chainlesschain 0.162.162 → 0.162.164

package/src/data/changelog.json

@@ -3,7 +3,7 @@
   "releases": [
     {
       "productVersion": "Unreleased",
-      "cliVersion": "0.162.162",
+      "cliVersion": "0.162.164",
       "cliVersions": [
         "0.4.46",
         "0.4.51",
@@ -20,18 +20,24 @@
         "0.162.159",
         "0.162.160",
         "0.162.161",
-        "0.162.162"
+        "0.162.162",
+        "0.162.163",
+        "0.162.164"
       ],
       "date": null,
       "title": "",
       "sections": [
+        {
+          "heading": "Added — cc CLI 0.162.164：IDE 增量 gap-analysis (2026-07-13) 全批接线落地——凭据脱敏三导出面 / /rewind 从这里分支 / cc doctor 执行位置 / cc session pr-status / 复杂 Diff 行评论锚定 / 终端上下文策略 / worktree 清理安全闸 / 崩溃恢复台账 / 无人值守动作门 / 跨设备操作指纹（CLI-only npm 发版）",
+          "body": "> `chainlesschain` 0.162.163 → **0.162.164** 发 npm `latest`（经 `npm-publish.yml`，`--provenance --access public`）。纯 `packages/cli/src` 增量；未触 `pdh/lib` → 无 Android cc bundle rollover / 无 USR_VERSION 改动。命令面只加 **session 子命令 `cc session pr-status`** 与 REPL `/rewind <n> --branch`、`cc doctor` 新增「Execution context」诊断段 + 工具 flag，**顶层命令数 175 不变**。本版把 `docs/CLAUDE_CODE_IDE_INCREMENTAL_GAP_ANALYSIS_2026-07-13.md` 的可 Windows 落地项整批接线（纯核已建、本版补真实运行时/命令面接线，默认路径保持字节不变）。\n\n- **8.1 凭据脱敏三导出面全闸**：一份导出物离机必须朝「不泄漏」失败——`cc session export` 导出前对渲染 transcript 跑召回优先 secret-scan（命中替 `[REDACTED]`，脱敏计数写 stderr，`--no-redact` 保原值）；OTLP `toOtlp()` 对 span/event 字符串属性（含 exception message）默认脱敏（`cc agent/team --otlp`、`cc eval`）；诊断包 `cc doctor --export-bundle` 强制脱敏（P1-9）。三面共用同一 recall-first 扫描器。\n- **P0-2 崩溃恢复副作用台账**：两阶段记账 `prepare→start→commit|fail|unknown` 接进 headless 与 IDE/Bridge/Extension-Host resume——`--resume` reconcile 台账，started-未落定-非幂等 op 注入去标识「Recovery notice」而非盲目重跑；Diff-Apply 内容哈希幂等（old 已改+new 已在→幂等 no-op 不重写）；外部操作 Idempotency Key + 0-重复副作用度量。\n- **P0-3「从这里分支」进 `/rewind`**：`/rewind <n> --branch [--write]`（`--fork` 别名）从选中 turn 派生独立会话，保留分支点之前历史并从此分叉，**父会话绝不被截断**；确定性分支 id + `session_branch` 血统事件 + 幂等重放 + traversal fail-closed。\n- **P1-1 复杂 Diff 行评论锚定**：review finding 锚到它所指的**代码**（file+baseHash+锚定行原文+上下文）而非裸坐标；agent 改文件后可 `reanchorComment` 重定位/标 outdated，绝不复用旧行号（接进 `review-pipeline` finding 输出 + `cc review` 尽力填 fileContents）。\n- **P1-2 终端上下文策略 + 后台任务脱敏**：`selectTerminalContextForModel` fail-closed（非显式 opt-in 绝不把终端 scrollback 塞进模型上下文）+ ANSI-strip→secret-redact→scrollback-cap；`check_shell {list}` / `/tasks` 后台任务快照对命令串脱敏并暴露 PID（stoppable 仅在握真 PID 时）。\n- **P1-4 PR/CI 监控 + 受控合并**：新子命令 `cc session pr-status [id] [--pr N] [--checks-file <json>] [--enable] [--json]`——从 PR-link ledger 取会话关联 PR，`gh pr view` 或 `--checks-file` 采信号，渲染状态条 + **默认关**的 auto-merge 合格性判定（穷举列未满足项：分支保护/Review/待审批/失败或 pending check/缺席必需 check）。\n- **P1-5 worktree 清理安全闸**：后台 agent worktree reaper 清理前过 fail-closed 安全闸——未提交/未追踪/未 push/关联 PR 任一命中即**保留**（旧「全清」逃生门 `force:true` 保留）；`git` 读不出→保留（绝不销毁无法核实的工作）。\n- **P1-6 会话级 agent 工具准入 + 归因**：extension 层工具（run_skill/spawn_sub_agent/browser/schedule/publish_artifact/MCP）需 Capability+Policy+权限+预算+UI 五闸全过；每次调用记只带来源的安全归因（可落 transcript）。\n- **P1-7 执行位置一等属性**：`cc doctor` 新增「Execution context」诊断段——检测 ambient location（Codespaces/SSH/Container/WSL/Local），remote/unknown fail-closed 到只读地板并列 policy 违规；凭据只显示来源/作用域不显示值。\n- **P1-8 无人值守动作门**：`cc agenda` 定时/事件任务默认拦截 notify/publish_artifact 等高危外呼（`unattendedAllowlist` 显式放回）；action-class 分级 fail-closed。\n- **P1-9 脱敏诊断包**：`cc doctor --export-bundle` 一键导出去标识诊断包（版本/平台/Capability/连接/脱敏事件/进程·端口·锁文件·worktree 摘要；默认不含源码/Key/Cookie/完整环境变量；导出前强制 secret-scan）。\n- **8.2 跨设备操作指纹**：远程审批 `remote-approval-bridge` 升级到全元组 `OperationApprovalRegistry`（工具名/规范化参数/目标环境/workspace/session/策略版本/有效期）；`permission.request` 发完整指纹 + 短标识 + 无秘密摘要，`approval.resolve` 失败关闭（mismatch/superseded/duplicate/过窗）。\n- **Monorepo / P2 硬化**：worktree `sparsePaths` 稀疏检出 + `symlinkDirectories` 逃逸守卫接进 team runner；`cc doctor` 新增沙箱真能力/静默降级、重复 skill 影子、settings.json hook 配置静态校验、async-hook 可靠性健康检查；LSP 服务器可选指数退避重启；每 span 归一 OTel session/agent id + `permission.decision_id`。\n\n> `chainlesschain` 0.162.162 → **0.162.163** 发 npm `latest`（经 `npm-publish.yml`，`--provenance --access public`）。纯 `packages/cli/src` 增量；未触 `pdh/lib` → 无 Android cc bundle rollover / 无 USR_VERSION 改动。命令面只加子命令（`cc agenda prune`、`cc plugin consent`、`cc hook replay`/`events-log`、`cc context --sources`）与 REPL slash（`/goal`）+ 工具参数/flag，**顶层命令数 175 不变**。本版把 0.162.162 announce 的多数纯核落成真实**运行时接线**，并补齐 `docs/CLAUDE_CODE_CLI_INCREMENTAL_GAP_ANALYSIS_2026-07-12.md` 各节的 last-mile「仍欠」。全套本地三层全绿（unit+integration 25,008 + e2e 628，0 真失败）。\n\n- **Subagent 契约全轴强制（P1）**：`_executeSpawnSubAgent` 真正消费 `resolveSubagentContract`（spawnArgs > agent-file > 父级天花板），tighten-only 强制 skills/mcp/hooks/memory capability INTERSECT、permissionMode（plan→只读工具集）、budget/effort/context、worktree fail-closed、递归深度/宽度上限；非 plan confirmer 线程化 + headless 与交互 REPL 均以运行模式播种子级天花板；子级专属无 confirmer ApprovalGate 强制 run_shell/run_code/browser_act 会话策略。\n- **跨 Agent 授权边界接线（P0）**：本地 headless 审批链路携带并校验 `tool_call_id + normalized_arguments + policy_digest` 绑定（重放/参数替换/错投的批准判 `binding-mismatch` 拒绝）；入站 channel 事件显式打 steer authority（其载荷里的 \"approved\" 只是文本，不能代表用户批准）。\n- **会话完成条件引擎接线（P1）**：`--goal-condition <spec>`（exit-zero/file-exists/contains/regex/model）驱动 headless 外层回合，跨进程 `--resume` 续跑（持久 `goal_snapshot`），REPL `/goal <condition>` 交互入口；`goal_started/evaluated/completed/exhausted` 事件。\n- **Turn↔Checkpoint 绑定持久化 + coverage-aware /rewind（P1）**：绑定作为链式会话事件持久化；`/rewind` 打印诚实的 coverage/警告（副作用 / 缺 checkpoint / 对话-文件漂移），永不过度承诺可恢复范围。\n- **副作用台账崩溃恢复（P0 纯核）**：`side-effect-ledger.js` 两阶段记账 `prepare→start→commit|fail|unknown` + `reconcileSideEffects` 分桶 redo/inspect/skip（file-write/git-push/package-install 中途强杀不重复副作用）。\n- **持久 Scheduler/Monitor 扩展（P1）**：`cc agenda prune`（回收终态条目）+ 过期退休（`expiresAt`/`retireExpired`）+ Monitor 文件/HTTP/mtime-change 源（替每 tick spawn shell）+ agent `schedule` 工具透传 `expires`/`jitter` + 每任务 permission-mode/worktree/turn 预算。\n- **Plugin 能力 consent 生命周期（P1）**：consent 存储 + load-path chokepoint enforcement（opt-in）+ `cc plugin consent` + `add`/`upgrade` 渲染能力清单+diff+re-consent 提示 + doctor 未同意/坏 manifest 告警。\n- **Monorepo 上下文（P1）**：`instructionExcludes` 从分层 settings 接进 `composeSystemPrompt`（排除 legacy/vendor/generated 子树，含 @import）+ `cc context --sources`（逐来源 token 归因）+ 懒加载子树指令纯核。\n- **Hooks 持久事件日志 + Replay（P2）**：哈希链 JSONL 事件日志（opt-in `CC_HOOK_EVENT_LOG`）+ `cc hook replay`（决策类事件必显式 `--sandbox`，绝不 re-gate 真流程）/`cc hook events-log`（列出/校验链）。\n- **JSON Schema（P2）**：`--json-schema` 接受 inline JSON + 与 `stream-json` 兼容（终局 `structured_result` NDJSON 行）+ format/if-then-else 断言 + 约束式重试改用富校验器（带 RFC 6901 JSON Pointer 提示）。\n- **多 Agent Review（P2）**：`cc review --multi`（correctness/security/performance/tests 分维 finder 扇出）+ `--verify`（skeptic 复现剔除 refuted）+ high effort 自动双开。\n- **OTel（P2）**：`--otlp-content` opt-in 输出 prompt/response/tool_arguments（默认脱敏 `[redacted]`）+ 每 span 归一化 session/agent id。"
+        },
         {
           "heading": "Added — cc CLI 0.162.162：增量 gap-analysis 收尾（P1 Subagent 契约/Turn-Checkpoint 绑定/Plugin 能力 Schema + P2 Hooks 事件总线/JSON Schema/多 Agent Review + LSP 诊断/Doctor+文档+OTel）+ IDE gap P0（远程审批指纹/会话生命周期）（CLI-only npm 发版）",
           "body": "> `chainlesschain` 0.162.161 → **0.162.162** 发 npm `latest`（经 `npm-publish.yml`，`--provenance --access public`）。纯 `packages/cli/src` + 一个构建脚本；未触 `pdh/lib` → 无 Android cc bundle rollover / 无 USR_VERSION 改动。命令面无新顶层命令（全部为纯核 lib 模块 + 最小接线 + 一个 `scripts/gen-cli-reference.mjs` 生成器），**顶层命令数 175 不变**。至此 `docs/CLAUDE_CODE_CLI_INCREMENTAL_GAP_ANALYSIS_2026-07-12.md`（vs Claude Code v2.1.207）的 P0/P1/P2 全部章节均有「已落地（增量）」记录；每节仍列「仍欠」（多为环境/平台阻塞或运行时深接线）。\n>\n> 全部为纯核 + 时钟注入（无 timer/RNG，确定性可测）+ 最小真实接线的低风险增量；新增测试文件本地全绿。\n\n- **Subagent 契约（P1）**：`subagent-contract.js`——tighten-only 继承/覆盖：权限模式加宽被钳回父级上限，capabilities 与父级天花板取交集，memory 父级拒则永不授予，预算封顶父级余量，maxDepth/maxChildren 只能调低不能调高；`resolveSubagentContract` + `enforceRecursionLimits` + `resolveIsolationFailClosed`。接线到 `.claude/agents/*.md` 解析（`parseAgentFile` 增 `contract` 字段）。\n- **Turn↔Checkpoint 绑定（P1）**：`turn-binding.js`——显式 turn→checkpoint 表：`computeCoverage` 对有副作用无 checkpoint 的 turn 标 PARTIAL、无变更标 FULL、有变更且有 checkpoint 标 FULL、有变更无 checkpoint 标 NONE；`resolveRestorePlan` 永不过度承诺可恢复范围（conversation/files/both scope）；`TurnBindingLog` + `selectTurnRange` + `buildTurnBindingFromMarks`。\n- **Plugin 能力声明 + 配置 Schema（P1）**：`plugin-runtime/capabilities.js`——能力默认 DENY（process/network{any,domains}/filesystem/mcp/monitor/credential），`diffCapabilities`+`consentRequiredForUpgrade`（加宽即需重新同意），`auditDeclaredCapabilities`；`normalizeOptionsSchema`/`validateOptions`/`redactSensitiveOptions`（敏感选项只从用户级取、拒绝来自 project 配置）。接线到 `manifest.js`（`parsePluginManifest` 增 capabilities/capabilitiesDeclared/optionsSchema）。\n- **Hooks 统一事件总线 + Replay（P2）**：`hook-event-bus.cjs`——`HOOK_EVENT_TYPES`（现有 settings 事件 ∪ 新 PermissionDenied/TaskCreated/TaskCompleted/InstructionsLoaded/CwdChanged/WorktreeCreate/WorktreeRemove/MCPElicitation），`buildHookEnvelope`（`event_id`=`evt_`+sha256，带 trace_id/parent_id 的版本化信封），`mergeHookDecisions`（block>ask>allow>continue 最严胜出），`planHookReplay`（决策类事件 replay 必须显式 sandbox:true）。接线到 `settings-hook-events.cjs`（`withDeliveryId` 打 event_id）。\n- **JSON Schema 结构化输出（P2）**：`json-schema-validate.js`——Draft 2020-12 子集校验器：`jsonPointer`/`canonical`/`computeSchemaDigest`(\"sha256:…\")/`validate`→`{valid,errors:[{code,keyword,instancePath,schemaPath,message}]}`/`validateSchema`(meta 校验)/`buildStructuredResultEvent`(`{type:\"structured_result\",schema_digest,valid,value,errors?}`)；支持 type/enum/const/properties/required/additionalProperties/items/prefixItems/数值与串与数组约束/allOf-anyOf-oneOf-not/本地 $ref（128 层守卫）。接线到 `json-schema-output.js`（加载即 meta 校验 + 导出 buildStructuredResult/computeSchemaDigest）。\n- **多 Agent Code Review + LSP 自动诊断（P2）**：`review-pipeline.js`——finders→verifier→deduper→结构化输出的纯聚合核：`dedupeFindings`（合并同 path:line:title、保留最高 severity、跨维度并 categories/dimensions；形状保持）、`applyVerdicts`（verifier 复现——拒者剔除、复现者提权）、`filterByConfidence`/`rankFindings`/`buildReviewReport`（path/line/category/severity/failure_scenario/evidence + rollup）；接线到 `review.js parseFindings`（过 dedupe，形状保持）。`lsp/diagnostics-scheduler.js`——编辑触发的自动诊断：`DiagnosticsScheduler`（debounce 合并编辑爆发、throttle 每文件最小间隔、msUntilNextDue）+ `capDiagnostics`（token 上限、按 severity 先丢最不严重、恒留≥1）。\n- **Doctor Runtime Checkup + CLI 文档漂移 + 统一 OTel id（P2）**：`telemetry-ids.js`——`buildTelemetryAttributes` 把杂乱别名归一到九个稳定 id key（session/turn/prompt/tool_use/agent/parent_agent/workflow.run_id/permission.decision_id/checkpoint.id），`content.*` 默认脱敏为 `[redacted]`（仅显式 opt-in 才输出且长度封顶），只发 allow-list key（外来高基数 label 丢弃）、id 值字符集净化+≤128 截断；接线到 `agent-core.js`（每 span 现带归一化的 workflow.run_id+session.id）。`runtime-checkup.js`——纯 Doctor 评估器（agenda 逾期/孤儿进程/慢·熔断 Hook/失效 Plugin·LSP/陈旧 session·worktree/冗长指令文件）；接线到 `doctor-checkup.js` 新 `runtimeSection`（只消费 agenda + 指令文件，其余留给既有 section 免双报）。`docs-drift.js` + `scripts/gen-cli-reference.mjs`——从 `command-manifest.json`(175)+`listCodingAgentToolNames()`(26) 生成 canonical 参考文档并双向 diff 漂移（`--out` 生成 / `--check` CI fail-on-drift）。\n- **IDE gap P0（cli/src 侧）**：远程审批绑定操作指纹（`approvalBindingDigest` 常数时间校验，断线重发/跨 Agent 冒用防护）+ 统一会话生命周期状态机（`session-lifecycle.js` 折叠 supervisor 状态/worker phase/IDE 状态为单一词汇表）。"
         },
         {
-          "heading": "Added — cc CLI 0.162.161：增量 gap-analysis（P0 后台状态机/跨 Agent 授权/凭据代理 + P1 完成条件/Monorepo 排除/持久 Scheduler）+ bg-* WS relay 协议硬化（CLI-only npm 发版）",
-          "body": "> `chainlesschain` 0.162.160 → **0.162.161** 发 npm `latest`（经 `npm-publish.yml`，`--provenance --access public`）。纯 `packages/cli/src` + `packages/agent-sdk` 协议增量；未触 `pdh/lib` → 无 Android cc bundle rollover / 无 USR_VERSION 改动。命令面无新顶层命令（`cc agenda list` 增 `nextWakeupAt` 字段），**顶层命令数 175 不变**。对照 `docs/CLAUDE_CODE_CLI_INCREMENTAL_GAP_ANALYSIS_2026-07-12.md`（vs Claude Code v2.1.207）逐节落地 P0/P1 Windows-可做、自包含、全测试的最有价值切片，每节文档记录「已落地」与「仍欠」。\n>\n> 全部为纯核 + 时钟注入（无 timer/RNG，确定性可测）+ 最小真实接线的低风险增量；已落地增量的 9 个测试文件 148 测全绿。\n\n- **跨事件 `trace_id`（协议 §1.2.1）**：stream-json 每行标注 run-scoped `trace_id`（`--trace-id` / `CC_TRACE_ID` / 自动生成），`sanitizeTraceId` 限字符集 `[A-Za-z0-9._:-]`≤128，供跨进程/跨 Agent 事件关联。\n- **后台 Agent 状态机（P0）**：拆分 Idle 与 Needs-input——`background-agent-phase.js` 归一化 phase（starting/working/idle/needs_input/waiting_permission，legacy `turn`→working），`phaseGroupKey` 让 `cc` 后台仪表板把「空闲」与「待输入/待批准」分组显示，不再混为一谈。\n- **跨 Agent 授权边界（P0 安全）**：`agent-authority.js` 授权信封——`origin`（user/model/subagent/teammate/channel/hook/remote/system/permission_tool）→ `authority`（none/steer/approve/manage），仅 user=manage、permission_tool=approve、已认证且 approve-scoped 的 remote=approve 可批准；`approvalBindingDigest({toolCallId,args,policyDigest})` 常数时间校验、fail-closed，防止一个 Agent 冒用另一个的批准。`origin` 恒由可信 dispatch 赋值，绝不从消息内容读取。\n- **跨平台沙箱与凭据代理（P0）**：`credential-proxy.js`——子进程环境默认屏蔽长效凭据（`maskCredentialEnv` 把 secret 值换成哨兵 `cc-cred-redacted:<NAME>`，`mask`/`deny` 双模式），审计日志绝不记录还原后的明文（`redactEnvForAudit`），`resolveApprovedInjection` 按 approved-host fail-closed 注入；`CC_CREDENTIAL_PROXY` 开关，关闭时同对象引用零开销。接线到 agent-core 前后台两处 spawn。\n- **会话级完成条件引擎（P1）**：`goal-condition-engine.js`——确定性完成条件（`exit-zero:`/`file-exists:`/`contains:`/`regex:`/`model:`/裸），预算（maxOuterTurns 默认 10、硬顶 100）+ 纯 reducer `evaluateGoalStep`，`GoalConditionEngine` 支持 snapshot/fromSnapshot 恢复；确定性检查经注入 spawnSync/existsSync 可测。\n- **大型 Monorepo 上下文排除（P1）**：`instructionExcludes`——`project-instructions.js` 支持按 glob 排除 legacy/vendor/generated 子树（裸名=任意段匹配、带斜杠前缀=目录+后代、`*`/`**`/`?` 通配、祖先匹配语义），@import 目标落在排除子树内也跳过（避免把凭据文件拉进 prompt）；`composeSystemPrompt` 透传 `instructionExcludes`。\n- **统一持久 Scheduler 规划器（P1）**：`schedule-planner.js`——确定性 jitter（FNV-1a 稳定 per-task 偏移，跨重启不漂移，避免共享 cron 分钟的惊群）、自适应唤醒（`nextWakeupAt`/`msUntilNextWakeup` 让 daemon 睡到最早 fire 而非轮询）、过期（`isEntryExpired`/`partitionSchedule` 先退休过期再触发）；接线到 `cc agenda list`（JSON `nextWakeupAt` + \"next wakeup\" 行）。\n- **bg-* WS relay 协议硬化**：事件序号缺口检测 + replay（慢/断线消费者补投）、出站背压（slow-consumer 保护）、跨语言 fixture 契约 + `tool_use_id` + event seq，IDE 上报文件路径的 remote URI/path 映射，MCP tool-path 边界守卫 + Windows lockfile ACL，diff-apply 并发/二进制守卫 + 读取实时编辑器缓冲的 stale-rejection，后台 Agent supervisor 3 个 pinned gap 收口 + 有界 prompt 队列。"
+          "heading": "Added — cc CLI 0.162.161：增量 gap-analysis（P0 后台状态机/跨 Agent 授权/凭据代理 + P1 完成条件/Monorepo 排除/持久 Scheduler）+ bg-\\* WS relay 协议硬化（CLI-only npm 发版）",
+          "body": "> `chainlesschain` 0.162.160 → **0.162.161** 发 npm `latest`（经 `npm-publish.yml`，`--provenance --access public`）。纯 `packages/cli/src` + `packages/agent-sdk` 协议增量；未触 `pdh/lib` → 无 Android cc bundle rollover / 无 USR_VERSION 改动。命令面无新顶层命令（`cc agenda list` 增 `nextWakeupAt` 字段），**顶层命令数 175 不变**。对照 `docs/CLAUDE_CODE_CLI_INCREMENTAL_GAP_ANALYSIS_2026-07-12.md`（vs Claude Code v2.1.207）逐节落地 P0/P1 Windows-可做、自包含、全测试的最有价值切片，每节文档记录「已落地」与「仍欠」。\n>\n> 全部为纯核 + 时钟注入（无 timer/RNG，确定性可测）+ 最小真实接线的低风险增量；已落地增量的 9 个测试文件 148 测全绿。\n\n- **跨事件 `trace_id`（协议 §1.2.1）**：stream-json 每行标注 run-scoped `trace_id`（`--trace-id` / `CC_TRACE_ID` / 自动生成），`sanitizeTraceId` 限字符集 `[A-Za-z0-9._:-]`≤128，供跨进程/跨 Agent 事件关联。\n- **后台 Agent 状态机（P0）**：拆分 Idle 与 Needs-input——`background-agent-phase.js` 归一化 phase（starting/working/idle/needs_input/waiting_permission，legacy `turn`→working），`phaseGroupKey` 让 `cc` 后台仪表板把「空闲」与「待输入/待批准」分组显示，不再混为一谈。\n- **跨 Agent 授权边界（P0 安全）**：`agent-authority.js` 授权信封——`origin`（user/model/subagent/teammate/channel/hook/remote/system/permission_tool）→ `authority`（none/steer/approve/manage），仅 user=manage、permission_tool=approve、已认证且 approve-scoped 的 remote=approve 可批准；`approvalBindingDigest({toolCallId,args,policyDigest})` 常数时间校验、fail-closed，防止一个 Agent 冒用另一个的批准。`origin` 恒由可信 dispatch 赋值，绝不从消息内容读取。\n- **跨平台沙箱与凭据代理（P0）**：`credential-proxy.js`——子进程环境默认屏蔽长效凭据（`maskCredentialEnv` 把 secret 值换成哨兵 `cc-cred-redacted:<NAME>`，`mask`/`deny` 双模式），审计日志绝不记录还原后的明文（`redactEnvForAudit`），`resolveApprovedInjection` 按 approved-host fail-closed 注入；`CC_CREDENTIAL_PROXY` 开关，关闭时同对象引用零开销。接线到 agent-core 前后台两处 spawn。\n- **会话级完成条件引擎（P1）**：`goal-condition-engine.js`——确定性完成条件（`exit-zero:`/`file-exists:`/`contains:`/`regex:`/`model:`/裸），预算（maxOuterTurns 默认 10、硬顶 100）+ 纯 reducer `evaluateGoalStep`，`GoalConditionEngine` 支持 snapshot/fromSnapshot 恢复；确定性检查经注入 spawnSync/existsSync 可测。\n- **大型 Monorepo 上下文排除（P1）**：`instructionExcludes`——`project-instructions.js` 支持按 glob 排除 legacy/vendor/generated 子树（裸名=任意段匹配、带斜杠前缀=目录+后代、`*`/`**`/`?` 通配、祖先匹配语义），@import 目标落在排除子树内也跳过（避免把凭据文件拉进 prompt）；`composeSystemPrompt` 透传 `instructionExcludes`。\n- **统一持久 Scheduler 规划器（P1）**：`schedule-planner.js`——确定性 jitter（FNV-1a 稳定 per-task 偏移，跨重启不漂移，避免共享 cron 分钟的惊群）、自适应唤醒（`nextWakeupAt`/`msUntilNextWakeup` 让 daemon 睡到最早 fire 而非轮询）、过期（`isEntryExpired`/`partitionSchedule` 先退休过期再触发）；接线到 `cc agenda list`（JSON `nextWakeupAt` + \"next wakeup\" 行）。\n- **bg-\\* WS relay 协议硬化**：事件序号缺口检测 + replay（慢/断线消费者补投）、出站背压（slow-consumer 保护）、跨语言 fixture 契约 + `tool_use_id` + event seq，IDE 上报文件路径的 remote URI/path 映射，MCP tool-path 边界守卫 + Windows lockfile ACL，diff-apply 并发/二进制守卫 + 读取实时编辑器缓冲的 stale-rejection，后台 Agent supervisor 3 个 pinned gap 收口 + 有界 prompt 队列。"
         },
         {
           "heading": "Added — cc CLI 0.162.160：运行时安全与确定性 8 批（沙箱严格模式 + 依赖/凭据安全 + 确定性 Headless + Subagent 契约 + MCP 生命周期 + Hooks 硬化）（CLI-only npm 发版）",

package/src/gateways/ws/remote-session-protocol.js

@@ -9,6 +9,11 @@ import {
 } from "../../harness/remote-session-crypto.js";
 import { isApprovalRequestEvent } from "../../harness/remote-session-push.js";
 import { RemoteCommandLedger } from "../../harness/remote-command-ledger.js";
+import {
+  ORIGIN,
+  assertCanApprove,
+  describeAuthorityChain,
+} from "../../lib/agent-authority.js";
 
 const CLIENT_EVENT_SCOPES = Object.freeze({
   prompt: "prompt",
@@ -463,6 +468,30 @@ export async function handleRemoteSessionPublish(
       ) {
         throw new Error("prompt content is required");
       }
+      // Authority (§"权限来源与跨 Agent 授权边界"): a remote *approve* is honored
+      // only from an authenticated, approve-scoped device — the SINGLE
+      // authoritative rule, not just the per-device scope check above, so the
+      // remote seam can never drift from the local/headless approval gate. The
+      // approve scope was already proven by the `authorize(..., "approve")` call
+      // above; asserting here makes that rule explicit and centralized. Built
+      // up-front (before the idempotency ledger) so a rejected approve never
+      // consumes a commandId slot. A deny always passes (anyone may deny —
+      // fail-safe). The envelope also feeds `describeAuthorityChain` provenance
+      // into the audit trail below.
+      let approvalEnvelope = null;
+      if (message.event.type === "approval.resolve") {
+        approvalEnvelope = {
+          origin: ORIGIN.REMOTE,
+          authenticated: true,
+          scopes: ["approve"],
+          principalId: clientId,
+          sessionId: message.remoteSessionId,
+        };
+        const approved = message.event.answer ?? message.event.approved;
+        if (approved === true || approved === "true" || approved === "yes") {
+          assertCanApprove(approvalEnvelope);
+        }
+      }
       // CLIENT-HOSTED sessions (第四阶段 #2): when the agent session does not
       // live in THIS server's sessionManager — e.g. a REPL/headless process
       // that connected as a WS client and registered its own local session id —
@@ -515,10 +544,15 @@ export async function handleRemoteSessionPublish(
                       requestId:
                         message.event.requestId || message.event.approvalId,
                       approved: message.event.answer ?? message.event.approved,
+                      // Log-safe provenance: which principal/session/authority.
+                      authority: describeAuthorityChain(approvalEnvelope || {}),
                       forwarded: true,
                     }
                   : { forwarded: true },
           });
+          // Hand the event to the host process. `message.event` carries any
+          // echoed approval binding, so the host gate can reject a stale /
+          // tampered verdict.
           server._send(hostTarget.ws, {
             type: "remote-session-control",
             remoteSessionId: message.remoteSessionId,
@@ -553,12 +587,17 @@ export async function handleRemoteSessionPublish(
             detail: {
               requestId: message.event.requestId || message.event.approvalId,
               approved: message.event.answer ?? message.event.approved,
+              // Log-safe provenance: which principal/session/authority approved.
+              authority: describeAuthorityChain(approvalEnvelope || {}),
             },
           });
           await handleSessionAnswer(server, message.id, ws, {
             ...controlMessage,
             requestId: message.event.requestId || message.event.approvalId,
             answer: message.event.answer ?? message.event.approved,
+            // Echoed approval binding (if any): the host interaction gate rejects
+            // a verdict whose binding doesn't match the pending request.
+            binding: message.event.binding ?? null,
           });
         } else if (message.event.type === "interrupt") {
           audit(server, {

package/src/gateways/ws/session-protocol.js

@@ -5,6 +5,46 @@ import {
   CODING_AGENT_EVENT_TYPES,
 } from "../../runtime/runtime-events.js";
 import { createSessionRecord } from "../../runtime/contracts/session-record.js";
+import { loadSideEffectLedger } from "../../lib/side-effect-ledger-store.js";
+import { reconcileSideEffects } from "../../lib/side-effect-ledger.js";
+
+/**
+ * P0-2: on a bridge/IDE resume, surface any irreversible tool that was in flight
+ * when the prior worker died. Returns a de-identified recovery descriptor (kind
+ * + short key + reason, never argument values) plus a human-readable notice, or
+ * null when nothing needs verification. PURE apart from reading the ledger.
+ */
+function buildResumeRecovery(sessionId) {
+  try {
+    const ledger = loadSideEffectLedger(sessionId);
+    const plan = reconcileSideEffects(ledger);
+    if (!plan.inspect.length) return null;
+    const items = plan.plans
+      .filter((p) => p.action === "inspect")
+      .map((p) => {
+        const op = ledger.get(p.opId) || {};
+        return {
+          kind: op.kind || "unknown",
+          key: op.key || null,
+          reason: p.reason,
+        };
+      });
+    const notice =
+      "Recovery notice — the previous run was interrupted while these " +
+      "irreversible operations were in flight; their outcome is UNKNOWN. Do " +
+      "NOT blindly re-run them. Verify whether each already took effect before " +
+      "repeating it, and ask the user if unsure:\n" +
+      items
+        .map(
+          (it) =>
+            `  • [${it.kind}]${it.key ? ` (${it.key})` : ""} — ${it.reason}`,
+        )
+        .join("\n");
+    return { count: items.length, items, notice };
+  } catch {
+    return null;
+  }
+}
 
 // Build a unified envelope for a solicited WS response. The bridge correlates
 // by `requestId` (the inbound request's id) and unwraps `payload` for callers
@@ -226,6 +266,14 @@ export async function handleSessionResume(server, id, ws, message) {
     status: "resumed",
   });
 
+  // P0-2: reconcile the crash-safe side-effect ledger. If a dangerous tool was
+  // in flight when the prior worker died, warn the IDE client AND inject a
+  // system note so the resumed model does not silently replay it.
+  const recovery = buildResumeRecovery(session.id);
+  if (recovery && Array.isArray(session.messages)) {
+    session.messages.push({ role: "system", content: recovery.notice });
+  }
+
   server.emit(
     RUNTIME_EVENTS.SESSION_RESUME,
     createRuntimeEvent(
@@ -235,6 +283,7 @@ export async function handleSessionResume(server, id, ws, message) {
         historyCount: history.length,
         sessionType: session.type || null,
         record,
+        ...(recovery ? { recovery } : {}),
       },
       { kind: "server", sessionId: session.id },
     ),
@@ -249,6 +298,7 @@ export async function handleSessionResume(server, id, ws, message) {
         sessionId: session.id,
         history,
         record,
+        ...(recovery ? { recovery } : {}),
       },
       session.id,
     ),
@@ -492,7 +542,10 @@ export async function handleSessionInterrupt(server, id, ws, message) {
 }
 
 export function handleSessionAnswer(server, id, ws, message) {
-  const { sessionId, requestId, answer } = message;
+  // `binding` (authority §"权限来源"): an approve answer may echo the binding the
+  // request advertised so the interaction adapter can reject a stale / tampered
+  // verdict. Absent → backward-compatible (no binding check).
+  const { sessionId, requestId, answer, binding = null } = message;
 
   if (!server.sessionManager) {
     server._send(
@@ -504,7 +557,7 @@ export function handleSessionAnswer(server, id, ws, message) {
 
   const session = server.sessionManager.getSession(sessionId);
   if (session && session.interaction && session.interaction.resolveAnswer) {
-    session.interaction.resolveAnswer(requestId, answer);
+    session.interaction.resolveAnswer(requestId, answer, binding);
   }
 
   server._send(

package/src/gateways/ws/ws-agent-handler.js

@@ -12,6 +12,12 @@
  */
 
 import { agentLoop, formatToolArgs } from "../../runtime/agent-core.js";
+import { classifyToolSideEffect } from "../../lib/side-effect-ledger.js";
+import {
+  loadSideEffectLedger,
+  persistSideEffectLedger,
+} from "../../lib/side-effect-ledger-store.js";
+import { operationIdempotencyKey } from "../../lib/idempotency.js";
 import {
   detectTaskType,
   selectModelForTask,
@@ -35,6 +41,9 @@ export class WSAgentHandler {
     this._processing = false;
     this._abortController = null;
     this._activeRequestId = null;
+    // P0-2: monotonic sequence for crash-safe side-effect ledger op ids. The
+    // session id + a per-op nonce keep ids unique across turns and processes.
+    this._sideEffectSeq = 0;
   }
 
   /**
@@ -120,6 +129,14 @@ export class WSAgentHandler {
         signal: abortController.signal,
       };
 
+      // P0-2: crash-safe side-effect ledger for the IDE/bridge path — mirrors
+      // the headless runner. A dangerous tool is recorded prepare→start (snapshot
+      // persisted BEFORE it settles) and commit/fail on its result, so a bridge
+      // worker killed mid-flight is surfaced for verification on resume (see
+      // handleSessionResume) instead of being blindly replayed.
+      const sideEffectLedger = loadSideEffectLedger(session.id);
+      let currentSideEffectOpId = null;
+
       for await (const event of agentLoop(session.messages, loopOptions)) {
         switch (event.type) {
           case "slot-filling":
@@ -137,6 +154,28 @@ export class WSAgentHandler {
               args: event.args,
               display: formatToolArgs(event.tool, event.args),
             });
+            currentSideEffectOpId = null;
+            {
+              const se = classifyToolSideEffect(event.tool, event.args);
+              if (se) {
+                const opId = `ws:${session.id}:${Date.now()}:${this._sideEffectSeq++}`;
+                currentSideEffectOpId = opId;
+                sideEffectLedger
+                  .prepare(opId, {
+                    kind: se.kind,
+                    key: se.key,
+                    meta: {
+                      tool: event.tool,
+                      idempotencyKey: operationIdempotencyKey({
+                        tool: event.tool,
+                        args: event.args,
+                      }),
+                    },
+                  })
+                  .start(opId);
+                persistSideEffectLedger(session.id, sideEffectLedger);
+              }
+            }
             break;
 
           case "tool-result":
@@ -146,6 +185,17 @@ export class WSAgentHandler {
               result: event.result,
               error: event.error,
             });
+            if (currentSideEffectOpId) {
+              const err = event.error || event.result?.error || null;
+              if (err)
+                sideEffectLedger.fail(
+                  currentSideEffectOpId,
+                  String(err).slice(0, 200),
+                );
+              else sideEffectLedger.commit(currentSideEffectOpId);
+              persistSideEffectLedger(session.id, sideEffectLedger);
+              currentSideEffectOpId = null;
+            }
             break;
 
           case "response-complete":

package/src/harness/jsonl-session-store.js

@@ -385,6 +385,66 @@ export function forkSession(sourceId) {
   return newId;
 }
 
+/**
+ * Create an independent BRANCH session ("从这里分支" — P0-3's fourth restore
+ * action) that keeps a parent's conversation up to a chosen turn and diverges
+ * from there. Unlike forkSession() (whole-session copy, random id, no lineage),
+ * this writes ONLY the caller-supplied pre-branch messages under a deterministic
+ * id (see deriveBranchSessionId) and records parent lineage — so the origin
+ * session is never touched (preservesParent) and a replayed branch request
+ * resolves to the SAME file instead of a duplicate (idempotent).
+ *
+ * @param {object} params
+ * @param {string} params.branchSessionId   deterministic branch id
+ * @param {string|null} [params.parentSessionId]
+ * @param {string|null} [params.parentTurnId]
+ * @param {Array<{role:string,content:any}>} [params.messages]  pre-branch turns
+ * @param {{title?:string,provider?:string,model?:string}} [params.meta]
+ * @returns {{branchSessionId:string, created:boolean, messages:number}}
+ */
+export function createBranchSession({
+  branchSessionId,
+  parentSessionId = null,
+  parentTurnId = null,
+  messages = [],
+  meta = {},
+} = {}) {
+  if (isUnsafeSessionId(branchSessionId)) {
+    throw new Error(
+      `unsafe branch session id: ${String(branchSessionId).slice(0, 60)}`,
+    );
+  }
+  // Idempotent: a replayed branch request resolves to the existing branch
+  // rather than doubling it (matches deriveBranchId's determinism).
+  if (existsSync(sessionPath(branchSessionId))) {
+    return { branchSessionId, created: false, messages: 0 };
+  }
+
+  startSession(branchSessionId, {
+    title: meta.title || `Branch of ${parentSessionId ?? "session"}`,
+    provider: meta.provider || "",
+    model: meta.model || "",
+  });
+  appendEvent(branchSessionId, "session_branch", {
+    parentSessionId: parentSessionId == null ? null : String(parentSessionId),
+    parentTurnId: parentTurnId == null ? null : String(parentTurnId),
+  });
+
+  let count = 0;
+  for (const m of Array.isArray(messages) ? messages : []) {
+    if (!m || m.role == null) continue;
+    if (m.role === "user") {
+      appendUserMessage(branchSessionId, m.content);
+      count += 1;
+    } else if (m.role === "assistant") {
+      appendAssistantMessage(branchSessionId, m.content);
+      count += 1;
+    }
+    // system prompt + tool scaffolding are re-established on resume; skip here.
+  }
+  return { branchSessionId, created: true, messages: count };
+}
+
 export function sessionExists(sessionId) {
   if (isUnsafeSessionId(sessionId)) return false; // never resolve a traversal id
   return existsSync(sessionPath(sessionId));

package/src/harness/worktree-isolator.js

@@ -8,8 +8,8 @@
  */
 
 import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { resolve } from "node:path";
+import { existsSync, rmSync, symlinkSync, mkdirSync } from "node:fs";
+import { resolve, dirname } from "node:path";
 import {
   isGitRepo,
   gitExec,
@@ -17,10 +17,15 @@ import {
   assertSafeGitRef,
   assertSafeGitPath,
 } from "../lib/git-integration.js";
+import { evaluateWorktreeCleanup } from "../lib/worktree-cleanup-safety.js";
+import {
+  normalizeSparsePaths,
+  planSymlinkDirectories,
+} from "../lib/worktree-sparse.js";
 
 const WORKTREE_DIR = ".worktrees";
 
-export function createWorktree(repoDir, branchName, baseBranch) {
+export function createWorktree(repoDir, branchName, baseBranch, options = {}) {
   assertSafeGitRef(branchName, "branch name");
   if (baseBranch) assertSafeGitRef(baseBranch, "base branch");
   if (!isGitRepo(repoDir)) {
@@ -40,7 +45,46 @@ export function createWorktree(repoDir, branchName, baseBranch) {
   const base = baseBranch || "HEAD";
   gitExec(`worktree add "${worktreePath}" -b "${branchName}" ${base}`, repoDir);
 
-  return { path: worktreePath, branch: branchName };
+  const result = { path: worktreePath, branch: branchName };
+
+  // Sparse checkout: only materialize the packages this task needs. For a
+  // large monorepo this cuts worktree creation time and disk. Cone mode wants
+  // directory paths — our sparsePaths are package dirs. Fail-closed on unsafe
+  // paths (normalizeSparsePaths drops them); empty/absent → full checkout,
+  // byte-identical to the no-sparse path.
+  const sparsePaths = normalizeSparsePaths(options.sparsePaths);
+  if (sparsePaths) {
+    for (const p of sparsePaths) assertSafeGitPath(p, "sparse path");
+    gitExecArgs(["sparse-checkout", "set", ...sparsePaths], worktreePath);
+    result.sparsePaths = sparsePaths;
+  }
+
+  // Dependency reuse: link explicitly-approved directories (e.g. node_modules)
+  // from the main checkout into the worktree so the task does not reinstall.
+  // planSymlinkDirectories throws (fail-closed) on any junction/symlink escape.
+  if (options.symlinkDirectories != null) {
+    const plan = planSymlinkDirectories(options.symlinkDirectories, {
+      repoDir,
+      worktreePath,
+    });
+    const linked = [];
+    for (const { name, source, dest } of plan) {
+      if (!existsSync(source)) continue; // approved but absent — nothing to reuse
+      if (existsSync(dest)) rmSync(dest, { recursive: true, force: true });
+      mkdirSync(dirname(dest), { recursive: true });
+      // 'junction' on Windows needs no admin and works for directories;
+      // 'dir' elsewhere. Both resolve to an absolute source we validated.
+      symlinkSync(
+        source,
+        dest,
+        process.platform === "win32" ? "junction" : "dir",
+      );
+      linked.push(name);
+    }
+    if (linked.length > 0) result.symlinkedDirectories = linked;
+  }
+
+  return result;
 }
 
 export function removeWorktree(repoDir, worktreePath, options = {}) {
@@ -145,12 +189,103 @@ export async function isolateTask(repoDir, taskId, fn) {
   }
 }
 
-export function cleanupAgentWorktrees(repoDir) {
+/**
+ * Gather the cleanup-safety state of one worktree for
+ * [[worktree-cleanup-safety.js]] `evaluateWorktreeCleanup`. Fail-closed: any git
+ * command that cannot be read leaves the worktree marked unverifiable (→ kept).
+ * `linkedPrs` is not known at this layer (no PR store here) and is left empty;
+ * a higher layer that knows about PRs can call `evaluateWorktreeCleanup` itself.
+ */
+function _worktreeCleanupState(repoDir, wt) {
+  const state = {
+    readable: true,
+    uncommitted: false,
+    untracked: false,
+    unpushed: false,
+    linkedPrs: [],
+  };
+
+  // Dirty state: separate tracked modifications from untracked files.
+  try {
+    const porcelain = execSync("git status --porcelain", {
+      cwd: wt.path,
+      encoding: "utf-8",
+      maxBuffer: 64 * 1024 * 1024,
+    });
+    const lines = porcelain.split("\n").filter((l) => l.trim().length > 0);
+    state.untracked = lines.some((l) => l.startsWith("??"));
+    state.uncommitted = lines.some((l) => !l.startsWith("??"));
+  } catch (_e) {
+    state.readable = false; // cannot verify → fail-closed keep
+    return state;
+  }
+
+  // Unpushed: only relevant if the branch has commits beyond the repo HEAD; if
+  // it does, they are unpushed unless a remote branch contains them.
+  try {
+    assertSafeGitRef(wt.branch, "branch name");
+    if (_hasBranchCommits(repoDir, wt.branch)) {
+      const remotes = gitExecArgs(
+        ["branch", "-r", "--contains", wt.branch],
+        repoDir,
+      );
+      state.unpushed = remotes.trim().length === 0;
+    }
+  } catch (_e) {
+    state.unpushed = true; // cannot prove the commits are pushed → keep
+  }
+
+  return state;
+}
+
+/**
+ * Assess (read-only) which `agent/*` worktrees are safe to remove. Returns the
+ * per-worktree decision from [[worktree-cleanup-safety.js]] without deleting
+ * anything — the "清理前检查未提交修改、未追踪文件、未 Push Commit 和关联 PR"
+ * report from IDE gap P1-5.
+ */
+export function assessAgentWorktreeCleanup(repoDir) {
+  const worktrees = listWorktrees(repoDir);
+  const assessments = [];
+  for (const wt of worktrees) {
+    if (!(wt.branch && wt.branch.startsWith("agent/"))) continue;
+    const state = _worktreeCleanupState(repoDir, wt);
+    const decision = evaluateWorktreeCleanup(state);
+    assessments.push({
+      path: wt.path,
+      branch: wt.branch,
+      safeToRemove: decision.safeToRemove,
+      blockers: decision.blockers,
+    });
+  }
+  return {
+    assessments,
+    removable: assessments.filter((a) => a.safeToRemove).length,
+    kept: assessments.filter((a) => !a.safeToRemove).length,
+  };
+}
+
+/**
+ * Remove `agent/*` worktrees. By DEFAULT this is now fail-closed: a worktree
+ * with uncommitted / untracked / unpushed work (or one whose state cannot be
+ * read) is KEPT, not force-deleted — the P1-5 data-loss guard. Pass
+ * `{ force: true }` for the legacy "wipe every agent worktree" behavior.
+ *
+ * @returns {number} count of worktrees actually removed
+ */
+export function cleanupAgentWorktrees(repoDir, options = {}) {
+  const force = options.force === true;
   const worktrees = listWorktrees(repoDir);
   let cleaned = 0;
 
   for (const wt of worktrees) {
     if (wt.branch && wt.branch.startsWith("agent/")) {
+      if (!force) {
+        const decision = evaluateWorktreeCleanup(
+          _worktreeCleanupState(repoDir, wt),
+        );
+        if (!decision.safeToRemove) continue; // keep work we cannot safely lose
+      }
       try {
         removeWorktree(repoDir, wt.path, { deleteBranch: true });
         cleaned++;