chainlesschain 0.162.174 → 0.162.176

package/src/lib/session-telemetry-middleware.js

@@ -0,0 +1,6 @@
+/**
+ * Session telemetry middleware stub
+ */
+export function registerSessionTelemetryMiddleware(program) {
+  // No-op stub for tests
+}

package/src/lib/settings-hook-events.cjs

@@ -21,6 +21,26 @@ const { runHooks } = require("./hook-runner.cjs");
 const { buildHookEnvelope } = require("./hook-event-bus.cjs");
 const hookEventLog = require("./hook-event-log.cjs");
 
+/**
+ * Publish lifecycle events to Hooks v2 without making the legacy settings hook
+ * path depend on the ESM runtime. Payloads are deliberately reduced before
+ * publication: prompt text and file contents must never become durable hook
+ * context merely because a lifecycle producer fired.
+ */
+function publishHooksV2Event(event, payload = {}) {
+  const safe = { ...payload };
+  delete safe.prompt;
+  delete safe.content;
+  delete safe.files;
+  void import("./hooks-v2-producers.js")
+    .then(({ emitHooksV2Event }) => {
+      emitHooksV2Event(event, safe);
+    })
+    .catch(() => {
+      // Optional producer bridge; legacy settings hooks remain authoritative.
+    });
+}
+
 /**
  * Stamp a unified-bus delivery id (event_id) onto a hook payload (P2 event bus).
  * Additive — a hook that ignores it is unaffected; a hook that reads it gets a
@@ -104,6 +124,10 @@ function runUserPromptSubmitHooks(
   settingsHooks,
   { prompt, cwd, sessionId } = {},
 ) {
+  publishHooksV2Event("UserPromptSubmit", {
+    cwd: cwd || null,
+    session_id: sessionId || null,
+  });
   if (!settingsHooks) return { blocked: false, additionalContext: null };
   const matched = collectHooks(settingsHooks, "UserPromptSubmit", "");
   if (matched.length === 0) return { blocked: false, additionalContext: null };
@@ -159,7 +183,7 @@ function dispatchAsyncHooks(settingsHooks, event, payload = {}, opts = {}) {
   return supervisor.dispatch(
     asyncHooks,
     { hook_event_name: event, cwd: opts.cwd, ...payload },
-    { cwd: opts.cwd },
+    { cwd: opts.cwd, broker: opts.broker },
   );
 }
 
@@ -169,6 +193,11 @@ function dispatchAsyncHooks(settingsHooks, event, payload = {}, opts = {}) {
  * @returns {{ additionalContext:string|null }}
  */
 function runSessionStartHooks(settingsHooks, { source, cwd, sessionId } = {}) {
+  publishHooksV2Event("SessionStart", {
+    source: source || "startup",
+    cwd: cwd || null,
+    session_id: sessionId || null,
+  });
   if (!settingsHooks) return { additionalContext: null };
   const matched = collectHooks(settingsHooks, "SessionStart", source || "");
   if (matched.length === 0) return { additionalContext: null };
@@ -199,6 +228,11 @@ function runCwdChangedHooks(
   settingsHooks,
   { oldCwd, newCwd, cwd, sessionId } = {},
 ) {
+  publishHooksV2Event("CwdChanged", {
+    old_cwd: oldCwd || null,
+    cwd: newCwd || cwd || null,
+    session_id: sessionId || null,
+  });
   if (!settingsHooks) return { additionalContext: null };
   const matched = collectHooks(settingsHooks, "CwdChanged", newCwd || "");
   const { sync } = partitionAsyncHooks(matched);
@@ -234,6 +268,13 @@ function runWorktreeCreateHooks(
   settingsHooks,
   { worktreePath, branch, baseSha, cwd, sessionId } = {},
 ) {
+  publishHooksV2Event("WorktreeCreate", {
+    worktree_path: worktreePath || null,
+    branch: branch || null,
+    base_sha: baseSha || null,
+    cwd: cwd || worktreePath || null,
+    session_id: sessionId || null,
+  });
   if (!settingsHooks) return { additionalContext: null };
   const matched = collectHooks(settingsHooks, "WorktreeCreate", branch || "");
   const { sync } = partitionAsyncHooks(matched);
@@ -271,6 +312,14 @@ function runWorktreeRemoveHooks(
   settingsHooks,
   { worktreePath, branch, removed, reason, cwd, sessionId } = {},
 ) {
+  publishHooksV2Event("WorktreeRemove", {
+    worktree_path: worktreePath || null,
+    branch: branch || null,
+    removed: removed === true,
+    reason: reason || null,
+    cwd: cwd || worktreePath || null,
+    session_id: sessionId || null,
+  });
   if (!settingsHooks) return { additionalContext: null };
   const matched = collectHooks(settingsHooks, "WorktreeRemove", branch || "");
   const { sync } = partitionAsyncHooks(matched);
@@ -312,6 +361,11 @@ function runInstructionsLoadedHooks(
   settingsHooks,
   { files, cwd, sessionId } = {},
 ) {
+  publishHooksV2Event("InstructionsLoaded", {
+    count: Array.isArray(files) ? files.length : 0,
+    cwd: cwd || null,
+    session_id: sessionId || null,
+  });
   if (!settingsHooks) return { additionalContext: null };
   const matched = collectHooks(settingsHooks, "InstructionsLoaded", "");
   const { sync } = partitionAsyncHooks(matched);
@@ -353,6 +407,12 @@ function runObserveHooks(
   payload = {},
   { cwd, matchTarget, traceId, parentId } = {},
 ) {
+  publishHooksV2Event(event, {
+    ...payload,
+    cwd: cwd || payload.cwd || null,
+    trace_id: traceId || payload.trace_id || null,
+    parent_id: parentId || payload.parent_id || null,
+  });
   if (!settingsHooks) return { decision: "continue", results: [] };
   const matched = collectHooks(settingsHooks, event, matchTarget || "");
   const { sync } = partitionAsyncHooks(matched);

package/src/lib/settings-hooks.cjs

@@ -252,6 +252,10 @@ function collectHooks(hooksBlock, event, toolName) {
           event,
           async: h.async === true,
           asyncRewake: h.asyncRewake === true,
+          origin: h.origin || "hook",
+          pluginId: h.pluginId || null,
+          pluginVersion: h.pluginVersion || null,
+          pluginSource: h.pluginSource || null,
         });
     }
   }

package/src/lib/side-effect-ledger.js

@@ -56,6 +56,8 @@ const KIND_IDEMPOTENT = new Map([
   ["network-mutation", false],
   ["payment", false],
   ["file-write", false],
+  ["file-delete", false],
+  ["file-move", false],
   ["file-write-checkpointed", true],
   ["read", true],
   ["compute", true],
@@ -99,6 +101,18 @@ export function classifyToolSideEffect(toolName, args = {}) {
         kind: "file-write",
         key: shortKey(a.path || a.file || a.notebook_path),
       };
+    case "delete_file":
+      return {
+        kind: "file-delete",
+        key: shortKey(a.path || a.file),
+      };
+    case "move_file":
+      return {
+        kind: "file-move",
+        key: shortKey(
+          `${a.path || a.file || ""} -> ${a.target_path || a.targetPath || ""}`,
+        ),
+      };
     case "edit_file_hashed":
       // Hash-guarded: re-applying over an already-changed tree fails safely, so
       // a replay cannot silently double-apply — idempotent-by-construction.
@@ -201,6 +215,14 @@ export class SideEffectLedger {
     ]);
   }
 
+  /** Merge bounded correlation metadata discovered after an effect started. */
+  annotate(opId, metadata = {}) {
+    const rec = this._rec(opId);
+    if (!rec || !metadata || typeof metadata !== "object") return this;
+    rec.meta = { ...rec.meta, ...metadata };
+    return this;
+  }
+
   /** Confirm the effect applied. Only from `started`. */
   commit(opId) {
     return this._advance(

package/src/lib/sub-agent-context.js

@@ -83,6 +83,10 @@ export class SubAgentContext {
     // nested spawns (threaded into the loop options so a nested spawn_sub_agent
     // reads it as ctx.subAgentContract).
     this.subAgentContract = options.subAgentContract || null;
+    // Optional session-level Extension Tier admission policy. Keep it as an
+    // explicit inherited capability so child loops cannot silently bypass the
+    // parent's admission decision.
+    this.toolAdmission = options.toolAdmission || null;
     // Skill capability INTERSECT: null = unrestricted; a list (possibly empty)
     // restricts run_skill/list_skills in this context's loop to those skills.
     this.skillAllowlist =
@@ -335,6 +339,7 @@ export class SubAgentContext {
       subAgentBudget: this.subAgentBudget,
       // This context's effective contract = the ceiling for its nested spawns.
       subAgentContract: this.subAgentContract,
+      toolAdmission: this.toolAdmission,
       // Skill allow-list restricting run_skill/list_skills in this loop.
       skillAllowlist: this.skillAllowlist,
       // Parent trace for hook envelopes (absent → key omitted, no parent_id).

package/src/lib/sub-agent-profiles.js

@@ -30,6 +30,8 @@ const FULL_TOOLS = Object.freeze([
   "write_file",
   "edit_file",
   "edit_file_hashed",
+  "delete_file",
+  "move_file",
   "list_dir",
   "search_files",
   "search_sessions",
@@ -49,6 +51,8 @@ const DESIGN_TOOLS = Object.freeze([
   "write_file",
   "edit_file",
   "edit_file_hashed",
+  "delete_file",
+  "move_file",
   "list_dir",
   "search_files",
   "web_fetch",

package/src/lib/trace-api.js

@@ -0,0 +1,6 @@
+/**
+ * Trace API stub
+ */
+export function recordTrace(name, data) {
+  // No-op stub for tests
+}

package/src/lib/turn-context.js

@@ -11,21 +11,23 @@
  * @module turn-context
  */
 
-import { execSync } from "child_process";
 import path from "path";
+import { executionBroker } from "./process-execution-broker/index.js";
 
-const _deps = { execSync };
+const _deps = {
+  execFileSync: (...args) => executionBroker.execFileSync(...args),
+};
 
 /**
  * Run a git command with stdio pipe and return stdout or null.
- * @param {string} cmd
+ * @param {string[]} args
  * @param {string} cwd
  * @returns {string|null}
  */
-function _git(cmd, cwd) {
+function _git(args, cwd) {
   try {
     return _deps
-      .execSync(`git ${cmd}`, {
+      .execFileSync("git", args, {
         cwd,
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "ignore"],
@@ -33,6 +35,10 @@ function _git(cmd, cwd) {
         // `status --porcelain` on a dirty repo with many files can exceed the
         // 1 MB execSync default → ENOBUFS → null → "(clean)" misreport below.
         maxBuffer: 16 * 1024 * 1024,
+        origin: "context:git",
+        policy: "allow",
+        scope: "context",
+        shell: false,
       })
       .trim();
   } catch (_e) {
@@ -60,10 +66,10 @@ export function buildTurnContext({
   lines.push(`## Turn context (iteration ${iteration})`);
   lines.push(`- cwd: ${path.resolve(cwd)}`);
 
-  const branch = _git("rev-parse --abbrev-ref HEAD", cwd);
+  const branch = _git(["rev-parse", "--abbrev-ref", "HEAD"], cwd);
   if (branch) {
-    const head = _git("rev-parse --short HEAD", cwd);
-    const status = _git("status --porcelain", cwd);
+    const head = _git(["rev-parse", "--short", "HEAD"], cwd);
+    const status = _git(["status", "--porcelain"], cwd);
     // Distinguish "command failed" (null — timeout / huge output) from "" (truly
     // clean): the old `status && …` reported a repo as "(clean)" whenever status
     // couldn't be determined, which is a wrong signal to the model.

package/src/lib/unattended-action-policy.js

@@ -121,6 +121,89 @@ export function classifyActionRisk(actionClass) {
   return "conditional"; // push — depends on branch protection
 }
 
+/**
+ * Classify a shell command before it reaches the process broker. This is a
+ * deliberately conservative, token-free classifier: compound commands use
+ * the highest-risk segment and unknown commands remain unknown so an
+ * unattended caller can fail closed.
+ */
+export function classifyShellAction(command) {
+  if (typeof command !== "string" || !command.trim()) return null;
+  const segments = command
+    .split(/&&|\|\||[;\n]|\|/)
+    .map((part) =>
+      part
+        .trim()
+        .replace(/^(?:env\s+)?(?:sudo\s+)?(?:command\s+)?/i, "")
+        .toLowerCase(),
+    )
+    .filter(Boolean);
+  const classifySegment = (segment) => {
+    if (/^git\s+push\b/.test(segment)) return ACTION_CLASS.PUSH;
+    if (/^git\s+(?:merge|rebase|cherry-pick)\b/.test(segment)) {
+      return ACTION_CLASS.MERGE;
+    }
+    if (/^(?:npm|pnpm|yarn|bun)\s+publish\b/.test(segment)) {
+      return ACTION_CLASS.PUBLISH;
+    }
+    if (
+      /^(?:terraform\s+(?:apply|destroy)|pulumi\s+up|kubectl\s+(?:apply|delete|rollout)|helm\s+(?:install|upgrade)|docker\s+push)\b/.test(
+        segment,
+      )
+    ) {
+      return segment.startsWith("docker push")
+        ? ACTION_CLASS.DEPLOY
+        : ACTION_CLASS.INFRA_MUTATION;
+    }
+    if (/\b(?:deploy|rollout)\b/.test(segment)) return ACTION_CLASS.DEPLOY;
+    if (/^(?:git\s+(?:status|diff|log|show|branch)|ls\b|dir\b|pwd\b|cat\b|type\b|rg\b|grep\b|find\b|where\b)/.test(segment)) {
+      return ACTION_CLASS.READ;
+    }
+    if (/^(?:npm|pnpm|yarn|bun)\s+(?:test|run\s+(?:test|lint|build)|install\b)/.test(segment) || /^(?:pytest|vitest|jest|cargo\s+test|go\s+test)\b/.test(segment)) {
+      return ACTION_CLASS.LOCAL_WRITE;
+    }
+    if (/^echo\b/.test(segment) && />/.test(segment)) {
+      return ACTION_CLASS.LOCAL_WRITE;
+    }
+    return null;
+  };
+  const rank = [
+    ACTION_CLASS.READ,
+    ACTION_CLASS.LOCAL_WRITE,
+    ACTION_CLASS.COMMIT,
+    ACTION_CLASS.PUSH,
+    ACTION_CLASS.PUBLISH,
+    ACTION_CLASS.MERGE,
+    ACTION_CLASS.DEPLOY,
+    ACTION_CLASS.INFRA_MUTATION,
+    ACTION_CLASS.EXTERNAL_MESSAGE,
+  ];
+  const classified = segments.map(classifySegment);
+  return classified.reduce((highest, current) => {
+    if (!current) return null;
+    if (!highest) return current;
+    return rank.indexOf(current) > rank.indexOf(highest) ? current : highest;
+  }, null);
+}
+
+/** Apply the unattended policy to a shell command, including protected push targets. */
+export function evaluateUnattendedShellAction(command, params = {}) {
+  const actionClass = classifyShellAction(command);
+  const protectedBranch =
+    params.protectedBranch === true ||
+    /\bgit\s+push\b[^\n]*(?:^|\s)(?:main|master|develop|production)(?:\s|$)/i.test(
+      command || "",
+    );
+  return {
+    actionClass,
+    ...evaluateUnattendedAction({
+    ...params,
+    actionClass,
+    protectedBranch,
+    }),
+  };
+}
+
 /**
  * Decide whether a fired task may perform one action. Fail-closed.
  *

package/src/lib/update-notice.js

@@ -1,39 +1,25 @@
 /**
- * Startup update notice — Claude-Code-style "new version available" line.
- *
- * Zero startup cost by design:
- *  - the CLI entry only does ONE sync cache read (~/.chainlesschain/
- *    update-check.json) and prints a single gray stderr line when the cached
- *    latest version is newer than the running one (TTY only, never pollutes
- *    piped/JSON output);
- *  - when the cache is stale (>24h) it spawns a DETACHED, unref'd child that
- *    refreshes the cache from the npm registry for the NEXT run — the current
- *    invocation never waits on the network. The cache's checkedAt is touched
- *    optimistically before spawning so concurrent invocations don't stampede.
- *
- * Disable with CC_UPDATE_NOTICE=0. `cc update` remains the full interactive
- * checker (GitHub releases + assets); this is just the passive nudge.
+ * Passive startup update notice. Cache reads are synchronous and fail-open;
+ * refreshing the npm metadata is delegated to a detached child process.
  */
-
 import fsDefault from "fs";
 import pathDefault from "path";
 import osDefault from "os";
-import { spawn as spawnDefault } from "child_process";
 import { fileURLToPath } from "url";
 import chalk from "chalk";
 import semver from "semver";
 import { VERSION } from "../constants.js";
 import { readDiskVersion } from "./version-skew.js";
+import { executionBroker } from "./process-execution-broker/index.js";
 
 export const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 export const NPM_LATEST_URL =
   "https://registry.npmjs.org/chainlesschain/latest";
-
 export const _deps = {
   fs: fsDefault,
   path: pathDefault,
   os: osDefault,
-  spawn: spawnDefault,
+  spawn: (...args) => executionBroker.spawn(...args),
 };
 
 export function cachePath(deps = _deps) {
@@ -63,34 +49,19 @@ function writeCache(deps, cache) {
   }
 }
 
-/**
- * Entry-point hook. Cheap and fail-open — never throws, never blocks.
- *
- * @returns {{ printed: boolean, spawned: boolean }}
- */
 export function maybeNotifyUpdate(opts = {}) {
   const deps = { ..._deps, ...(opts.deps || {}) };
   const env = opts.env || process.env;
   const now = opts.now ?? Date.now();
   const isTTY = opts.isTTY ?? Boolean(process.stderr.isTTY);
-  // `running` = the version THIS process loaded at spawn (baked VERSION).
-  // `installed` = the version on disk RIGHT NOW (a fresh package.json read).
-  // They diverge after `npm i -g` runs under a long-lived process: the files
-  // update but the running process keeps the old code. We therefore compare the
-  // INSTALLED version against npm latest (so a stale process never nags
-  // "npm i -g" when disk is already current), and separately flag a
-  // running<installed skew as "restart to apply" (re-installing wouldn't help).
   const running = opts.currentVersion || VERSION;
   const installed = opts.installedVersion ?? readDiskVersion() ?? running;
   const print =
     opts.print || ((line) => process.stderr.write(chalk.gray(line) + "\n"));
-
   const out = { printed: false, spawned: false };
   try {
     if (env.CC_UPDATE_NOTICE === "0") return out;
-
     const cache = readCache(deps);
-
     if (
       isTTY &&
       cache?.latest &&
@@ -98,7 +69,6 @@ export function maybeNotifyUpdate(opts = {}) {
       semver.valid(installed) &&
       semver.gt(cache.latest, installed)
     ) {
-      // A newer release exists on npm → a real upgrade is available.
       print(
         `Update available: chainlesschain ${installed} → ${cache.latest} (npm i -g chainlesschain · CC_UPDATE_NOTICE=0 to hide)`,
       );
@@ -109,19 +79,13 @@ export function maybeNotifyUpdate(opts = {}) {
       semver.valid(running) &&
       semver.gt(installed, running)
     ) {
-      // Already updated on disk, but this process is older → restart to apply.
-      // Re-running `npm i -g` would be a no-op; the fix is to relaunch cc / the
-      // IDE panel so the new code loads.
       print(
         `cc was updated ${running} → ${installed} on disk — restart cc (or reload your IDE panel) to apply (CC_UPDATE_NOTICE=0 to hide)`,
       );
       out.printed = true;
     }
-
     const stale = !cache?.checkedAt || now - cache.checkedAt > CACHE_TTL_MS;
     if (stale) {
-      // Optimistic touch first: parallel `cc` invocations inside the stale
-      // window won't each spawn a refresher.
       writeCache(deps, { ...(cache || {}), checkedAt: now });
       const refresher = deps.path.join(
         deps.path.dirname(fileURLToPath(import.meta.url)),
@@ -131,20 +95,20 @@ export function maybeNotifyUpdate(opts = {}) {
         detached: true,
         stdio: "ignore",
         windowsHide: true,
+        origin: "update:notice-refresh",
+        policy: "allow",
+        scope: "update",
+        shell: false,
       });
       if (child && typeof child.unref === "function") child.unref();
       out.spawned = true;
     }
   } catch {
-    /* fail-open: a broken cache or spawn must never affect the CLI */
+    /* update hints must never affect the CLI */
   }
   return out;
 }
 
-/**
- * One cache refresh (used by the detached child; exported for tests).
- * npm registry only — light, unauthenticated, no GitHub rate-limit risk.
- */
 export async function refreshCacheOnce({
   cacheFile,
   fetchImpl = fetch,

package/src/lib/with-file-lock.js

@@ -26,6 +26,7 @@ export function withFileLock(targetPath, fn, opts = {}) {
     _fs = defaultFs,
     _now = () => Date.now(),
     _sleep = sleepSync,
+    failIfUnavailable = false,
   } = opts;
 
   const lockDir = `${targetPath}.lock`;
@@ -54,6 +55,12 @@ export function withFileLock(targetPath, fn, opts = {}) {
     }
   }
 
+  if (!held && failIfUnavailable) {
+    const error = new Error(`Could not acquire state lock: ${targetPath}`);
+    error.code = "STATE_LOCK_UNAVAILABLE";
+    throw error;
+  }
+
   try {
     return fn({ locked: held });
   } finally {

package/src/lib/ws-server.js

@@ -14,4 +14,5 @@ export {
   ChainlessChainWSServer,
   tokenizeCommand,
   isCommandBlocked,
+  _deps,
 } from "../gateways/ws/ws-server.js";

package/src/repl/agent-repl.js

@@ -77,6 +77,7 @@ import {
   fireUserPromptSubmit,
   fireAssistantResponse,
   fireSessionStop,
+  fireNotification,
 } from "../lib/session-hooks.js";
 import { HookEvents } from "../lib/hook-manager.js";
 import { IterationBudget } from "../lib/iteration-budget.js";
@@ -182,21 +183,46 @@ function persistRecentDenial(record, options = {}) {
  * user's attention (e.g. waiting on a permission/risk confirmation). A hook can
  * ring a bell / send a desktop notification. Best-effort, never blocks.
  */
-async function _fireNotification(message) {
-  if (!_settingsHooks) return;
-  try {
-    const { runObserveHooks } = await import("../lib/settings-hook-events.cjs");
-    runObserveHooks(
-      _settingsHooks,
-      "Notification",
-      { message, cwd: process.cwd(), session_id: null },
-      { cwd: process.cwd() },
-    );
-  } catch (_err) {
-    // observe-only — never affect the prompt
+async function _fireNotification(message, type = "info") {
+  // Fire settings.json observe hooks first (best-effort)
+  if (_settingsHooks) {
+    try {
+      const { runObserveHooks } =
+        await import("../lib/settings-hook-events.cjs");
+      runObserveHooks(
+        _settingsHooks,
+        "Notification",
+        {
+          message,
+          type,
+          cwd: process.cwd(),
+          session_id: _session?.sessionId || null,
+        },
+        { cwd: process.cwd() },
+      );
+    } catch (_err) {
+      // observe-only — never affect the prompt
+    }
   }
+  // Fire database-registered Notification hooks (interceptable/suppressible)
+  if (_session) {
+    try {
+      const result = await fireNotification(_hookDb, message, {
+        session: _session,
+        type,
+      });
+      if (result?.directive?.suppress) {
+        return { suppress: true };
+      }
+      if (result?.directive?.message) {
+        return { message: result.directive.message };
+      }
+    } catch (_err) {
+      // ignore hook errors
+    }
+  }
+  return { message };
 }
-
 /**
  * "Always allow" persistence: derive a sensible allow rule for a tool call,
  * append it to .claude/settings.local.json (personal, gitignored), and reflect
@@ -1736,6 +1762,38 @@ export async function startAgentRepl(options = {}) {
   // "close" cleanup instead of a bare exit.
   _replRl = rl;
 
+  // MCP elicitation in the interactive REPL uses the same readline surface as
+  // approvals, while MCPClient retains the protocol-level response shape.
+  const mcpElicitationClients = [
+    _adhocMcp?.mcpClient,
+    _bundleMcpClient,
+  ].filter((client) => client?.setElicitationHandler);
+  for (const client of mcpElicitationClients) {
+    client.setElicitationHandler(
+      (request) =>
+        new Promise((resolve) => {
+          const label = request.message || "MCP server requests additional input";
+          rl.question(chalk.yellow(`\n  MCP [${request.server}] ${label}\n  > `), (answer) => {
+            const trimmed = String(answer || "").trim();
+            if (!trimmed) {
+              resolve({ action: "cancel" });
+            } else {
+              let content = { value: trimmed };
+              try {
+                const parsed = JSON.parse(trimmed);
+                if (parsed && typeof parsed === "object") content = parsed;
+              } catch {
+                // Plain text remains a valid single-field elicitation answer.
+              }
+              resolve({ action: "accept", content });
+            }
+            rl.prompt();
+          });
+        }),
+      { timeoutMs: options.mcpElicitationTimeoutMs },
+    );
+  }
+
   // Inbound channels (--channels, gap-2026-07-11 P0#5): external events enter
   // this session as user turns. rl.emit("line") reuses the REPL's own input
   // path, so an event landing mid-turn queues behind it (pending-lines), and

package/src/repl/clipboard-copy.js

@@ -4,7 +4,7 @@
  * spawn wrapper. The pure parts are unit-tested; real clipboard I/O is
  * environment-dependent and exercised through an injected spawnSync.
  */
-import { spawnSync as _spawnSync } from "node:child_process";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
 
 /** Flatten a message's content (string | content-parts[]) to plain text. Pure. */
 export function messageText(content) {
@@ -78,7 +78,9 @@ export function clipboardCommands(platform = process.platform) {
   ];
 }
 
-const _deps = { spawnSync: _spawnSync };
+const _deps = {
+  spawnSync: (...args) => executionBroker.spawnSync(...args),
+};
 
 /**
  * Write text to the system clipboard, trying each platform candidate in order
@@ -96,6 +98,10 @@ export function copyToClipboard(text, { platform, spawnSync } = {}) {
         input: text,
         encoding: "utf-8",
         windowsHide: true,
+        origin: "repl:clipboard-copy",
+        policy: "allow",
+        scope: "clipboard",
+        shell: false,
       });
     } catch (e) {
       lastErr = e.message;