chainlesschain 0.162.163 → 0.162.165

package/src/runtime/agent-core.js

@@ -26,6 +26,7 @@ import sharedHookRunner from "../lib/hook-runner.cjs";
 import sharedHookEvents from "../lib/settings-hook-events.cjs";
 import { mergeProviderOptions } from "../lib/provider-options.js";
 import { applyCredentialProxy } from "../lib/credential-proxy.js";
+import { describeBackgroundCommand } from "../lib/terminal-context.js";
 import { buildTelemetryAttributes } from "../lib/telemetry-ids.js";
 import { getPlanModeManager } from "../lib/plan-mode.js";
 import { CLISkillLoader } from "../lib/skill-loader.js";
@@ -45,6 +46,11 @@ import {
 import { createToolContext } from "../tools/tool-context.js";
 import { createToolTelemetryRecord } from "../tools/tool-telemetry.js";
 import { isAbortError, throwIfAborted } from "../lib/abort-utils.js";
+import {
+  classifyEditReplay,
+  editIdempotencyKey,
+  EDIT_REPLAY,
+} from "../lib/idempotency.js";
 import { buildSearchCommand } from "../lib/search-command.js";
 import { discoverCommands } from "../lib/slash-commands.js";
 import {
@@ -138,18 +144,37 @@ function _readBgStream(stream) {
 }
 
 /**
- * Snapshot of background shell tasks (for REPL/host status surfaces).
- * @returns {Array<{id:string,status:string,command:string,exitCode:number|null}>}
+ * Snapshot of background shell tasks (for REPL/host status surfaces AND the
+ * model-facing `check_shell { list:true }` tool).
+ *
+ * P1-2 (terminal-context): the `command` string can carry an inline secret
+ * (`FOO=token cmd`, `curl -H "Authorization: Bearer …"`); this list is shown to
+ * the model and rendered in `/tasks`, so run it through
+ * `describeBackgroundCommand` to secret-redact the command and expose the PID.
+ * The task's own lifecycle `status` (running/exited/failed/error) is preserved
+ * — that is distinct from a health check, so it is NOT replaced. `stoppable` is
+ * gated on the task still running (a valid pid alone doesn't make a dead task
+ * stoppable).
+ * @returns {Array<{id:string,status:string,command:string,pid:number|null,
+ *   stoppable:boolean,exitCode:number|null,startedAt:string,endedAt:string}>}
  */
 export function listBackgroundShellTasks() {
-  return Array.from(_backgroundShellTasks.values()).map((t) => ({
-    id: t.id,
-    status: t.status,
-    command: t.command,
-    exitCode: t.exitCode,
-    startedAt: t.startedAt,
-    endedAt: t.endedAt,
-  }));
+  return Array.from(_backgroundShellTasks.values()).map((t) => {
+    const desc = describeBackgroundCommand({
+      command: t.command,
+      pid: t.child?.pid,
+    });
+    return {
+      id: t.id,
+      status: t.status,
+      command: desc.command, // P1-2: secret-redacted
+      pid: desc.pid, // P1-2: PID surfaced
+      stoppable: t.status === "running" && desc.stoppable,
+      exitCode: t.exitCode,
+      startedAt: t.startedAt,
+      endedAt: t.endedAt,
+    };
+  });
 }
 
 // Kill a background task's whole process tree. Because tasks are spawned with
@@ -826,20 +851,38 @@ export function buildSystemPrompt(cwd, opts = {}) {
     // Non-critical — skill loader may not be available
   }
 
-  // Append rules.md
-  try {
-    const projectRoot = findProjectRoot(dir);
-    if (projectRoot) {
-      const rulesPath = path.join(projectRoot, ".chainlesschain", "rules.md");
-      if (fs.existsSync(rulesPath)) {
-        const content = fs.readFileSync(rulesPath, "utf-8");
-        if (content.trim()) {
-          prompt += `\n\n## Project Rules\n${content}`;
+  // Append rules.md — unless the caller opted into a lean/off prompt. `rules.md`
+  // is coding-convention DETAIL (the entry cc.md/CLAUDE.md references it), so it
+  // is shed both when project memory is fully off (`--no-project-memory` →
+  // projectMemory === false) AND in entry-only lean mode (projectMemory ===
+  // "lean", or the env signal CC_PROJECT_MEMORY=lean when no explicit value is
+  // threaded). NOTE: legacy `CC_PROJECT_MEMORY=0` intentionally still KEEPS
+  // rules.md (its long-standing contract only dropped the instruction block) —
+  // so we only honor the "lean" env here, never "0".
+  const _pm = opts.projectMemory;
+  const _envLean =
+    process.env.CC_PROJECT_MEMORY === "lean" ||
+    process.env.CC_PROJECT_MEMORY === "entry";
+  const _dropRules =
+    _pm === false ||
+    _pm === "lean" ||
+    _pm === "entry" ||
+    (_pm == null && _envLean);
+  if (!_dropRules) {
+    try {
+      const projectRoot = findProjectRoot(dir);
+      if (projectRoot) {
+        const rulesPath = path.join(projectRoot, ".chainlesschain", "rules.md");
+        if (fs.existsSync(rulesPath)) {
+          const content = fs.readFileSync(rulesPath, "utf-8");
+          if (content.trim()) {
+            prompt += `\n\n## Project Rules\n${content}`;
+          }
         }
       }
+    } catch {
+      // Non-critical
     }
-  } catch {
-    // Non-critical
   }
 
   // Advertise extra workspace roots (--add-dir) so the model knows it may
@@ -2100,6 +2143,26 @@ async function _withPostEditDiagnostics(result, filePath, cwd) {
   return newDiagnostics ? { ...result, newDiagnostics } : result;
 }
 
+/**
+ * Drop skills whose `paths:` frontmatter scopes them to a different subtree than
+ * the agent's cwd (large-monorepo lazy skill surface). A skill with no `paths`
+ * applies everywhere, so a skill set with none is returned unchanged. Best-effort:
+ * any failure (or an unlocatable project root → relCwd "") falls open to the full
+ * list, never hiding a skill spuriously.
+ */
+async function filterSkillsByCwd(skills, cwd) {
+  try {
+    if (!Array.isArray(skills) || skills.every((s) => !s?.paths)) return skills;
+    const { filterSkillsByRelCwd, relCwdForCwd } =
+      await import("../lib/skill-path-scope.js");
+    const { findProjectRoot } = await import("../lib/project-detector.js");
+    const root = (cwd && findProjectRoot(cwd)) || cwd || "";
+    return filterSkillsByRelCwd(skills, relCwdForCwd(cwd, root));
+  } catch {
+    return skills; // fail-open: never hide a skill because scoping errored
+  }
+}
+
 async function executeToolInner(
   name,
   args,
@@ -2323,6 +2386,30 @@ async function executeToolInner(
         replaceAll,
       );
       if (count === 0) {
+        // Idempotent replay (P0-2 "Diff Apply 内容哈希"): a resumed edit whose
+        // old_string is already gone but whose new_string is present already
+        // landed. Report a no-op success (NO write occurs — zero data risk)
+        // rather than a misleading "not found" error, so a recovered worker
+        // doesn't get stuck re-issuing an edit that already happened.
+        const replay = classifyEditReplay({
+          content,
+          oldString: args.old_string,
+          newString: args.new_string,
+        });
+        if (replay === EDIT_REPLAY.ALREADY_APPLIED) {
+          return attachDescriptor({
+            success: true,
+            path: filePath,
+            alreadyApplied: true,
+            idempotencyKey: editIdempotencyKey({
+              path: args.path,
+              oldString: args.old_string,
+              newString: args.new_string,
+              replaceAll,
+            }),
+            note: "edit already applied (new_string present, old_string absent) — no change made",
+          });
+        }
         return attachDescriptor({ error: "old_string not found in file" });
       }
       // Require a UNIQUE match (Claude-Code Edit parity) — replacing the first
@@ -3220,6 +3307,16 @@ async function executeToolInner(
           goalMaxTokens: args.goal_max_tokens ?? null,
           goalMaxCost: args.goal_max_cost ?? null,
           goalMaxTime: args.goal_max_time ?? null,
+          // P1-8: action classes this unattended task may still perform (e.g.
+          // "publish", "external_message"). Accepts an array or a comma list.
+          unattendedAllowlist: Array.isArray(args.unattended_allow)
+            ? args.unattended_allow
+            : typeof args.unattended_allow === "string"
+              ? args.unattended_allow
+                  .split(",")
+                  .map((s) => s.trim())
+                  .filter(Boolean)
+              : null,
         };
         if (action === "wakeup") {
           if (!args.prompt) {
@@ -3620,7 +3717,10 @@ async function executeToolInner(
     }
 
     case "run_skill": {
-      const allSkills = skillLoader.getResolvedSkills().filter(skillAllowed);
+      const allSkills = await filterSkillsByCwd(
+        skillLoader.getResolvedSkills().filter(skillAllowed),
+        cwd,
+      );
       if (allSkills.length === 0) {
         return attachDescriptor({
           error: _skillAllowlist
@@ -3766,7 +3866,10 @@ async function executeToolInner(
     }
 
     case "list_skills": {
-      let skills = skillLoader.getResolvedSkills().filter(skillAllowed);
+      let skills = await filterSkillsByCwd(
+        skillLoader.getResolvedSkills().filter(skillAllowed),
+        cwd,
+      );
       if (skills.length === 0) {
         return attachDescriptor({
           error: _skillAllowlist
@@ -6379,6 +6482,22 @@ function extractInitialPromptText(messages) {
   return "";
 }
 
+/**
+ * Stable id for a permission GATE decision, so a denied/gated tool span can be
+ * correlated with the decision that blocked it. Only gated results carry a
+ * `policy` (allow-path tools execute with no distinct decision), so this returns
+ * null when there's nothing to identify. Deterministic (call id + gate) — no
+ * clock/RNG — so a consumer holding the tool-result's policy + tool_call_id can
+ * recompute it. Not exported (no shim-parity impact) — only the telemetry seam
+ * uses it.
+ */
+function permissionDecisionId(callId, policy) {
+  if (!policy || typeof policy !== "object" || !policy.decision) return null;
+  const gate = policy.via || policy.decision;
+  const base = callId || "call";
+  return `${base}:perm:${gate}`;
+}
+
 export async function* agentLoop(messages, options) {
   // Shared iteration budget — replaces hardcoded MAX_ITERATIONS.
   // When options.iterationBudget is provided (e.g. from parent agent),
@@ -6858,6 +6977,18 @@ export async function* agentLoop(messages, options) {
       }
     }
 
+    // Per-span unified ids (P2 observability): the run-level default attributes
+    // stamp session/agent/workflow ids on every span, but turn/prompt ids are
+    // per-iteration. A "turn" is one model iteration of the run; "prompt" is the
+    // model request within that turn. Normalized through buildTelemetryAttributes
+    // so they get the same charset-sanitized + cardinality-bounded treatment as
+    // the run-level ids (turn.id correlates with the agent.iteration counter).
+    const modelIdAttrs = recorder
+      ? buildTelemetryAttributes({
+          turnId: `${runId}:t${budget.consumed}`,
+          promptId: `${runId}:t${budget.consumed}:p`,
+        })
+      : null;
     const result = await _withSpan(
       recorder,
       "agent.model",
@@ -6865,6 +6996,7 @@ export async function* agentLoop(messages, options) {
         "gen_ai.system": options.provider || "ollama",
         "gen_ai.request.model": options.model || "unknown",
         "agent.iteration": budget.consumed,
+        ...(modelIdAttrs || {}),
       },
       () => llmCall(callMessages, options),
       (span, r) => {
@@ -6886,6 +7018,21 @@ export async function* agentLoop(messages, options) {
           Array.isArray(r?.message?.tool_calls) &&
             r.message.tool_calls.length > 0,
         );
+        // response CONTENT is opt-in (--otlp-content): stamped only when
+        // enabled, redacted + length-capped through the same normalizer; the
+        // field is entirely absent by default so default OTLP stays unchanged.
+        if (options.otlpIncludeContent === true && r?.message?.content) {
+          const respAttrs = buildTelemetryAttributes(
+            { response: r.message.content },
+            { includeContent: true },
+          );
+          if (respAttrs["content.response"] != null) {
+            span.setAttribute(
+              "content.response",
+              respAttrs["content.response"],
+            );
+          }
+        }
       },
       "model_error",
     );
@@ -7163,17 +7310,66 @@ export async function* agentLoop(messages, options) {
 
       let toolResult;
       let toolError = null;
+      // Per-span unified ids (P2 observability): a tool span carries its turn.id
+      // (correlating with the model span of the same iteration), the provider's
+      // tool_use.id (so a tool-result event can be tied back to its call), and —
+      // when auto-checkpoint fired before a mutating tool — the checkpoint.id the
+      // user could restore to. All normalized through buildTelemetryAttributes.
+      // tool_arguments CONTENT is opt-in (--otlp-content): the alias key is only
+      // present when explicitly enabled, so by default the field is omitted
+      // entirely (byte-identical default OTLP), and even opted-in it's length-
+      // capped by redactContent. Mirrors the run-level content.prompt opt-in.
+      const toolContentOptIn = options.otlpIncludeContent === true;
+      const toolIdAttrs = recorder
+        ? buildTelemetryAttributes(
+            {
+              turnId: `${runId}:t${budget.consumed}`,
+              toolUseId: call.id,
+              checkpointId: cpId || undefined,
+              ...(toolContentOptIn ? { toolArguments: toolArgs } : {}),
+            },
+            { includeContent: toolContentOptIn },
+          )
+        : null;
       try {
         toolResult = await _withSpan(
           recorder,
           "agent.tool",
-          { "tool.name": toolName },
+          { "tool.name": toolName, ...(toolIdAttrs || {}) },
           () => executeTool(toolName, toolArgs, toolContext),
           (span, r) => {
             span.setAttribute(
               "tool.is_error",
               !!(r && typeof r === "object" && r.error),
             );
+            // permission.decision_id (P2): a GATED tool result carries a
+            // `policy` (deny / ask-fail / host-block / sandbox); allow-path
+            // tools execute with no distinct decision. Stamp a stable id
+            // (derived from the call + gate, so it's recomputable from the
+            // tool-result's policy + tool_call_id) plus the low-cardinality
+            // decision, letting a blocked tool span be tied to its decision.
+            const decId =
+              r && typeof r === "object"
+                ? permissionDecisionId(call.id, r.policy)
+                : null;
+            if (decId) {
+              const permAttrs = buildTelemetryAttributes({
+                decisionId: decId,
+                "permission.decision": r.policy.decision,
+              });
+              if (permAttrs["permission.decision_id"]) {
+                span.setAttribute(
+                  "permission.decision_id",
+                  permAttrs["permission.decision_id"],
+                );
+              }
+              if (permAttrs["permission.decision"]) {
+                span.setAttribute(
+                  "permission.decision",
+                  permAttrs["permission.decision"],
+                );
+              }
+            }
           },
           "tool_error",
         );

package/src/runtime/diagnostics.js

@@ -288,6 +288,66 @@ export async function collectDoctorReport() {
   };
 }
 
+/**
+ * Parse `git worktree list --porcelain` output into `{ path, branch }` entries.
+ *
+ * Pure (no I/O) so it can be unit-tested against fixed fixtures. A detached
+ * worktree has no `branch` line and yields `branch: null`.
+ */
+export function parseGitWorktrees(porcelain) {
+  if (!porcelain || typeof porcelain !== "string") return [];
+  const entries = [];
+  let cur = null;
+  for (const line of porcelain.split("\n")) {
+    const trimmed = line.trimEnd();
+    if (trimmed.startsWith("worktree ")) {
+      if (cur) entries.push(cur);
+      cur = { path: trimmed.slice("worktree ".length).trim(), branch: null };
+    } else if (trimmed.startsWith("branch ") && cur) {
+      cur.branch = trimmed
+        .slice("branch ".length)
+        .replace("refs/heads/", "")
+        .trim();
+    }
+  }
+  if (cur) entries.push(cur);
+  return entries;
+}
+
+/** Best-effort live git worktree list for the current repo. */
+export function collectWorktrees() {
+  return parseGitWorktrees(safeExec("git worktree list --porcelain"));
+}
+
+/**
+ * Map a doctor report + ambient runtime signals into the input contract of
+ * `buildDiagnosticBundle` (src/lib/diagnostic-bundle.js).
+ *
+ * Pure & deterministic aside from reading this process's own platform tags:
+ * the caller gathers live signals (env, worktrees, lockfiles) and passes them
+ * in, so the mapping itself is unit-testable. Session-runtime fields
+ * (connectionState, reconnectHistory, trace, redactionEvents) are absent from a
+ * cold `cc doctor` invocation and left to the bundle builder's safe defaults.
+ */
+export function buildDoctorDiagnosticInput(report, signals = {}) {
+  const r = report || {};
+  return {
+    version: r.version || null,
+    platform: {
+      os: process.platform,
+      arch: process.arch,
+      node: process.versions?.node || null,
+    },
+    ports: (Array.isArray(r.ports) ? r.ports : [])
+      .filter((p) => p && p.open)
+      .map((p) => ({ port: p.port, proto: p.name })),
+    worktrees: Array.isArray(signals.worktrees) ? signals.worktrees : [],
+    lockfiles: Array.isArray(signals.lockfiles) ? signals.lockfiles : [],
+    env: signals.env && typeof signals.env === "object" ? signals.env : {},
+    notes: signals.notes != null ? signals.notes : null,
+  };
+}
+
 /**
  * Collect a machine-readable status report.
  *

package/src/runtime/headless-runner.js

@@ -51,6 +51,13 @@ import {
   getLastSessionId as jsonlGetLastSessionId,
   verifySession as jsonlVerifySession,
 } from "../harness/jsonl-session-store.js";
+import {
+  SideEffectLedger,
+  reconcileSideEffects,
+  classifyToolSideEffect,
+} from "../lib/side-effect-ledger.js";
+import { SIDE_EFFECT_LEDGER_EVENT } from "../lib/side-effect-ledger-store.js";
+import { operationIdempotencyKey } from "../lib/idempotency.js";
 import { expandFileRefsAsync } from "./file-ref-expander.js";
 import { composeSystemPrompt } from "./system-prompt.js";
 import { buildUserContent } from "../lib/image-input.js";
@@ -688,6 +695,81 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     }
   }
 
+  // ── P0-2: crash-safe side-effect ledger ────────────────────────────────
+  // Dangerous tools (file writes, opaque shell, git push, publish/schedule/
+  // notify/browser actions) are recorded prepare→start→commit|fail and the
+  // full snapshot persisted before the effect settles, so a worker killed
+  // mid-flight does NOT blindly replay an effect that may already have landed.
+  // Only active when persisting (an ephemeral/one-shot run can't be resumed);
+  // the byte-for-byte default path is untouched when no dangerous tool runs.
+  const sideEffectRunNonce = String(deps.now ? deps.now() : Date.now());
+  let sideEffectLedger = new SideEffectLedger({ clock: deps.now || null });
+  let sideEffectSeq = 0;
+  let currentSideEffectOpId = null;
+  let resumeSideEffectContext = null;
+  const persistSideEffectLedger = () => {
+    if (!persist) return;
+    try {
+      store.appendEvent(
+        sessionId,
+        SIDE_EFFECT_LEDGER_EVENT,
+        sideEffectLedger.toJSON(),
+      );
+    } catch {
+      // best-effort — never fail the run over ledger persistence
+    }
+  };
+  if (persist) {
+    try {
+      const events = store.readEvents(sessionId) || [];
+      for (let i = events.length - 1; i >= 0; i--) {
+        const e = events[i];
+        if (
+          e &&
+          e.type === SIDE_EFFECT_LEDGER_EVENT &&
+          e.data &&
+          Array.isArray(e.data.ops)
+        ) {
+          sideEffectLedger = SideEffectLedger.fromJSON(e.data, {
+            clock: deps.now || null,
+          });
+          break;
+        }
+      }
+    } catch {
+      // fresh ledger — best effort
+    }
+    // On resume, surface any operation that was in flight when the prior run
+    // died: its outcome is UNKNOWN, so the model is told to VERIFY before any
+    // replay rather than silently re-issue an irreversible effect.
+    if (resumeId) {
+      try {
+        const plan = reconcileSideEffects(sideEffectLedger);
+        if (plan.inspect.length > 0) {
+          const lines = plan.plans
+            .filter((p) => p.action === "inspect")
+            .map((p) => {
+              const op = sideEffectLedger.get(p.opId);
+              const kind = op?.kind || "unknown";
+              const key = op?.key ? ` (${op.key})` : "";
+              return `  • [${kind}]${key} — ${p.reason}`;
+            });
+          resumeSideEffectContext =
+            "Recovery notice — the previous run was interrupted while these " +
+            "irreversible operations were in flight; their outcome is UNKNOWN. " +
+            "Do NOT blindly re-run them. Verify whether each already took " +
+            "effect before repeating it, and ask the user if unsure:\n" +
+            lines.join("\n");
+          writeErr(
+            `⚠ ${plan.inspect.length} interrupted side-effect(s) need verification before replay (resume ${resumeId}).\n`,
+          );
+        }
+      } catch {
+        resumeSideEffectContext = null;
+      }
+    }
+  }
+
   // ── Wire the persistent ApprovalGate with our non-interactive confirmer
   // and force the session-policy tier dictated by --permission-mode. ──────
   let approvalGate = null;
@@ -770,13 +852,21 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     }
   }
 
+  // --no-project-memory (options.projectMemory === false): lean prompt — skip
+  // rules.md (in buildSystemPrompt) + the cc.md/CLAUDE.md block. Absent flag
+  // (undefined) leaves both paths byte-identical.
+  const _leanNoProjectMemory = options.projectMemory === false;
   const systemContent = composeSystemPrompt(
-    buildSystemPrompt(cwd, { additionalDirectories }),
+    buildSystemPrompt(cwd, {
+      additionalDirectories,
+      projectMemory: options.projectMemory,
+    }),
     {
       systemPrompt: options.systemPrompt,
       appendSystemPrompt: options.appendSystemPrompt,
       outputStyle: outputStyleBody,
       instructionExcludes,
+      projectMemory: _leanNoProjectMemory ? false : undefined,
     },
   );
 
@@ -863,6 +953,9 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     ...(sessionStartContext
       ? [{ role: "system", content: sessionStartContext }]
       : []),
+    ...(resumeSideEffectContext
+      ? [{ role: "system", content: resumeSideEffectContext }]
+      : []),
     ...history,
     { role: "user", content: userMessageContent },
   ]);
@@ -1067,7 +1160,7 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     try {
       const { AsyncHookSupervisor } =
         await import("../lib/async-hook-supervisor.cjs");
-      _hookSupervisor = new AsyncHookSupervisor();
+      _hookSupervisor = new AsyncHookSupervisor({ persistStats: true });
     } catch {
       _hookSupervisor = null; // async hooks are best-effort
     }
@@ -1492,10 +1585,50 @@ export async function runAgentHeadless(options = {}, deps = {}) {
               args: event.args,
             });
             toolCalls.push({ tool: event.tool, args: event.args });
+            // P0-2: record an irreversible effect as STARTED (persisted before
+            // it settles) so a crash before the matching tool-result leaves a
+            // reconcilable "in flight" marker instead of a silent replay.
+            currentSideEffectOpId = null;
+            if (persist) {
+              const se = classifyToolSideEffect(event.tool, event.args);
+              if (se) {
+                const opId = `${sideEffectRunNonce}:${sideEffectSeq++}`;
+                currentSideEffectOpId = opId;
+                sideEffectLedger
+                  .prepare(opId, {
+                    kind: se.kind,
+                    key: se.key,
+                    // Content-addressed key: a resumed replay of the SAME effect
+                    // derives the SAME key, so an external provider can de-dupe
+                    // and countDuplicateCommittedEffects can measure `0` repeats.
+                    meta: {
+                      tool: event.tool,
+                      idempotencyKey: operationIdempotencyKey({
+                        tool: event.tool,
+                        args: event.args,
+                      }),
+                    },
+                  })
+                  .start(opId);
+                persistSideEffectLedger();
+              }
+            }
             break;
           }
           case "tool-result": {
             const err = event.error || event.result?.error || null;
+            // P0-2: settle the in-flight side-effect (commit on success, fail on
+            // a clean error) and persist the updated ledger snapshot.
+            if (persist && currentSideEffectOpId) {
+              if (err)
+                sideEffectLedger.fail(
+                  currentSideEffectOpId,
+                  String(err).slice(0, 200),
+                );
+              else sideEffectLedger.commit(currentSideEffectOpId);
+              persistSideEffectLedger();
+              currentSideEffectOpId = null;
+            }
             if (isText && err) writeErr(`  Error: ${err}\n`);
             emitStream({
               type: "tool_result",

package/src/runtime/headless-stream.js

@@ -1073,8 +1073,16 @@ export async function runAgentHeadlessStream(options = {}, deps = {}) {
     }
   }
 
+  // --no-project-memory (options.projectMemory === false) → lean system prompt:
+  // skip both the rules.md append inside buildSystemPrompt AND the auto-loaded
+  // cc.md/CLAUDE.md instruction block. Only `=== false` changes anything; when
+  // the flag is absent (undefined) both paths stay byte-identical.
+  const _leanNoProjectMemory = options.projectMemory === false;
   const systemContent = composeSystemPrompt(
-    buildSystemPrompt(cwd, { additionalDirectories }),
+    buildSystemPrompt(cwd, {
+      additionalDirectories,
+      projectMemory: options.projectMemory,
+    }),
     {
       systemPrompt: options.systemPrompt,
       appendSystemPrompt: _jsonSchema
@@ -1084,6 +1092,7 @@ export async function runAgentHeadlessStream(options = {}, deps = {}) {
         : options.appendSystemPrompt,
       outputStyle: outputStyleBody,
       instructionExcludes,
+      projectMemory: _leanNoProjectMemory ? false : undefined,
     },
   );
   const messages = [{ role: "system", content: systemContent }];

package/src/runtime/policies/agent-policy.js

@@ -49,6 +49,11 @@ export function resolveAgentPolicy({
     // before 2026-07-09, breaking --vim/--think/--thinking-budget/
     // --fallback-model/--pdh/--permission-mode for interactive sessions.
     permissionMode: overrides.permissionMode,
+    // --no-project-memory tri-state (undefined=default-on / false=lean prompt).
+    // Plain passthrough consumed by startAgentRepl → composeSystemPrompt /
+    // buildSystemPrompt; without this allowlist entry the flag would be silently
+    // dropped for interactive sessions (same class as the vim/think/pdh fixes).
+    projectMemory: overrides.projectMemory,
     vimMode: overrides.vimMode,
     thinking: overrides.thinking,
     thinkingBudget: overrides.thinkingBudget,