chainlesschain 0.162.160 → 0.162.161

package/src/lib/goal-condition-engine.js

@@ -0,0 +1,369 @@
+/**
+ * Session-level completion-condition engine (P1 §"会话级完成条件引擎").
+ *
+ * Distinct from `cc goal` (long-term, cross-session OKR progress) and from
+ * `cc loop` (a timer that re-runs ONE command): this drives the agent's OUTER
+ * turns. After each outer turn an independent evaluator judges a completion
+ * CONDITION; if unmet, the runner starts the next outer turn — until the
+ * condition is met (`completed`) or a budget is exhausted (`exhausted`).
+ *
+ * The engine is a pure reducer over usage + per-turn evaluations, so it is
+ * deterministically testable without a model or the real agent loop. It:
+ *   - supports model-judged conditions AND deterministic checkers
+ *     (exit-zero / file-exists / contains / regex),
+ *   - enforces max_outer_turns and token / cost / time budgets,
+ *   - emits the SDK event taxonomy (goal_started / goal_evaluated /
+ *     goal_completed / goal_exhausted) with structured reason, evidence and
+ *     turn/token/cost/time, and
+ *   - snapshots/restores so a condition survives `--resume`.
+ *
+ * The clock is injected (`now`) and NEVER read implicitly, so snapshots replay
+ * identically and tests are deterministic.
+ */
+
+/** SDK event taxonomy for the completion-condition loop. */
+export const GOAL_EVENTS = Object.freeze({
+  STARTED: "goal_started",
+  EVALUATED: "goal_evaluated",
+  COMPLETED: "goal_completed",
+  EXHAUSTED: "goal_exhausted",
+});
+
+/** Terminal decisions the reducer can return alongside `continue`. */
+export const GOAL_DECISION = Object.freeze({
+  CONTINUE: "continue",
+  COMPLETE: "complete",
+  EXHAUSTED: "exhausted",
+});
+
+/** Default budget — a bounded outer-turn count; other axes unbounded (null). */
+export const DEFAULT_GOAL_BUDGET = Object.freeze({
+  maxOuterTurns: 10,
+  maxTokens: null,
+  maxCostUsd: null,
+  maxTimeMs: null,
+});
+
+// A hard ceiling so a misconfigured condition can never spin forever.
+const OUTER_TURN_HARD_CAP = 100;
+
+function positiveIntOrNull(value, cap) {
+  const n = Number(value);
+  if (!Number.isFinite(n) || n <= 0) return null;
+  const floored = Math.floor(n);
+  return cap ? Math.min(floored, cap) : floored;
+}
+
+function positiveNumOrNull(value) {
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? n : null;
+}
+
+/** Normalize a budget: sane defaults, positive values, hard outer-turn cap. */
+export function normalizeGoalBudget(input = {}) {
+  const maxOuterTurns =
+    positiveIntOrNull(input.maxOuterTurns, OUTER_TURN_HARD_CAP) ??
+    DEFAULT_GOAL_BUDGET.maxOuterTurns;
+  return {
+    maxOuterTurns,
+    maxTokens: positiveIntOrNull(input.maxTokens),
+    maxCostUsd: positiveNumOrNull(input.maxCostUsd),
+    maxTimeMs: positiveIntOrNull(input.maxTimeMs),
+  };
+}
+
+/**
+ * Parse a `--goal-condition` spec into a condition descriptor. A `kind:` prefix
+ * selects a deterministic checker; anything else (or an explicit `model:`) is
+ * model-judged natural language.
+ *
+ *   exit-zero:npm test        → run the command, met iff exit 0
+ *   file-exists:dist/app.js   → met iff the path exists
+ *   contains:ALL GREEN        → met iff the last output contains the text
+ *   regex:^BUILD OK$          → met iff the last output matches
+ *   model:the tests pass      → a model judges the transcript
+ *   the tests pass            → (bare) model-judged
+ */
+export function parseGoalCondition(spec) {
+  const raw = String(spec ?? "").trim();
+  if (!raw) throw new Error("goal condition is required");
+  const idx = raw.indexOf(":");
+  const prefix = idx === -1 ? "" : raw.slice(0, idx).trim().toLowerCase();
+  const rest = idx === -1 ? "" : raw.slice(idx + 1).trim();
+  switch (prefix) {
+    case "exit-zero":
+    case "exit0":
+      if (!rest) throw new Error("exit-zero condition needs a command");
+      return { kind: "exit-zero", command: rest, source: raw };
+    case "file-exists":
+    case "file":
+      if (!rest) throw new Error("file-exists condition needs a path");
+      return { kind: "file-exists", path: rest, source: raw };
+    case "contains":
+      if (!rest) throw new Error("contains condition needs text");
+      return { kind: "contains", text: rest, source: raw };
+    case "regex":
+      if (!rest) throw new Error("regex condition needs a pattern");
+      return { kind: "regex", pattern: rest, source: raw };
+    case "model":
+      if (!rest) throw new Error("model condition needs a description");
+      return { kind: "model", text: rest, source: raw };
+    default:
+      return { kind: "model", text: raw, source: raw };
+  }
+}
+
+/** True when a condition is a deterministic checker (not model-judged). */
+export function isDeterministicCondition(condition) {
+  return Boolean(condition) && condition.kind !== "model";
+}
+
+/**
+ * Evaluate a deterministic condition against gathered evidence — PURE.
+ * `evidence` supplies `output` (last turn text), `exitCode`, and a
+ * `fileExists(path) => boolean` predicate. Returns `{met, reason, evidence}`.
+ */
+export function checkDeterministicCondition(condition, evidence = {}) {
+  const output = String(evidence.output ?? "");
+  switch (condition?.kind) {
+    case "contains": {
+      const met = output.includes(condition.text);
+      return {
+        met,
+        reason: met
+          ? `output contains "${condition.text}"`
+          : `output does not contain "${condition.text}"`,
+        evidence: { kind: "contains", matched: met },
+      };
+    }
+    case "regex": {
+      let re;
+      try {
+        re = new RegExp(condition.pattern, condition.flags || "m");
+      } catch (err) {
+        return {
+          met: false,
+          reason: `invalid regex: ${err.message}`,
+          evidence: { kind: "regex", error: true },
+        };
+      }
+      const met = re.test(output);
+      return {
+        met,
+        reason: met
+          ? `output matches /${condition.pattern}/`
+          : `output does not match /${condition.pattern}/`,
+        evidence: { kind: "regex", matched: met },
+      };
+    }
+    case "exit-zero": {
+      const met = Number(evidence.exitCode) === 0;
+      return {
+        met,
+        reason: `\`${condition.command}\` exited ${evidence.exitCode}`,
+        evidence: { kind: "exit-zero", exitCode: evidence.exitCode ?? null },
+      };
+    }
+    case "file-exists": {
+      const fx = typeof evidence.fileExists === "function";
+      const met = fx ? evidence.fileExists(condition.path) === true : false;
+      return {
+        met,
+        reason: met
+          ? `${condition.path} exists`
+          : `${condition.path} does not exist`,
+        evidence: { kind: "file-exists", path: condition.path, met },
+      };
+    }
+    default:
+      return {
+        met: false,
+        reason: `not a deterministic condition (${condition?.kind})`,
+        evidence: { kind: condition?.kind ?? "unknown" },
+      };
+  }
+}
+
+/**
+ * Gather evidence and run a deterministic check. Deps (`spawnSync`,
+ * `existsSync`) are injected for tests; `lastOutput` feeds contains/regex.
+ */
+export function runDeterministicCheck(condition, deps = {}) {
+  const evidence = { output: deps.lastOutput ?? "" };
+  if (condition.kind === "exit-zero") {
+    const spawnSync = deps.spawnSync;
+    if (typeof spawnSync !== "function") {
+      return {
+        met: false,
+        reason: "no spawnSync available for exit-zero",
+        evidence: { kind: "exit-zero", error: true },
+      };
+    }
+    const res = spawnSync(condition.command, {
+      cwd: deps.cwd,
+      shell: true,
+      encoding: "utf8",
+      windowsHide: true,
+    });
+    evidence.exitCode = res?.status ?? (res?.error ? 1 : null);
+  } else if (condition.kind === "file-exists") {
+    const existsSync = deps.existsSync;
+    evidence.fileExists = (p) =>
+      typeof existsSync === "function" ? existsSync(p) === true : false;
+  }
+  return checkDeterministicCondition(condition, evidence);
+}
+
+function usageSnapshot(state, nowMs) {
+  return {
+    outerTurns: state.outerTurns,
+    tokens: state.tokens,
+    costUsd: state.costUsd,
+    elapsedMs: Math.max(0, nowMs - state.startedAtMs),
+  };
+}
+
+function whichLimitHit(state, budget, nowMs) {
+  if (budget.maxOuterTurns != null && state.outerTurns >= budget.maxOuterTurns)
+    return "max_outer_turns";
+  if (budget.maxTokens != null && state.tokens >= budget.maxTokens)
+    return "max_tokens";
+  if (budget.maxCostUsd != null && state.costUsd >= budget.maxCostUsd)
+    return "max_cost";
+  if (
+    budget.maxTimeMs != null &&
+    Math.max(0, nowMs - state.startedAtMs) >= budget.maxTimeMs
+  )
+    return "max_time";
+  return null;
+}
+
+/**
+ * The pure decision step. Given the accumulated `state`, this turn's
+ * `evaluation` ({met, reason, evidence}), the `budget`, and the current time,
+ * decide `complete | continue | exhausted` and produce events. Always emits a
+ * `goal_evaluated`; adds a terminal `goal_completed` / `goal_exhausted` when
+ * the loop stops. Does NOT mutate `state` — returns the next one.
+ */
+export function evaluateGoalStep(state, evaluation, budget, opts = {}) {
+  const nowMs = Number(opts.now ?? state.startedAtMs);
+  const next = {
+    ...state,
+    outerTurns: state.outerTurns + 1,
+  };
+  const usage = usageSnapshot(next, nowMs);
+  const met = evaluation?.met === true;
+  const evaluated = {
+    type: GOAL_EVENTS.EVALUATED,
+    met,
+    reason: evaluation?.reason ?? null,
+    evidence: evaluation?.evidence ?? null,
+    ...usage,
+  };
+  if (met) {
+    return {
+      state: { ...next, done: true, outcome: "completed" },
+      decision: GOAL_DECISION.COMPLETE,
+      events: [
+        evaluated,
+        {
+          type: GOAL_EVENTS.COMPLETED,
+          reason: evaluation?.reason ?? "condition met",
+          evidence: evaluation?.evidence ?? null,
+          ...usage,
+        },
+      ],
+    };
+  }
+  const limit = whichLimitHit(next, budget, nowMs);
+  if (limit) {
+    return {
+      state: { ...next, done: true, outcome: "exhausted", limit },
+      decision: GOAL_DECISION.EXHAUSTED,
+      events: [
+        evaluated,
+        {
+          type: GOAL_EVENTS.EXHAUSTED,
+          limit,
+          reason: `budget exhausted (${limit})`,
+          ...usage,
+        },
+      ],
+    };
+  }
+  return { state: next, decision: GOAL_DECISION.CONTINUE, events: [evaluated] };
+}
+
+/**
+ * Stateful wrapper over the reducer for the runner. Inject `now` (a `() => ms`
+ * clock) so behavior is deterministic and snapshot-replayable.
+ */
+export class GoalConditionEngine {
+  constructor({ condition, budget, now } = {}) {
+    this.condition =
+      typeof condition === "string" ? parseGoalCondition(condition) : condition;
+    this.budget = normalizeGoalBudget(budget);
+    this._now = typeof now === "function" ? now : () => 0;
+    this.state = {
+      outerTurns: 0,
+      tokens: 0,
+      costUsd: 0,
+      startedAtMs: this._now(),
+      done: false,
+      outcome: null,
+    };
+  }
+
+  /** Emit the opening event; call once before the first outer turn. */
+  start() {
+    return {
+      type: GOAL_EVENTS.STARTED,
+      condition: this.condition,
+      budget: this.budget,
+      startedAtMs: this.state.startedAtMs,
+    };
+  }
+
+  /** Accumulate a turn's usage before evaluating it. */
+  recordTurnUsage({ tokens = 0, costUsd = 0 } = {}) {
+    this.state = {
+      ...this.state,
+      tokens: this.state.tokens + (Number(tokens) || 0),
+      costUsd: this.state.costUsd + (Number(costUsd) || 0),
+    };
+    return this.state;
+  }
+
+  /** Evaluate this outer turn; returns `{decision, events}`. */
+  evaluate(evaluation) {
+    const result = evaluateGoalStep(this.state, evaluation, this.budget, {
+      now: this._now(),
+    });
+    this.state = result.state;
+    return { decision: result.decision, events: result.events };
+  }
+
+  get done() {
+    return this.state.done === true;
+  }
+
+  /** Serialize for `--resume`. startedAtMs is preserved so time keeps counting. */
+  snapshot() {
+    return {
+      condition: this.condition,
+      budget: this.budget,
+      state: { ...this.state },
+    };
+  }
+
+  /** Restore a prior run (same clock injection contract). */
+  static fromSnapshot(snap, { now } = {}) {
+    const engine = new GoalConditionEngine({
+      condition: snap.condition,
+      budget: snap.budget,
+      now,
+    });
+    engine.state = { ...snap.state };
+    return engine;
+  }
+}

package/src/lib/headless-manifest.js

@@ -16,6 +16,7 @@
 
 import crypto from "node:crypto";
 import { createRequire } from "node:module";
+import { PROTOCOL_MIN_VERSION } from "./capability-negotiation.js";
 
 export const STREAM_PROTOCOL_VERSION = 1;
 
@@ -137,6 +138,10 @@ export function buildAgentCapabilities() {
     name: "chainlesschain-cli",
     version,
     protocol_version: STREAM_PROTOCOL_VERSION,
+    // Oldest wire version this CLI can still negotiate down to (the N-1 in the
+    // capability handshake, agent-sdk docs/PROTOCOL.md §1.3). At v1 there is no
+    // older line shape, so min === current.
+    min_protocol_version: PROTOCOL_MIN_VERSION,
     agent_tools: contract.listCodingAgentToolNames(),
     permission_modes: [
       "default",
@@ -162,6 +167,14 @@ export function buildAgentCapabilities() {
       interactive_approvals: true,
       permission_prompt_tool: true,
       remote_control: true,
+      // Additive protocol-v1 stream fields (agent-sdk docs/PROTOCOL.md §1.2.1):
+      // every stream-json stdout line carries a monotonic `seq` and a
+      // run-scoped `trace_id`, and tool_use/tool_result lines carry a pairing
+      // `id` ("tu-<n>"). `trace_id` is caller-injectable (--trace-id /
+      // CC_TRACE_ID) for end-to-end IDE ↔ CLI correlation.
+      tool_use_id: true,
+      event_seq: true,
+      trace_id: true,
       mcp: {
         config_file: true,
         registry: true,

package/src/lib/ide-context.js

@@ -22,6 +22,7 @@ import {
   filterIdeFileEntry,
   redactSecretsInText,
 } from "./ide-context-redaction.js";
+import { normalizeIdePathForCli, detectWsl } from "./remote-path-mapping.js";
 
 /** Hard cap on the selected text we inline into the prompt. */
 const SELECTION_TEXT_CAP = 2000;
@@ -95,24 +96,55 @@ export function parseToolResultJson(result) {
 // through read_file), so credential files and secret-shaped text are filtered
 // HERE, at the collection boundary, before anything reaches the prompt.
 // CC_IDE_CONTEXT_REDACTION=0 disables (the filters below become pass-through).
+//
+// The same boundary also folds a remote file representation (a vscode-remote://
+// URI, a \\wsl.localhost\… UNC, or a Windows drive path while cc runs in WSL)
+// into the path THIS host can open (see [[remote-path-mapping.js]]) — otherwise
+// the agent, reading the inlined path, would target a file cc can't see. The
+// credential filter runs on the ORIGINAL value (basename is preserved by the
+// map, so the verdict is unchanged). CC_IDE_PATH_MAP=0 disables it.
+
+/** Env gate: CC_IDE_PATH_MAP=0|false|off disables remote path normalization. */
+export function idePathMapEnabled(env = process.env) {
+  const v = String(env?.CC_IDE_PATH_MAP ?? "").toLowerCase();
+  return !(v === "0" || v === "false" || v === "off");
+}
+
+/** Fold one IDE-reported file value into a path cc can open on this host. */
+function mapIdeFile(file, env) {
+  if (typeof file !== "string" || !idePathMapEnabled(env)) return file;
+  return normalizeIdePathForCli(file, {
+    platform: process.platform,
+    wsl: detectWsl(env || {}),
+  });
+}
 
 /** Drop the selection when it lives in a credential file; scrub its text. */
 function sanitizeIdeSelection(sel, env) {
   if (!sel) return sel;
   if (sel.file && filterIdeFileEntry(sel.file, { env }) === null) return null;
-  if (typeof sel.text === "string" && sel.text.length > 0) {
-    const scrubbed = redactSecretsInText(sel.text, { env });
-    if (scrubbed !== sel.text) return { ...sel, text: scrubbed };
+  let out = sel;
+  const mappedFile = mapIdeFile(sel.file, env);
+  if (mappedFile !== sel.file) out = { ...out, file: mappedFile };
+  if (typeof out.text === "string" && out.text.length > 0) {
+    const scrubbed = redactSecretsInText(out.text, { env });
+    if (scrubbed !== out.text) out = { ...out, text: scrubbed };
   }
-  return sel;
+  return out;
 }
 
-/** Drop open-editor entries whose file is a credential file. */
+/** Drop open-editor entries whose file is a credential file; map the rest. */
 function sanitizeIdeEditors(editors, env) {
   if (!Array.isArray(editors)) return editors;
-  return editors.filter(
-    (e) => !(e && e.file && filterIdeFileEntry(e.file, { env }) === null),
-  );
+  return editors
+    .filter(
+      (e) => !(e && e.file && filterIdeFileEntry(e.file, { env }) === null),
+    )
+    .map((e) => {
+      if (!e || typeof e.file !== "string") return e;
+      const mapped = mapIdeFile(e.file, env);
+      return mapped === e.file ? e : { ...e, file: mapped };
+    });
 }
 
 /** Scrub secret-shaped text out of terminal commands and their output. */
@@ -131,18 +163,25 @@ function sanitizeIdeTerminals(terms, env) {
   });
 }
 
-/** Drop diagnostics for credential files; scrub their message text. */
+/** Drop diagnostics for credential files; map their file + scrub message text. */
 function sanitizeIdeDiagnostics(diags, env) {
   if (!Array.isArray(diags)) return diags;
   return diags
     .filter(
       (d) => !(d && d.file && filterIdeFileEntry(d.file, { env }) === null),
     )
-    .map((d) =>
-      d && typeof d.message === "string"
-        ? { ...d, message: redactSecretsInText(d.message, { env }) }
-        : d,
-    );
+    .map((d) => {
+      if (!d) return d;
+      let out = d;
+      if (typeof d.file === "string") {
+        const mapped = mapIdeFile(d.file, env);
+        if (mapped !== d.file) out = { ...out, file: mapped };
+      }
+      if (typeof out.message === "string") {
+        out = { ...out, message: redactSecretsInText(out.message, { env }) };
+      }
+      return out;
+    });
 }
 
 /** Resolve to the promise's value, or null after `ms` / on rejection. */

package/src/lib/project-instructions.js

@@ -44,6 +44,83 @@ export const PROJECT_FILE_NAMES = ["cc.md", "CLAUDE.md", "AGENTS.md"];
 /** Local (gitignored) companion names, first match wins. */
 export const LOCAL_FILE_NAMES = ["cc.local.md", "CLAUDE.local.md"];
 
+/**
+ * `instructionExcludes` — a large-monorepo reduction lever (P1). Subtrees whose
+ * instruction / rule / @import files should NEVER load (legacy, vendored,
+ * generated). Opt-in: empty by default so behavior is byte-identical unless the
+ * caller (config `instructionExcludes`) sets it. Patterns are matched against a
+ * path RELATIVE to the project root, with forward slashes:
+ *   - a bare name (`node_modules`, `dist`) matches that segment ANYWHERE;
+ *   - a slashed prefix (`packages/legacy`) matches that dir and everything under;
+ *   - a glob (`**​/generated/**`, `vendor/*`) matches via `*`/`**`/`?`.
+ */
+export function normalizeInstructionExcludes(list) {
+  if (!Array.isArray(list)) return [];
+  return [
+    ...new Set(
+      list
+        .map((s) =>
+          String(s || "")
+            .trim()
+            .replace(/\\/g, "/")
+            .replace(/\/+$/, ""),
+        )
+        .filter(Boolean),
+    ),
+  ];
+}
+
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        re += ".*";
+        i++;
+        if (glob[i + 1] === "/") i++; // `**/` also swallows the slash
+      } else {
+        re += "[^/]*";
+      }
+    } else if (c === "?") {
+      re += "[^/]";
+    } else {
+      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp("^" + re + "$");
+}
+
+/**
+ * True when a repo-relative path falls under an excluded subtree. A file is
+ * excluded when it, or any of its ancestor directories, matches a pattern.
+ */
+export function pathIsExcluded(relPath, excludes) {
+  if (!excludes || excludes.length === 0) return false;
+  const rel = String(relPath || "")
+    .replace(/\\/g, "/")
+    .replace(/^\.\/?/, "")
+    .replace(/\/+$/, "");
+  if (!rel) return false;
+  const segs = rel.split("/");
+  for (const pat of excludes) {
+    if (/[*?[\]]/.test(pat)) {
+      const re = globToRegExp(pat);
+      if (re.test(rel)) return true;
+      let acc = "";
+      for (const s of segs) {
+        acc = acc ? `${acc}/${s}` : s;
+        if (re.test(acc)) return true;
+      }
+    } else {
+      if (rel === pat || rel.startsWith(`${pat}/`)) return true;
+      // a bare (slash-free) name matches that path segment anywhere
+      if (!pat.includes("/") && segs.includes(pat)) return true;
+    }
+  }
+  return false;
+}
+
 // Same boundary rule as file-ref-expander: `@` at start / after whitespace or
 // an opening bracket-quote, so emails and decorative @ never match.
 const IMPORT_TOKEN_RE = /(^|[\s("'`[{])@([^\s"'`)\]}]+)/g;
@@ -100,13 +177,21 @@ export function findInstructionFiles(opts = {}) {
   const { fs, path, os } = resolveDeps(opts);
   const cwd = path.resolve(opts.cwd || process.cwd());
   const home = opts.home || os.homedir() || "";
+  const excludes = normalizeInstructionExcludes(opts.instructionExcludes);
 
   const seen = new Set();
   const out = [];
+  const root = findProjectRoot(cwd, opts) || cwd;
+  // A discovered file under an excluded subtree (relative to the project root)
+  // never loads. The user-scope file lives outside the repo, so it is exempt.
+  const excluded = (abs) =>
+    excludes.length > 0 &&
+    pathIsExcluded(path.relative(root, path.resolve(abs)), excludes);
   const push = (p, scope) => {
     if (!p) return;
     const abs = path.resolve(p);
     if (seen.has(abs) || !isFile(fs, abs)) return;
+    if (scope !== "user" && excluded(abs)) return;
     seen.add(abs);
     out.push({ path: abs, scope });
   };
@@ -121,7 +206,6 @@ export function findInstructionFiles(opts = {}) {
     );
   }
 
-  const root = findProjectRoot(cwd, opts) || cwd;
   const chain = [];
   let dir = cwd;
   for (;;) {
@@ -274,6 +358,10 @@ export function loadProjectInstructions(opts = {}) {
     : DEFAULT_MAX_TOTAL_BYTES;
 
   const roots = findInstructionFiles(opts);
+  const excludes = normalizeInstructionExcludes(opts.instructionExcludes);
+  const projectRoot =
+    findProjectRoot(path.resolve(opts.cwd || process.cwd()), opts) ||
+    path.resolve(opts.cwd || process.cwd());
   const visited = new Set(roots.map((r) => r.path));
   const out = [];
   const warnings = [];
@@ -322,6 +410,15 @@ export function loadProjectInstructions(opts = {}) {
       const resolved = path.resolve(baseDir, target);
       if (visited.has(resolved) || !isFile(fs, resolved)) continue; // silent:
       // non-files are decorative @tokens (npm scopes, emails), not imports.
+      // An @import that resolves under an excluded subtree does not load — the
+      // reduction lever must not be bypassed by an import pointing into it.
+      if (
+        excludes.length > 0 &&
+        pathIsExcluded(path.relative(projectRoot, resolved), excludes)
+      ) {
+        visited.add(resolved);
+        continue;
+      }
       // Refuse to import a credential / secret file. `cc agent` auto-loads
       // project memory, so a cloned/untrusted repo's cc.md must NOT be able to
       // pull `@~/.ssh/id_rsa` / `@../.env` into the LLM-bound system prompt