chainlesschain 0.162.169 → 0.162.171

package/src/lib/background-agent-supervisor.js

@@ -6,16 +6,21 @@ import {
   openSync,
   readFileSync,
   readdirSync,
+  realpathSync,
   renameSync,
   rmSync,
   statSync,
   writeFileSync,
 } from "node:fs";
 import { randomBytes } from "node:crypto";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { getHomeDir } from "./paths.js";
 import { deriveSessionState } from "./session-lifecycle.js";
+import {
+  finishAgentWorktree,
+  validateAgentWorktree,
+} from "./agent-worktree.js";
 
 export const DEFAULT_HEARTBEAT_INTERVAL_MS = 5000;
 export const DEFAULT_HEARTBEAT_STALE_MS = 120000;
@@ -135,19 +140,28 @@ function defaultReadProcessStartTimeMs(pid) {
 function defaultKillProcessTree(pid, signal = "SIGKILL") {
   const target = Number(pid);
   if (!Number.isInteger(target) || target <= 0) return false;
+  // Never signal ourselves: no legitimate background-agent record can point at
+  // the process performing the reclaim, so a matching pid is a corrupt/stale
+  // record — killing it would take down the caller (a `cc` CLI process, or a
+  // vitest worker when a test drives this path with a live-looking fixture).
+  if (target === process.pid) return false;
   try {
     if (process.platform === "win32") {
-      const r = spawnSync("taskkill", ["/PID", String(target), "/T", "/F"], {
-        windowsHide: true,
-        encoding: "utf8",
-      });
+      const r = _deps.spawnSync(
+        "taskkill",
+        ["/PID", String(target), "/T", "/F"],
+        {
+          windowsHide: true,
+          encoding: "utf8",
+        },
+      );
       return !r.error && r.status === 0;
     }
     try {
-      process.kill(-target, signal);
+      _deps.kill(-target, signal);
       return true;
     } catch {
-      process.kill(target, signal);
+      _deps.kill(target, signal);
       return true;
     }
   } catch {
@@ -158,6 +172,12 @@ function defaultKillProcessTree(pid, signal = "SIGKILL") {
 export const _deps = {
   spawn,
   spawnSync,
+  // Single POSIX signal seam: every kill this module issues goes through here
+  // so tests can stub it — a bare `process.kill` is NOT interceptable and a
+  // fixture recording a live pid would eat a REAL signal (the shard-2/4
+  // "worker-death" CI flake: a stop-flow test recorded pid=process.pid and
+  // SIGTERMed its own vitest worker).
+  kill: (pid, signal) => process.kill(pid, signal),
   readProcessStartTimeMs: defaultReadProcessStartTimeMs,
   killProcessTree: defaultKillProcessTree,
 };
@@ -265,6 +285,20 @@ export function writeBackgroundAgentState(state) {
     if (Number(current.pinnedAt || 0) > Number(next.pinnedAt || 0)) {
       next = { ...next, pinned: current.pinned, pinnedAt: current.pinnedAt };
     }
+    // A background worktree is immutable session identity, just like the
+    // conversation id. Heartbeat/finalize/rename writers may race with a stale
+    // snapshot, but no same-id transition is allowed to move the run back to
+    // the main checkout or drop the cleanup metadata.
+    if (current.worktreePath) {
+      next = {
+        ...next,
+        cwd: current.worktreePath,
+        repoRoot: current.repoRoot,
+        worktreePath: current.worktreePath,
+        baseSha: current.baseSha,
+        branch: current.branch,
+      };
+    }
   }
   const tmp = `${target}.${process.pid}.tmp`;
   writeFileSync(tmp, JSON.stringify(next, null, 2), { mode: 0o600 });
@@ -485,7 +519,7 @@ export function renameBackgroundAgent(id, title, options = {}) {
  * conversation session is NOT touched — that's `cc session delete`.
  */
 export function removeBackgroundAgent(id, options = {}) {
-  const state = effectiveBackgroundAgentState(readBackgroundAgentState(id), {
+  let state = effectiveBackgroundAgentState(readBackgroundAgentState(id), {
     now: options.now,
     heartbeatStaleMs: options.heartbeatStaleMs,
   });
@@ -498,15 +532,28 @@ export function removeBackgroundAgent(id, options = {}) {
     }
     try {
       stopBackgroundAgent(id);
+      state =
+        effectiveBackgroundAgentState(readBackgroundAgentState(id), {
+          now: options.now,
+          heartbeatStaleMs: options.heartbeatStaleMs,
+        }) || state;
     } catch {
       /* best-effort — the record removal below is the point of rm --force */
     }
   }
+  const worktree = cleanupBackgroundAgentWorktree(state, {
+    keepWorktree: options.keepWorktree === true,
+  });
   rmSync(statePath(id), { force: true });
   if (options.keepLog !== true) {
     rmSync(logPath(id), { force: true });
   }
-  return { id, removed: true, status: state.status };
+  return {
+    id,
+    removed: true,
+    status: state.status,
+    ...(worktree ? { worktree } : {}),
+  };
 }
 
 /**
@@ -583,6 +630,68 @@ export function buildFollowUpArgv(argv, opts = {}) {
   return out;
 }
 
+function canonicalPath(value) {
+  const absolute = resolve(String(value || ""));
+  try {
+    const real = realpathSync.native
+      ? realpathSync.native(absolute)
+      : realpathSync(absolute);
+    return process.platform === "win32" ? real.toLowerCase() : real;
+  } catch {
+    return process.platform === "win32" ? absolute.toLowerCase() : absolute;
+  }
+}
+
+/**
+ * Normalize and verify worktree metadata before it enters a background job.
+ * The metadata is persisted as top-level state fields for compatibility with
+ * status/IDE consumers: repoRoot/worktreePath/baseSha/branch.
+ */
+export function normalizeBackgroundWorktree(worktree, cwd) {
+  if (!worktree) return null;
+  const normalized = {
+    repoRoot: resolve(String(worktree.repoRoot || "")),
+    worktreePath: resolve(String(worktree.worktreePath || worktree.path || "")),
+    baseSha: String(worktree.baseSha || ""),
+    branch: String(worktree.branch || ""),
+  };
+  if (
+    !normalized.repoRoot ||
+    !normalized.worktreePath ||
+    !normalized.baseSha ||
+    !normalized.branch
+  ) {
+    throw new Error(
+      "Cannot launch background agent: incomplete worktree metadata",
+    );
+  }
+  if (canonicalPath(cwd) !== canonicalPath(normalized.worktreePath)) {
+    throw new Error(
+      "Cannot launch background agent: cwd does not match the persisted worktree path",
+    );
+  }
+  const validation = validateAgentWorktree({
+    ...normalized,
+    path: normalized.worktreePath,
+  });
+  if (!validation.valid) {
+    throw new Error(
+      `Cannot launch background agent: worktree metadata is not usable (${validation.reason})`,
+    );
+  }
+  return normalized;
+}
+
+function persistedWorktree(state) {
+  if (!state?.worktreePath) return null;
+  return {
+    repoRoot: state.repoRoot,
+    worktreePath: state.worktreePath,
+    baseSha: state.baseSha,
+    branch: state.branch,
+  };
+}
+
 /**
  * Continue a finished/crashed background session as a NEW background session
  * on the same conversation (`cc daemon resume <id> <prompt>`). The original
@@ -607,14 +716,27 @@ export function resumeBackgroundAgent(id, prompt, options = {}) {
   }
   const text = String(prompt || "").trim();
   if (!text) throw new Error("resume requires a prompt");
+  const worktree = persistedWorktree(state);
+  if (
+    worktree &&
+    options.cwd &&
+    canonicalPath(options.cwd) !== canonicalPath(worktree.worktreePath)
+  ) {
+    throw new Error(
+      `Background agent ${id} is bound to worktree "${worktree.worktreePath}" and cannot resume in a different cwd`,
+    );
+  }
   const argv = ["agent", "--session", state.sessionId, "-p", text];
   return launchBackgroundAgent({
     argv,
-    cwd: options.cwd || state.cwd || process.cwd(),
+    // Worktree sessions fail closed: never fall back to process.cwd(), which
+    // could silently resume a write task in the main checkout.
+    cwd: worktree?.worktreePath || options.cwd || state.cwd || process.cwd(),
     sessionId: state.sessionId,
     title: options.title || state.title || text.slice(0, 100),
     cliEntry: options.cliEntry,
     followUpArgv: ["agent", "--session", state.sessionId],
+    worktree,
   });
 }
 
@@ -652,8 +774,10 @@ export function launchBackgroundAgent({
   title,
   cliEntry,
   followUpArgv,
+  worktree,
 }) {
   assertUsableCwd(cwd);
+  const worktreeState = normalizeBackgroundWorktree(worktree, cwd);
   const id = createBackgroundAgentId();
   const dir = backgroundAgentsDir();
   const jobFile = join(dir, `${id}.job.${process.pid}.json`);
@@ -668,6 +792,7 @@ export function launchBackgroundAgent({
     title: title || "Background agent",
     cliEntry: cliEntry || process.argv[1],
     logFile: logPath(id),
+    ...(worktreeState || {}),
     // Present = interactive attach can start follow-up turns; absent = the
     // transport rejects prompts (log-only session).
     ...(Array.isArray(followUpArgv) ? { followUpArgv } : {}),
@@ -691,6 +816,7 @@ export function launchBackgroundAgent({
     endedAt: null,
     exitCode: null,
     logFile: job.logFile,
+    ...(worktreeState || {}),
   };
   writeBackgroundAgentState(state);
   let child;
@@ -763,6 +889,21 @@ export function stopBackgroundAgent(id) {
     }
     return { ...state, stopped: false };
   }
+  // Self-pid guard: a worker record whose pid is the CURRENT process is
+  // impossible in legitimate operation (the stopper is never the worker) —
+  // it means a corrupt/hand-edited state file. Signalling it would SIGTERM /
+  // taskkill-tree the very process (and shell tree) running `cc daemon stop`.
+  // Treat as lost, kill nothing.
+  if (Number(state.pid) === process.pid) {
+    const lost = {
+      ...state,
+      status: "lost",
+      endedAt: Date.now(),
+      lostReason: "self-pid-corrupt-record",
+    };
+    writeBackgroundAgentState(lost);
+    return { ...lost, stopped: false };
+  }
   // Gap 1: last-instant identity re-check before the kill — never
   // taskkill/SIGTERM a pid the OS has re-assigned to an unrelated process.
   if (!isSameProcess(state.pid, state.startedAt)) {
@@ -796,9 +937,9 @@ export function stopBackgroundAgent(id) {
     }
   } else {
     try {
-      process.kill(-Number(state.pid), "SIGTERM");
+      _deps.kill(-Number(state.pid), "SIGTERM");
     } catch {
-      process.kill(Number(state.pid), "SIGTERM");
+      _deps.kill(Number(state.pid), "SIGTERM");
     }
     // The worker detaches the agent child into its OWN process group (so a
     // crashed worker's child can be group-killed) — which also means the
@@ -810,15 +951,16 @@ export function stopBackgroundAgent(id) {
       Number.isInteger(agentPid) &&
       agentPid > 0 &&
       agentPid !== Number(state.pid) &&
+      agentPid !== process.pid &&
       Number.isFinite(anchor) &&
       anchor > 0 &&
       isSameProcess(agentPid, anchor)
     ) {
       try {
-        process.kill(-agentPid, "SIGTERM");
+        _deps.kill(-agentPid, "SIGTERM");
       } catch {
         try {
-          process.kill(agentPid, "SIGTERM");
+          _deps.kill(agentPid, "SIGTERM");
         } catch {
           /* already gone */
         }
@@ -835,6 +977,84 @@ export function stopBackgroundAgent(id) {
   return { ...next, stopped: true };
 }
 
+function activeWorktreeProcesses(state) {
+  const active = [];
+  if (
+    Number.isInteger(Number(state?.pid)) &&
+    Number(state.pid) > 0 &&
+    isSameProcess(state.pid, state.startedAt)
+  ) {
+    active.push("worker");
+  }
+  if (
+    Number.isInteger(Number(state?.agentPid)) &&
+    Number(state.agentPid) > 0 &&
+    isSameProcess(state.agentPid, state.agentStartedAt)
+  ) {
+    active.push("agent");
+  }
+  return active;
+}
+
+/**
+ * Explicit background-record cleanup owns the worktree teardown. Normal
+ * completion, kill, lost-worker reconciliation, attach and resume all retain
+ * it so a later resume continues in the exact same isolated checkout.
+ */
+export function cleanupBackgroundAgentWorktree(state, options = {}) {
+  const worktree = persistedWorktree(state);
+  if (!worktree) return null;
+  if (options.keepWorktree === true) {
+    return {
+      removed: false,
+      kept: true,
+      reason: "kept by explicit request",
+      path: worktree.worktreePath,
+    };
+  }
+
+  const blockers = [];
+  const active = activeWorktreeProcesses(state);
+  if (active.length) blockers.push(`active ${active.join("+")} process`);
+  if (Number(state?.pendingApprovals || 0) > 0) {
+    blockers.push("pending approval");
+  }
+  if (state?.pendingQuestion) blockers.push("pending user input");
+  if (
+    Number(state?.uncertainSideEffects || 0) > 0 ||
+    state?.phase === "uncertain_side_effect" ||
+    state?.phase === "uncertain-side-effect"
+  ) {
+    blockers.push("unfinished or uncertain side effect");
+  }
+  if (blockers.length) {
+    throw new Error(
+      `Refusing to clean background worktree "${worktree.worktreePath}": ${blockers.join(", ")}`,
+    );
+  }
+
+  if (!existsSync(worktree.worktreePath)) {
+    return {
+      removed: false,
+      kept: false,
+      reason: "worktree path already missing",
+      path: worktree.worktreePath,
+    };
+  }
+
+  const result = finishAgentWorktree({
+    ...worktree,
+    path: worktree.worktreePath,
+  });
+  if (!result.removed) {
+    throw new Error(
+      `Refusing to remove background agent record while its worktree is kept (${result.reason}). ` +
+        "Resolve or preserve the work first, or pass --keep-worktree to remove only the record.",
+    );
+  }
+  return { ...result, path: worktree.worktreePath };
+}
+
 export function openBackgroundLogFile(id) {
   const fd = openSync(logPath(id), "a", 0o600);
   return { fd, close: () => closeSync(fd) };

package/src/lib/interaction-adapter.js

@@ -187,7 +187,7 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
     });
   }
 
-  _ask(questionType, question, extra = {}) {
+  _ask(questionType, question, extra = {}, options = {}) {
     return this._request(
       {
         type: "question",
@@ -195,7 +195,12 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
         question,
         ...extra,
       },
-      { kind: "question" },
+      {
+        kind: "question",
+        // Approval binding pass-through: a permission-gate producer supplies
+        // it; plain questions never carry one (message stays byte-identical).
+        ...(options.binding ? { binding: options.binding } : {}),
+      },
     );
   }
 
@@ -207,10 +212,26 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
     return this._ask("select", question, { choices });
   }
 
+  /**
+   * @param {string} question
+   * @param {boolean|object} [defaultVal] — boolean (legacy, byte-identical) or
+   *   an options object `{ default, binding, ...extra }`: `binding` rides out
+   *   on the request so the client must echo it back on approve (verified in
+   *   _resolvePending, mismatched approve → deny); any other keys merge into
+   *   the question message (e.g. structured `approval` context for UIs).
+   */
   async askConfirm(question, defaultVal = true) {
-    const answer = await this._ask("confirm", question, {
-      default: defaultVal,
-    });
+    const opts =
+      defaultVal !== null && typeof defaultVal === "object"
+        ? defaultVal
+        : { default: defaultVal };
+    const { binding = null, default: dflt = true, ...extra } = opts;
+    const answer = await this._ask(
+      "confirm",
+      question,
+      { default: dflt, ...extra },
+      binding ? { binding } : {},
+    );
     // Normalize to boolean
     if (typeof answer === "boolean") return answer;
     return answer === "true" || answer === "yes" || answer === "y";

package/src/lib/packer/smoke-runner.js

@@ -111,6 +111,11 @@ export async function smokeTestExe(ctx) {
         // child.kill on Windows doesn't traverse the process tree; taskkill
         // does. We spawned a single exe with no subprocesses so plain kill
         // is enough in practice, but /T protects us if that ever changes.
+        // Skip when the child has ALREADY exited: Windows recycles pids
+        // within seconds, so taskkilling a dead child's pid can murder an
+        // unrelated process tree that inherited the number (on CI: another
+        // vitest worker or a test's helper child).
+        if (child.exitCode !== null || child.signalCode !== null) return;
         spawn("taskkill", ["/F", "/T", "/PID", String(child.pid)], {
           stdio: "ignore",
         }).unref();

package/src/lib/repl-rewind.js

@@ -232,18 +232,48 @@ export function restoreClearedConversation(messages, marks, cleared) {
 }
 
 /**
- * Coverage-aware restore plan for a rewound turn, derived from the REPL's
- * EXISTING implicit state (`listUserTurns()` output + `{atMessageCount,id,tool}`
- * marks) — no new agent-loop events required. Bridges those into the explicit
- * turn-binding table and asks `resolveRestorePlan` for the honest plan, so
- * `/rewind` can warn when a restore can't be fully promised (side-effects, a
- * missing checkpoint, or a conversation/files drift) instead of silently doing a
- * lossy rewind.
+ * Match a live-conversation turn to its record in a PERSISTED explicit
+ * turn-binding table (`loadTurnBindingLog(sessionId)` — produced by headless
+ * runs of the same session, which anchor each turn at
+ * `conversationOffset = messages.length` measured just AFTER that turn's user
+ * message was appended). So the record for the user message at live index
+ * `turnIndex` is the one with `conversationOffset === turnIndex + 1`. Exact
+ * match only — anything else falls back to the marks-derived table rather than
+ * guessing (the offsets align because both runs rebuild the same persisted
+ * message sequence under a single leading system prompt).
+ *
+ * @param {import("./turn-binding.js").TurnBindingLog|null} persistedLog
+ * @param {number} turnIndex  message index of the target user turn
+ * @returns {object|null}  a turn view (with computed coverage), or null
+ */
+export function pickPersistedTurn(persistedLog, turnIndex) {
+  if (!persistedLog || typeof persistedLog.list !== "function") return null;
+  const want = Number(turnIndex) + 1;
+  if (!Number.isFinite(want)) return null;
+  for (const t of persistedLog.list()) {
+    if (Number(t.conversationOffset) === want) return t;
+  }
+  return null;
+}
+
+/**
+ * Coverage-aware restore plan for a rewound turn. Prefers the PERSISTED
+ * explicit turn-binding table when the session has one for the target turn
+ * (cross-process honesty: a `--resume`d session's pre-resume turns have NO
+ * process-local marks, but their headless run persisted checkpoint ids, shell/
+ * side-effect flags and child agents — the explicit table answers where marks
+ * cannot). Falls back to the REPL's implicit state (`listUserTurns()` output +
+ * `{atMessageCount,id,tool}` marks) bridged into the same table shape. Either
+ * way `resolveRestorePlan` produces the honest plan, so `/rewind` can warn
+ * when a restore can't be fully promised (side-effects, a missing checkpoint,
+ * or a conversation/files drift) instead of silently doing a lossy rewind.
  *
  * @param {Array} messages  live conversation (for listUserTurns)
  * @param {Array<{atMessageCount:number,id:string,tool?:string}>} marks
  * @param {number} turnIndex  message index returned by rewindToTurn()
  * @param {string} [scope]  one of RESTORE_SCOPE (default BOTH)
+ * @param {{persistedLog?:object|null}} [opts]  explicit table from
+ *        `loadTurnBindingLog(sessionId)` (advisory; null → marks only)
  * @returns {{scope, coverage, conversation, files, warnings:string[]}}
  */
 export function buildRewindPlan(
@@ -251,7 +281,10 @@ export function buildRewindPlan(
   marks,
   turnIndex,
   scope = RESTORE_SCOPE.BOTH,
+  { persistedLog = null } = {},
 ) {
+  const persisted = pickPersistedTurn(persistedLog, turnIndex);
+  if (persisted) return resolveRestorePlan(persisted, scope);
   const turns = listUserTurns(messages, { limit: 1000 });
   const log = buildTurnBindingFromMarks(turns, marks);
   const turn = log.get(`turn-${Number(turnIndex)}`);
@@ -288,18 +321,29 @@ export function renderRewindWarnings(plan) {
  * @param {Array} messages  live conversation (for listUserTurns)
  * @param {Array<{atMessageCount:number,id:string,tool?:string}>} marks
  * @param {number} turnIndex  message index of the branch-point user turn
- * @param {{parentSessionId?:string, seq?:number, writeIntent?:boolean}} [opts]
+ * @param {{parentSessionId?:string, seq?:number, writeIntent?:boolean,
+ *          persistedLog?:object|null}} [opts]  persistedLog: explicit table
+ *        from `loadTurnBindingLog(sessionId)`, preferred over marks (same
+ *        cross-process rationale as buildRewindPlan)
  * @returns {object} the plan from planSessionBranch()
  */
 export function buildBranchPlan(
   messages,
   marks,
   turnIndex,
-  { parentSessionId = null, seq = 0, writeIntent = false } = {},
+  {
+    parentSessionId = null,
+    seq = 0,
+    writeIntent = false,
+    persistedLog = null,
+  } = {},
 ) {
-  const turns = listUserTurns(messages, { limit: 1000 });
-  const log = buildTurnBindingFromMarks(turns, marks);
-  const turn = log.get(`turn-${Number(turnIndex)}`);
+  let turn = pickPersistedTurn(persistedLog, turnIndex);
+  if (!turn) {
+    const turns = listUserTurns(messages, { limit: 1000 });
+    const log = buildTurnBindingFromMarks(turns, marks);
+    turn = log.get(`turn-${Number(turnIndex)}`);
+  }
   return planSessionBranch({ parentSessionId, turn, seq, writeIntent });
 }
 
@@ -336,6 +380,7 @@ export function renderBranchPlan(plan) {
  *   /rewind --files 3             → { command: "turn", n: 3, scope: FILES }
  *   /rewind 3 --branch            → { command: "branch", n: 3, writeIntent: false }
  *   /rewind 3 --branch --write    → { command: "branch", n: 3, writeIntent: true }
+ *   /rewind 3 --both --yes        → non-interactive file confirmation (IDE)
  *
  * An unknown flag is ignored (kept forgiving); a non-numeric, flag-less arg with
  * no turn number falls back to `list` so a typo can't silently rewind — and a
@@ -354,6 +399,7 @@ export function parseRewindArg(arg) {
   let scope = RESTORE_SCOPE.BOTH;
   let branch = false;
   let writeIntent = false;
+  let confirmed = false;
   for (const t of tokens) {
     if (t === "--files" || t === "--files-only") scope = RESTORE_SCOPE.FILES;
     else if (
@@ -365,11 +411,13 @@ export function parseRewindArg(arg) {
     else if (t === "--both") scope = RESTORE_SCOPE.BOTH;
     else if (t === "--branch" || t === "--fork") branch = true;
     else if (t === "--write" || t === "--write-intent") writeIntent = true;
+    else if (t === "--yes" || t === "-y") confirmed = true;
     else if (n === null && /^\d+$/.test(t)) n = Number(t);
   }
-  if (branch && n !== null) return { command: "branch", n, scope, writeIntent };
+  if (branch && n !== null)
+    return { command: "branch", n, scope, writeIntent, confirmed };
   if (n === null) return { command: "list", scope };
-  return { command: "turn", n, scope };
+  return { command: "turn", n, scope, confirmed };
 }
 
 /** Render the picker list (shared by /rewind and double-Esc). */