `hook circuit breaker open (${st.fails} consecutive failures) — skipped for cooldown`,
+          exitCode: null,
+          skipped: true,
+          breakerOpen: true,
+        };
+      }
+      // half-open: let this one trial through; the outcome below decides.
+    }
+  }
+  const result = _runCommandHookInner(command, input, opts);
+  if (breaker.threshold > 0) {
+    if (result.nonBlockingError) {
+      const st = _breaker.get(command) || { fails: 0, openedAt: 0 };
+      st.fails += 1;
+      if (st.fails >= breaker.threshold) st.openedAt = Date.now();
+      _breaker.set(command, st);
+    } else {
+      _breaker.delete(command); // success / block / ask closes the breaker
+    }
+  }
+  return result;
+}
+
+// Payload schema version (gap 2026-07-11 P2): every hook's stdin JSON carries
+// schema_version so hook scripts can branch on future payload changes.
+// Additive-only changes keep the version; a breaking reshape must bump it.
+const HOOK_PAYLOAD_SCHEMA_VERSION = 1;
+
+// command → { fails, openedAt } (per process; hooks are per-run anyway)
+const _breaker = new Map();
+
+function hookBreakerConfig(env = process.env) {
+  const threshold = Number(env.CC_HOOK_BREAKER_THRESHOLD);
+  const cooldown = Number(env.CC_HOOK_BREAKER_COOLDOWN_MS);
+  return {
+    threshold:
+      Number.isFinite(threshold) && threshold >= 0 ? Math.floor(threshold) : 3,
+    cooldownMs: Number.isFinite(cooldown) && cooldown > 0 ? cooldown : 60000,
+  };
+}
+
+/** Test seam: clear breaker state between cases. */
+function _resetHookBreaker() {
+  _breaker.clear();
+}
+
+function _runCommandHookInner(command, input = {}, opts = {}) {
   const { cwd, event } = opts;
   // spawnSync is SYNCHRONOUS — it blocks the whole agent until the hook returns
   // or its timeout fires. Node treats a 0/undefined timeout as UNLIMITED, so a
@@ -128,15 +191,15 @@ function runCommandHook(command, input = {}, opts = {}) {
     Number.isFinite(_rawTimeout) && _rawTimeout > 0
       ? Math.min(_rawTimeout, 600000)
       : 60000;
-  if (!command) {
-    return { decision: HOOK_DECISIONS.CONTINUE, reason: null, exitCode: 0 };
-  }
   const shellKind = normalizeShellKind(opts.shell);
   const usePowershell = shellKind === "powershell" || shellKind === "pwsh";
   let res;
   try {
     const common = {
-      input: JSON.stringify(input),
+      input: JSON.stringify({
+        ...input,
+        schema_version: input.schema_version ?? HOOK_PAYLOAD_SCHEMA_VERSION,
+      }),
       cwd: cwd || process.cwd(),
       encoding: "utf-8",
       timeout,
@@ -258,5 +321,8 @@ module.exports = {
   runHooks,
   tryParseDecision,
   HOOK_DECISIONS,
+  HOOK_PAYLOAD_SCHEMA_VERSION,
+  hookBreakerConfig,
+  _resetHookBreaker,
   _deps,
 };

package/src/lib/ide-context-redaction.js

@@ -0,0 +1,130 @@
+/**
+ * IDE-context redaction — the implicit-context counterpart of the credential
+ * READ guard ([[credential-guard.js]]).
+ *
+ * The IDE bridge shares editor state (selection text, open-editor tabs,
+ * terminal output, diagnostics) with every prompt WITHOUT any tool-permission
+ * gate: nothing was "read" through read_file, so denyRead rules and the
+ * credential guard never fire. An open `.env` tab or an `export API_KEY=…`
+ * still visible in the integrated terminal would ride straight into model
+ * context. This module closes that side door:
+ *
+ *   1. `filterIdeFileEntry` — file-path entries (open editors, selection file,
+ *      diagnostics files) that name a credential file are dropped, reusing the
+ *      exact same `credentialFileReason` patterns the read guard enforces. The
+ *      non-resolved variant is deliberate: these paths come from the IDE, may
+ *      not exist locally, and a pure string check never touches the fs.
+ *   2. `redactSecretsInText` — free text (selection, terminal output,
+ *      diagnostic messages) is scrubbed with a conservative set of secret
+ *      shapes: AWS access-key ids, Bearer tokens, PEM private-key blocks,
+ *      well-known token prefixes, and `SECRET_NAME = value` assignments (only
+ *      the VALUE is swallowed — key names and ordinary code survive).
+ *
+ * Precision over recall, same posture as the guards: a redactor that mangles
+ * everyday code teaches users to turn it off. `CC_IDE_CONTEXT_REDACTION=0`
+ * disables (default ON).
+ */
+
+import {
+  credentialFileReason,
+  _internals as credentialGuardInternals,
+} from "./credential-guard.js";
+
+const REDACTED = "[REDACTED]";
+const REDACTED_FILE = "[redacted credential file]";
+
+// Boundary-delimited secret words (KEY / TOKEN / SECRET / PASSWORD / …) —
+// shared with the credential guard so both surfaces agree on what "looks
+// secret".
+const SECRET_VAR_RE = credentialGuardInternals.SECRET_VAR_RE;
+
+// AWS access-key ids are globally unique, fixed-shape strings.
+const AWS_ACCESS_KEY_RE = /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g;
+
+// `Bearer <token>` in headers / curl lines / pasted requests.
+const BEARER_RE = /\b(Bearer)\s+[A-Za-z0-9\-._~+/=]{8,}/g;
+
+// PEM private-key blocks — the bytes ARE the secret. A block whose END marker
+// was truncated off still redacts to the end of the text (fail toward safety).
+const PEM_PRIVATE_KEY_RE =
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/g;
+
+// High-precision vendor token prefixes (OpenAI/Anthropic sk-, GitHub PATs,
+// GitLab PATs, Slack xox*) — unambiguous even outside an assignment.
+const TOKEN_PREFIX_RE =
+  /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{16,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g;
+
+// `API_KEY = "value"` / `token: value` / JSON `"secret": "value"` — the key
+// must contain a boundary-delimited secret word, the value must be a bare
+// token-like run (≥8 chars, no spaces). The trailing lookahead rejects values
+// that continue into a call — `token = getToken()` is code, not a secret.
+// Only the value is replaced; the key and separator are kept so the agent
+// still sees WHAT was configured, just not the secret itself.
+const ASSIGNMENT_RE =
+  /\b([A-Za-z_][A-Za-z0-9_-]*)(["']?\s*[=:]\s*)(["']?)([A-Za-z0-9+/=_.\-]{8,})\3(?![A-Za-z0-9+/=_.\-(])/g;
+
+/**
+ * Env kill-switch: CC_IDE_CONTEXT_REDACTION=0|false|no|off disables all IDE
+ * context redaction. Default ON — only an explicit opt-out turns it off.
+ */
+export function ideRedactionEnabled(env = process.env) {
+  const raw = env && env.CC_IDE_CONTEXT_REDACTION;
+  return !(raw != null && /^(0|false|no|off)$/i.test(String(raw).trim()));
+}
+
+/**
+ * Gate one IDE-supplied file-path entry (open-editor tab, selection file,
+ * diagnostic file). Returns the path unchanged when it is fine to share, or
+ * null when it names a credential/secret file and the whole entry must be
+ * dropped (or replaced with the `REDACTED_FILE_PLACEHOLDER`).
+ *
+ * Pure string check by design (non-resolved `credentialFileReason`): IDE paths
+ * may be remote/virtual, and a context filter must never do fs I/O. `cwd` is
+ * accepted for signature parity with the resolved guards but unused here.
+ *
+ * @param {string} filePath
+ * @param {object} [opts] { cwd?, env? }
+ * @returns {string|null}
+ */
+export function filterIdeFileEntry(filePath, opts = {}) {
+  const p = String(filePath || "");
+  if (!p) return filePath ?? null;
+  if (!ideRedactionEnabled(opts.env || process.env)) return filePath;
+  return credentialFileReason(p) ? null : filePath;
+}
+
+/**
+ * Scrub secret-shaped substrings out of IDE-supplied free text (selection
+ * text, terminal output, diagnostic messages). Non-strings pass through
+ * untouched; with the kill-switch off the text is returned as-is.
+ *
+ * @param {string} text
+ * @param {object} [opts] { env? }
+ * @returns {string}
+ */
+export function redactSecretsInText(text, opts = {}) {
+  if (typeof text !== "string" || text.length === 0) return text;
+  if (!ideRedactionEnabled(opts.env || process.env)) return text;
+  let out = text;
+  out = out.replace(PEM_PRIVATE_KEY_RE, REDACTED);
+  out = out.replace(BEARER_RE, (_m, word) => `${word} ${REDACTED}`);
+  out = out.replace(AWS_ACCESS_KEY_RE, REDACTED);
+  out = out.replace(TOKEN_PREFIX_RE, REDACTED);
+  out = out.replace(ASSIGNMENT_RE, (m, key, sep, quote, _value) => {
+    // Hyphens count as segment boundaries too (api-key ≙ api_key).
+    if (!SECRET_VAR_RE.test(key.replace(/-/g, "_"))) return m;
+    return `${key}${sep}${quote}${REDACTED}${quote}`;
+  });
+  return out;
+}
+
+export const REDACTED_MARKER = REDACTED;
+export const REDACTED_FILE_PLACEHOLDER = REDACTED_FILE;
+
+export const _internals = {
+  AWS_ACCESS_KEY_RE,
+  BEARER_RE,
+  PEM_PRIVATE_KEY_RE,
+  TOKEN_PREFIX_RE,
+  ASSIGNMENT_RE,
+};

package/src/lib/ide-context.js

@@ -18,6 +18,11 @@
  */
 
 import { simpleDiff } from "./note-versioning.js";
+import {
+  filterIdeFileEntry,
+  redactSecretsInText,
+} from "./ide-context-redaction.js";
+import { normalizeIdePathForCli, detectWsl } from "./remote-path-mapping.js";
 
 /** Hard cap on the selected text we inline into the prompt. */
 const SELECTION_TEXT_CAP = 2000;
@@ -86,6 +91,99 @@ export function parseToolResultJson(result) {
   }
 }
 
+// ─── Redaction seams (see [[ide-context-redaction.js]]) ─────────────────────
+// IDE context bypasses the tool-permission layer entirely (nothing goes
+// through read_file), so credential files and secret-shaped text are filtered
+// HERE, at the collection boundary, before anything reaches the prompt.
+// CC_IDE_CONTEXT_REDACTION=0 disables (the filters below become pass-through).
+//
+// The same boundary also folds a remote file representation (a vscode-remote://
+// URI, a \\wsl.localhost\… UNC, or a Windows drive path while cc runs in WSL)
+// into the path THIS host can open (see [[remote-path-mapping.js]]) — otherwise
+// the agent, reading the inlined path, would target a file cc can't see. The
+// credential filter runs on the ORIGINAL value (basename is preserved by the
+// map, so the verdict is unchanged). CC_IDE_PATH_MAP=0 disables it.
+
+/** Env gate: CC_IDE_PATH_MAP=0|false|off disables remote path normalization. */
+export function idePathMapEnabled(env = process.env) {
+  const v = String(env?.CC_IDE_PATH_MAP ?? "").toLowerCase();
+  return !(v === "0" || v === "false" || v === "off");
+}
+
+/** Fold one IDE-reported file value into a path cc can open on this host. */
+function mapIdeFile(file, env) {
+  if (typeof file !== "string" || !idePathMapEnabled(env)) return file;
+  return normalizeIdePathForCli(file, {
+    platform: process.platform,
+    wsl: detectWsl(env || {}),
+  });
+}
+
+/** Drop the selection when it lives in a credential file; scrub its text. */
+function sanitizeIdeSelection(sel, env) {
+  if (!sel) return sel;
+  if (sel.file && filterIdeFileEntry(sel.file, { env }) === null) return null;
+  let out = sel;
+  const mappedFile = mapIdeFile(sel.file, env);
+  if (mappedFile !== sel.file) out = { ...out, file: mappedFile };
+  if (typeof out.text === "string" && out.text.length > 0) {
+    const scrubbed = redactSecretsInText(out.text, { env });
+    if (scrubbed !== out.text) out = { ...out, text: scrubbed };
+  }
+  return out;
+}
+
+/** Drop open-editor entries whose file is a credential file; map the rest. */
+function sanitizeIdeEditors(editors, env) {
+  if (!Array.isArray(editors)) return editors;
+  return editors
+    .filter(
+      (e) => !(e && e.file && filterIdeFileEntry(e.file, { env }) === null),
+    )
+    .map((e) => {
+      if (!e || typeof e.file !== "string") return e;
+      const mapped = mapIdeFile(e.file, env);
+      return mapped === e.file ? e : { ...e, file: mapped };
+    });
+}
+
+/** Scrub secret-shaped text out of terminal commands and their output. */
+function sanitizeIdeTerminals(terms, env) {
+  if (!Array.isArray(terms)) return terms;
+  return terms.map((t) => {
+    if (!t || typeof t !== "object") return t;
+    const out = { ...t };
+    if (typeof out.command === "string") {
+      out.command = redactSecretsInText(out.command, { env });
+    }
+    if (typeof out.output === "string") {
+      out.output = redactSecretsInText(out.output, { env });
+    }
+    return out;
+  });
+}
+
+/** Drop diagnostics for credential files; map their file + scrub message text. */
+function sanitizeIdeDiagnostics(diags, env) {
+  if (!Array.isArray(diags)) return diags;
+  return diags
+    .filter(
+      (d) => !(d && d.file && filterIdeFileEntry(d.file, { env }) === null),
+    )
+    .map((d) => {
+      if (!d) return d;
+      let out = d;
+      if (typeof d.file === "string") {
+        const mapped = mapIdeFile(d.file, env);
+        if (mapped !== d.file) out = { ...out, file: mapped };
+      }
+      if (typeof out.message === "string") {
+        out = { ...out, message: redactSecretsInText(out.message, { env }) };
+      }
+      return out;
+    });
+}
+
 /** Resolve to the promise's value, or null after `ms` / on rejection. */
 function withTimeout(promise, ms) {
   return new Promise((resolve) => {
@@ -137,18 +235,22 @@ export async function collectIdeContext(mcp, opts = {}) {
       ? call("mcp__ide__getTerminalOutput", { limit: TERMINAL_LIMIT })
       : Promise.resolve(null),
   ]);
-  const openEditors = Array.isArray(editors?.editors) ? editors.editors : null;
-  const terminals = Array.isArray(terminalData?.terminals)
+  const env = opts.env || process.env;
+  const sel = sanitizeIdeSelection(selection || null, env);
+  let openEditors = Array.isArray(editors?.editors) ? editors.editors : null;
+  if (openEditors) openEditors = sanitizeIdeEditors(openEditors, env);
+  let terminals = Array.isArray(terminalData?.terminals)
     ? terminalData.terminals
     : null;
+  if (terminals) terminals = sanitizeIdeTerminals(terminals, env);
   if (
-    !selection &&
+    !sel &&
     !(openEditors && openEditors.length > 0) &&
     !(terminals && terminals.length > 0)
   ) {
     return null;
   }
-  return { selection: selection || null, openEditors, terminals };
+  return { selection: sel, openEditors, terminals };
 }
 
 /**
@@ -304,8 +406,11 @@ export async function collectIdeDiagnostics(mcp, filePath, opts = {}) {
   );
   const all = Array.isArray(data?.diagnostics) ? data.diagnostics : null;
   if (!all) return null;
-  const relevant = all.filter(
-    (d) => d && DIAG_SEVERITIES.has(String(d.severity).toLowerCase()),
+  const relevant = sanitizeIdeDiagnostics(
+    all.filter(
+      (d) => d && DIAG_SEVERITIES.has(String(d.severity).toLowerCase()),
+    ),
+    env,
   );
   return relevant.length > 0 ? relevant : null;
 }
@@ -653,6 +758,7 @@ export async function expandIdeMentions(text, mcp, opts = {}) {
   const mentions = findIdeMentions(src);
   if (mentions.length === 0) return out;
   const timeoutMs = opts.timeoutMs || DEFAULT_TIMEOUT_MS;
+  const env = opts.env || process.env;
   const blocks = [];
   for (const kind of mentions) {
     try {
@@ -663,11 +769,9 @@ export async function expandIdeMentions(text, mcp, opts = {}) {
           );
           continue;
         }
-        const sel = await callIdeToolJson(
-          mcp,
-          "mcp__ide__getSelection",
-          {},
-          timeoutMs,
+        const sel = sanitizeIdeSelection(
+          await callIdeToolJson(mcp, "mcp__ide__getSelection", {}, timeoutMs),
+          env,
         );
         const b = formatSelectionMention(sel);
         if (b) {
@@ -689,7 +793,14 @@ export async function expandIdeMentions(text, mcp, opts = {}) {
           {},
           timeoutMs,
         );
-        const b = formatDiagnosticsMention(data);
+        const safe =
+          data && Array.isArray(data.diagnostics)
+            ? {
+                ...data,
+                diagnostics: sanitizeIdeDiagnostics(data.diagnostics, env),
+              }
+            : data;
+        const b = formatDiagnosticsMention(safe);
         if (b) {
           blocks.push(b);
           out.expanded.push("diagnostics");
@@ -709,7 +820,11 @@ export async function expandIdeMentions(text, mcp, opts = {}) {
           { limit: TERMINAL_MENTION_LIMIT },
           timeoutMs,
         );
-        const b = formatTerminalMention(data);
+        const safe =
+          data && Array.isArray(data.terminals)
+            ? { ...data, terminals: sanitizeIdeTerminals(data.terminals, env) }
+            : data;
+        const b = formatTerminalMention(safe);
         if (b) {
           blocks.push(b);
           out.expanded.push("terminal");

package/src/lib/jsonl-session-store.js

@@ -21,6 +21,8 @@ export {
   readEvents,
   rebuildMessages,
   listJsonlSessions,
+  renameSession,
+  pruneJsonlSessions,
   forkSession,
   sessionExists,
   getLastSessionId,

package/src/lib/llm-config-defaults.js

@@ -38,24 +38,40 @@ export async function reconcileConfigLlmProvider(cfgLlm = {}) {
   if (!cfgLlm || !cfgLlm.provider || !cfgLlm.baseUrl) {
     return { llm: cfgLlm, changed: false };
   }
-  const { inferProviderFromBaseUrl, modelForeignToProvider } = await import(
-    "./runnable-provider.js"
-  );
+  const { inferProviderFromBaseUrl, modelForeignToProvider } =
+    await import("./runnable-provider.js");
   const inferred = inferProviderFromBaseUrl(cfgLlm.baseUrl);
   if (!inferred || inferred === cfgLlm.provider) {
     return { llm: cfgLlm, changed: false };
   }
   const corrected = { ...cfgLlm, provider: inferred };
   if (modelForeignToProvider(inferred, cfgLlm.model)) {
-    const { selectModelForTask, TaskType } = await import(
-      "./task-model-selector.js"
-    );
+    const { selectModelForTask, TaskType } =
+      await import("./task-model-selector.js");
     const def = selectModelForTask(inferred, TaskType.CHAT);
     if (def) corrected.model = def;
   }
   return { llm: corrected, changed: true };
 }
 
+import { resolveApiKeyFromHelper } from "./api-key-helper.js";
+
+/**
+ * Key backfill order: config llm.apiKey (plaintext, legacy) first, then
+ * llm.apiKeyHelper (external command → OS credential store). The helper only
+ * runs when no key is otherwise present, so configured setups never pay a
+ * subprocess spawn.
+ */
+function backfillApiKey(options, cfgLlm) {
+  if (options.apiKey) return;
+  if (cfgLlm.apiKey) {
+    options.apiKey = cfgLlm.apiKey;
+  } else if (cfgLlm.apiKeyHelper) {
+    const key = resolveApiKeyFromHelper(cfgLlm.apiKeyHelper);
+    if (key) options.apiKey = key;
+  }
+}
+
 export function applyConfigLlmDefaults(options = {}, cfgLlm = {}, opts = {}) {
   // The IDE chat panel pins --provider/--model (read from config) but DROPS
   // --base-url/--api-key. With an explicit --provider the block below bails, so
@@ -71,7 +87,7 @@ export function applyConfigLlmDefaults(options = {}, cfgLlm = {}, opts = {}) {
     options.provider === cfgLlm.provider
   ) {
     if (!options.baseUrl && cfgLlm.baseUrl) options.baseUrl = cfgLlm.baseUrl;
-    if (!options.apiKey && cfgLlm.apiKey) options.apiKey = cfgLlm.apiKey;
+    backfillApiKey(options, cfgLlm);
     if (!options.model && !opts.explicitModel && cfgLlm.model) {
       options.model = cfgLlm.model;
     }
@@ -85,6 +101,6 @@ export function applyConfigLlmDefaults(options = {}, cfgLlm = {}, opts = {}) {
     options.model = cfgLlm.model;
   }
   if (!options.baseUrl && cfgLlm.baseUrl) options.baseUrl = cfgLlm.baseUrl;
-  if (!options.apiKey && cfgLlm.apiKey) options.apiKey = cfgLlm.apiKey;
+  backfillApiKey(options, cfgLlm);
   return options;
 }