chainlesschain 0.162.176 → 0.162.178

package/src/commands/llm.js

@@ -43,6 +43,7 @@ import {
   autoFailStuckRequestsV2,
   getLlmProvidersStatsV2,
 } from "../lib/llm-providers.js";
+import { formatProviderResponseError } from "../lib/provider-http-error.js";
 
 /**
  * Resolve the effective `cc llm test` target from CLI flags + persisted config.
@@ -58,7 +59,12 @@ import {
  * @param {object} [env]    process.env (for apiKeyEnv lookup)
  * @returns {{provider,model,baseUrl,apiKey,isOllama,label}}
  */
-export function resolveLlmTestTarget(options = {}, config = {}, builtIns = {}, env = {}) {
+export function resolveLlmTestTarget(
+  options = {},
+  config = {},
+  builtIns = {},
+  env = {},
+) {
   const llm = config.llm || {};
   const provider = options.provider || llm.provider || "ollama";
   const isOllama = provider === "ollama";
@@ -73,11 +79,15 @@ export function resolveLlmTestTarget(options = {}, config = {}, builtIns = {}, e
   if (isOllama) {
     // Only inherit config.baseUrl when the CONFIGURED provider is also ollama —
     // otherwise `--provider ollama` would probe another provider's endpoint.
-    const configOllamaBase = llm.provider === "ollama" ? llm.baseUrl : undefined;
+    const configOllamaBase =
+      llm.provider === "ollama" ? llm.baseUrl : undefined;
     baseUrl = options.baseUrl || configOllamaBase || "http://localhost:11434";
   } else {
     baseUrl =
-      options.baseUrl || llm.baseUrl || builtIn?.baseUrl || "https://api.openai.com/v1";
+      options.baseUrl ||
+      llm.baseUrl ||
+      builtIn?.baseUrl ||
+      "https://api.openai.com/v1";
   }
 
   const apiKey = isOllama
@@ -166,7 +176,9 @@ export function registerLlmCommand(program) {
   // probe instead of only special-casing openai.
   llm
     .command("test")
-    .description("Test LLM provider connectivity (defaults to configured provider)")
+    .description(
+      "Test LLM provider connectivity (defaults to configured provider)",
+    )
     .option("--provider <provider>", "LLM provider (default: configured)")
     .option("--model <model>", "Model to test (default: configured)")
     .option("--base-url <url>", "API base URL (default: configured/provider)")
@@ -195,7 +207,9 @@ export function registerLlmCommand(program) {
           });
 
           if (!response.ok) {
-            throw new Error(`HTTP ${response.status}`);
+            throw new Error(
+              await formatProviderResponseError("ollama", response),
+            );
           }
 
           const data = await response.json();
@@ -226,7 +240,9 @@ export function registerLlmCommand(program) {
           });
 
           if (!response.ok) {
-            throw new Error(`HTTP ${response.status}`);
+            throw new Error(
+              await formatProviderResponseError(target.provider, response),
+            );
           }
 
           const data = await response.json();

package/src/commands/loop.js

@@ -23,10 +23,10 @@
  * only builds the concrete iteration (spawn + tee output) and wires SIGINT.
  */
 
-import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import chalk from "chalk";
 import { logger } from "../lib/logger.js";
+import executionBroker from "../lib/process-execution-broker/index.js";
 import {
   runLoop,
   parseDuration,
@@ -42,6 +42,10 @@ import {
   sessionExists,
 } from "../harness/jsonl-session-store.js";
 
+export const _deps = {
+  spawn: executionBroker.spawn.bind(executionBroker),
+};
+
 /**
  * Appended to the prompt under `--dynamic` so the model can self-pace: it ends
  * its reply with at most one control directive the loop parses (parseLoopDirectives).
@@ -66,10 +70,13 @@ const BIN_PATH = fileURLToPath(
  */
 function spawnIteration(cmd, args, { shell, onChild, capture }) {
   return new Promise((resolve) => {
-    const child = spawn(cmd, args, {
+    const child = _deps.spawn(cmd, args, {
       shell,
       stdio: capture ? ["inherit", "pipe", "pipe"] : "inherit",
       env: process.env,
+      origin: "loop:iteration",
+      policy: "allow",
+      scope: "loop",
     });
     if (onChild) onChild(child);
 

package/src/commands/skill.js

@@ -10,6 +10,7 @@ import chalk from "chalk";
 import ora from "ora";
 import fs from "fs";
 import path from "path";
+import { createSkillProcessBroker } from "../lib/skill-process-broker.js";
 import { logger } from "../lib/logger.js";
 import {
   CLISkillLoader,
@@ -326,7 +327,7 @@ export function registerSkillCommand(program) {
     .option("--json", "Output as JSON")
     .action(async (name, inputParts, options) => {
       const skills = loader.loadAll();
-      const s = skills.find((sk) => sk.id === name || sk.dirName === name);
+      let s = skills.find((sk) => sk.id === name || sk.dirName === name);
 
       if (!s) {
         logger.error(`Skill not found: ${name}`);
@@ -345,6 +346,16 @@ export function registerSkillCommand(program) {
         process.exit(1);
       }
 
+      try {
+        s = loader.materializeSkill(s, {
+          loadedBecause: "cli_skill_run",
+          bodyIncluded: false,
+        });
+      } catch (error) {
+        logger.error(`Skill "${s.id}" body could not be loaded: ${error.message}`);
+        process.exit(1);
+      }
+
       const spinner = ora(`Running ${s.displayName}...`).start();
       const input = inputParts.join(" ");
 
@@ -368,6 +379,7 @@ export function registerSkillCommand(program) {
           projectRoot: process.cwd(),
           workspacePath: process.cwd(),
           workspaceRoot: process.cwd(),
+          processBroker: createSkillProcessBroker(s),
         };
 
         const result = await handler.execute(task, context, s);

package/src/commands/statusline.js

@@ -27,12 +27,12 @@ export function registerStatuslineCommand(program) {
     .action(async (options) => {
       try {
         const { loadStatusLineConfig, buildContext, renderStatusLine } =
-          await import("../lib/status-line.cjs");
+          await import("../lib/status-line.js");
         const cfg = loadStatusLineConfig({ cwd: process.cwd() });
         if (!cfg) {
           logger.log(
             chalk.gray(
-              'No statusLine configured. Add to .claude/settings.json:\n' +
+              "No statusLine configured. Add to .claude/settings.json:\n" +
                 '  { "statusLine": { "type": "command", "command": "./status.sh" } }',
             ),
           );
@@ -73,7 +73,7 @@ export function registerStatuslineCommand(program) {
     .option("--json", "Output as JSON")
     .action(async (options) => {
       try {
-        const { loadStatusLineConfig } = await import("../lib/status-line.cjs");
+        const { loadStatusLineConfig } = await import("../lib/status-line.js");
         const cfg = loadStatusLineConfig({ cwd: process.cwd() });
         if (options.json) {
           console.log(JSON.stringify(cfg, null, 2));

package/src/data/changelog.json

@@ -2,8 +2,21 @@
   "source": "CHANGELOG.md",
   "releases": [
     {
-      "productVersion": "Unreleased",
-      "cliVersion": "0.162.170",
+      "productVersion": null,
+      "cliVersion": "0.162.178",
+      "cliVersions": ["0.162.178"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed — cc CLI 0.162.178 + IDE provider 403 diagnosis hotfix",
+          "body": "- Preserve structured provider error codes/messages for failed LLM requests and\n  `cc llm test`, with credential-shaped text redacted before display.\n- Do not classify every HTTP 403 as an invalid API key: overdue accounts,\n  billing failures, and model-access denials now retain their real corrective\n  action in CLI, VS Code, and JetBrains.\n- Release VS Code 0.37.33 and JetBrains 0.4.70 with corrected setup guidance."
+        }
+      ]
+    },
+    {
+      "productVersion": "v5.0.3.135",
+      "cliVersion": "0.162.177",
       "cliVersions": [
         "0.4.46",
         "0.4.51",
@@ -28,11 +41,46 @@
         "0.162.167",
         "0.162.168",
         "0.162.169",
-        "0.162.170"
+        "0.162.170",
+        "0.162.171",
+        "0.162.172",
+        "0.162.173",
+        "0.162.174",
+        "0.162.175",
+        "0.162.176",
+        "0.162.177"
       ],
-      "date": null,
-      "title": "",
+      "date": "2026-07-24",
+      "title": "Python Agent SDK 0.1.0 + CLI/IDE 运行时收口 + 跨端 CI 稳定性",
       "sections": [
+        {
+          "heading": "Fixed — cc CLI 0.162.177：技能生成子进程统一纳入 Process Broker（CLI-only npm 发版）",
+          "body": "> `chainlesschain` 0.162.176 → **0.162.177**（2026-07-23）。本版把 CLI-Anything 与 CLI 技能包生成器的同步子进程执行统一收进宿主 Process Broker，补齐技能执行链路最后一处直接 `child_process` 入口。\n\n- **宿主拥有执行来源**：技能只拿到窄化、冻结的进程 facade；`origin`、`scope`、插件 id/version/source 等来源元数据由宿主写入，处理器不能伪造或绕过。\n- **CLI-Anything 无 shell 执行**：生成的 handler 把输入解析成字面 argv，经 `runFileSync(..., shell:false)` 执行；保留危险字符与未闭合引号拒绝，缺少 Broker 时 fail closed。\n- **CLI 技能包统一接线**：direct/hybrid 生成 handler 改经 `processBroker.runSync` 调用 CLI，命令行与 agent 两条技能执行入口都注入同一 Broker facade，并补齐单元/集成回归。"
+        },
+        {
+          "heading": "Added — cc CLI 0.162.176：统一进程执行边界 + durable runtime 事件 + IDE plan/diff review 完整链路（CLI-only npm 发版）",
+          "body": "> `chainlesschain` 0.162.175 → **0.162.176**（2026-07-23）。本版把 CLI 内分散的子进程入口收进统一 broker，并补齐 durable event、插件来源治理、结构化输出与 IDE 评审链路；同时修复 Windows changelog fallback、MCP 初始化顺序及多项跨平台执行回归。\n\n- **统一进程执行与安全边界**：后台 agent、batch、worktree、LSP/MCP、hook、发布、远程执行、凭据 helper 等宿主命令统一经 process broker；远程 argv、凭据过滤、同步/异步 exec-file 契约和跨平台 probe 一并加固。\n- **durable runtime / plugin 治理**：外部事件持久队列与 backpressure、MCP durable 事件生产者、plugin secret/process boundary、hook broker、plugin bin provenance 与 SBOM 接线。\n- **结构化输出与 IDE 评审**：JSON Schema 支持 local/dynamic/external refs；plan review 流式进度、批准计划锁定、diff 生命周期/关联/追问持久化和工具准入 host signal 接线。\n- **稳定性修复**：Windows 全局安装遇到父级 Node.js `CHANGELOG.md` 时回退包内数据；MCP 先初始化再注册 elicitation；修复 ESM cycle、workspace publishing、stream debug stack 与 broker portability。"
+        },
+        {
+          "heading": "Fixed — cc CLI 0.162.175：Windows hook 输出与 Node.js 22 启动链路加固",
+          "body": "> `chainlesschain` 0.162.174 → **0.162.175**（2026-07-21）。\n\n- 修复 Windows hook 输出处理、Node.js 22 JSON import 语法、platform sandbox/process broker 残余语法错误及命令注册回归。\n- 后台 cowork attach 可把 `askUserQuestion` 真实交给用户；Setup/Notification hooks、跨平台 sandbox 与 credential agent 默认链路完成接线。\n- 清理发布门的跨平台/并发 flake，恢复 CLI 启动、测试与发版契约。"
+        },
+        {
+          "heading": "Fixed — cc CLI 0.162.174：移除失效的 session notification import",
+          "body": "> `chainlesschain` 0.162.173 → **0.162.174**（2026-07-20）。\n\n- 移除 session notification 的陈旧导入，避免启动期模块解析失败。"
+        },
+        {
+          "heading": "Fixed — cc CLI 0.162.173：修复 observability 启动回归",
+          "body": "> `chainlesschain` 0.162.172 → **0.162.173**（2026-07-20）。\n\n- 修复 observability 模块缺失导出、循环依赖与 `traceContext is not defined`，恢复 CLI 正常启动。"
+        },
+        {
+          "heading": "Added — cc CLI 0.162.172：cowork 远程控制 + Runtime Convergence M5/M6",
+          "body": "> `chainlesschain` 0.162.171 → **0.162.172**（2026-07-20）。\n\n- 完成 cowork 远程控制、Hook System v2、Notification 事件与 Permission UX。\n- 接入分布式追踪、性能指标、OTLP exporter，以及 M5/M6 四层 runtime convergence 运行参数。"
+        },
+        {
+          "heading": "Added — cc CLI 0.162.171：后台 Agent 安全 worktree 交接 + turn/approval 持久绑定",
+          "body": "> `chainlesschain` 0.162.170 → **0.162.171**（2026-07-19）。\n\n- 后台 Agent 增加生产级 bootstrap 与安全 worktree transfer。\n- REPL 成为 turn-binding 生产者，`/rewind` 消费持久化绑定表；WebSocket approval binding 补齐真实生产者。\n- IDE lockfile sandbox 与 CLI worktree 边界同步加固。"
+        },
         {
           "heading": "Added — cc CLI 0.162.170：后台 Agent stop 自杀守卫 + 可注入 kill seam + smoke-runner 死 pid 守卫；发版门 flake 治本后首个无 skip_tests 发版（CLI-only npm 发版）",
           "body": "> `chainlesschain` 0.162.169 → **0.162.170** 发 npm `latest`（经 `npm-publish.yml`，`--provenance --access public`）。CLI-only：`packages/cli/src` 仅两文件（+ vitest 4.1.5→4.1.10 devDep 升级与测试）；未触 `pdh/lib` → 无 Android bundle / 无 USR_VERSION。**无新增顶层命令，命令数 175 不变**；默认路径字节不变（守卫只在损坏/异常记录上改变行为）。本版同时是 CI 发版门 worker-death flake（卡了 .167/.168/.169 三个发版、cli-ci 30+ 连败）治本（trap #34）后的**验证发版**——test 门应首跑即绿、无需 `skip_tests`。\n\n- **后台 Agent stop 自杀守卫（真实世界加固）**：`stopBackgroundAgent` 现拒绝向 `pid === process.pid` 的记录发信号——合法的 worker 记录不可能指向执行 stop 的进程自身，命中即判损坏记录（标 `lost`/`self-pid-corrupt-record`、不杀任何进程）。此前一份损坏/手改的 state 文件能让 `cc daemon stop` 对用户自己的 shell 树发 SIGTERM（POSIX）或 `taskkill /T /F`（Windows）。agentPid 组杀同样加 `!== process.pid` 守卫；`defaultKillProcessTree` 同款自杀守卫。\n- **可注入 kill seam**：supervisor 全部 POSIX 信号从裸 `process.kill` 收进 `_deps.kill` 单一 seam——测试可注入（正是 flake 根因之一：`_deps.spawnSync` stub 只盖 Windows taskkill 分支、POSIX 裸 kill 拦不住），生产行为不变。\n- **smoke-runner 死 pid 守卫**：子进程已退出（`exitCode`/`signalCode` 非 null）时跳过 Windows `taskkill /T /F`——Windows 秒级复用 pid，对死尸 pid 的树杀会误杀顶替者全树（CI 上即另一 vitest worker / 无辜测试子进程）。\n- **vitest 4.1.5 → 4.1.10**（root workspace 全体 devDep）：含 4.1.9 的真 pool 修复（worker 崩溃挂起、per-task error 监听、STOPPED 态、回收 isTerminated 守卫）；非 flake 解药但保留为正确卫生。agent-sdk 刻意保持 `^3` 钉版；独立 web-panel 不动。"

package/src/gateways/ws/personal-data-hub-protocol.js

@@ -23,6 +23,7 @@ import {
 } from "../../lib/personal-data-hub-wiring.js";
 import { importPdh } from "../../lib/pdh-load-error.js";
 import { getAIChatWizard } from "../../lib/personal-data-hub-aichat-wizard.js";
+import { runDedicatedBatchCollectors } from "../../lib/pdh-dedicated-batch-collectors.js";
 import {
   existsSync,
   unlinkSync,
@@ -224,7 +225,10 @@ export const PERSONAL_DATA_HUB_HANDLERS = {
     }),
 
   "personal-data-hub.sync-all": async (msg) =>
-    withHub(async (hub) => await hub.registry.syncAll(msg.options || {})),
+    withHub(async (hub) => {
+      const reports = await hub.registry.syncAll(msg.options || {});
+      return await runDedicatedBatchCollectors(hub, reports);
+    }),
 
   "personal-data-hub.register-mock": async (msg) =>
     withHub((hub) => {
@@ -361,6 +365,9 @@ export const PERSONAL_DATA_HUB_HANDLERS = {
         }),
     ),
 
+  "personal-data-hub.activate-email": async (msg) =>
+    withHub(async (hub) => await hub.activateEmailAdapter(msg.email)),
+
   "personal-data-hub.unregister-email": async (msg) =>
     withHub(async (hub) => await hub.unregisterEmailAdapter(msg.email)),
 
@@ -381,6 +388,9 @@ export const PERSONAL_DATA_HUB_HANDLERS = {
         }),
     ),
 
+  "personal-data-hub.activate-alipay": async (msg) =>
+    withHub(async (hub) => await hub.activateAlipayAdapter(msg.email)),
+
   "personal-data-hub.unregister-alipay": async (msg) =>
     withHub(async (hub) => await hub.unregisterAlipayAdapter(msg.email)),
 
@@ -414,6 +424,15 @@ export const PERSONAL_DATA_HUB_HANDLERS = {
         }),
     ),
 
+  "personal-data-hub.activate-wechat": async (msg) =>
+    withHub(
+      async (hub) =>
+        await hub.activateWechatAdapter(msg.uin, {
+          fridaOpts: msg.fridaOpts,
+          keyProviderOverride: msg.keyProviderOverride,
+        }),
+    ),
+
   "personal-data-hub.unregister-wechat": async (msg) =>
     withHub(async (hub) => await hub.unregisterWechatAdapter(msg.uin)),
 
@@ -658,7 +677,8 @@ export const PERSONAL_DATA_HUB_STREAMING_HANDLERS = {
       }
     };
     try {
-      const reports = await hub.registry.syncAll(msg.options || {});
+      const registryReports = await hub.registry.syncAll(msg.options || {});
+      const reports = await runDedicatedBatchCollectors(hub, registryReports);
       return { result: reports };
     } finally {
       hub.registry.onSyncEvent = original;

package/src/harness/background-task-manager.js

@@ -1,19 +1,23 @@
 /**
  * Background Task Manager - daemon task queue with completion notifications.
  *
- * Tasks run in child_process.fork() for isolation.
+ * Tasks run in a brokered Node child with an IPC channel for isolation.
  * Queue persisted to .chainlesschain/tasks/queue.jsonl.
  * Completion notifications delivered to REPL callback.
  *
  * Feature-flag gated: BACKGROUND_TASKS
  */
 
-import { fork } from "node:child_process";
 import { existsSync, mkdirSync, appendFileSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { createHash } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { getHomeDir } from "../lib/paths.js";
+import executionBroker from "../lib/process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: executionBroker.spawn.bind(executionBroker),
+};
 
 function getTasksDir() {
   const dir = join(getHomeDir(), "tasks");
@@ -114,13 +118,21 @@ export class BackgroundTaskManager extends EventEmitter {
     task.recoverySourceStatus = null;
     this._recordHistory(task, "started", { status: task.status });
 
-    const child = fork(
-      join(import.meta.dirname || ".", "background-task-worker.js"),
-      [task.command, task.cwd, task.type],
+    const workerPath = join(
+      import.meta.dirname || ".",
+      "background-task-worker.js",
+    );
+    const child = _deps.spawn(
+      process.execPath,
+      [...process.execArgv, workerPath, task.command, task.cwd, task.type],
       {
         cwd: task.cwd,
-        silent: true,
+        stdio: ["pipe", "pipe", "pipe", "ipc"],
         env: { ...process.env, CC_TASK_ID: taskId },
+        origin: "background-task:worker",
+        policy: "allow",
+        scope: "background-task",
+        shell: false,
       },
     );
 

package/src/harness/background-task-worker.js

@@ -5,7 +5,7 @@
  * Sends messages to parent: { type: "heartbeat"|"result"|"error", ... }
  */
 
-import { execSync } from "node:child_process";
+import executionBroker from "../lib/process-execution-broker/index.js";
 
 const [command, cwd, type] = process.argv.slice(2);
 
@@ -14,23 +14,16 @@ const heartbeat = setInterval(() => {
 }, 5000);
 
 try {
-  let result;
-
-  if (type === "shell") {
-    result = execSync(command, {
-      cwd: cwd || process.cwd(),
-      encoding: "utf-8",
-      timeout: 300000,
-      maxBuffer: 10 * 1024 * 1024,
-    });
-  } else {
-    result = execSync(command, {
-      cwd: cwd || process.cwd(),
-      encoding: "utf-8",
-      timeout: 300000,
-      maxBuffer: 10 * 1024 * 1024,
-    });
-  }
+  const result = executionBroker.execSync(command, {
+    cwd: cwd || process.cwd(),
+    encoding: "utf-8",
+    timeout: 300000,
+    maxBuffer: 10 * 1024 * 1024,
+    origin: `background-task:command:${type || "unknown"}`,
+    policy: "allow",
+    scope: "background-task",
+    shell: true,
+  });
 
   if (process.send) {
     process.send({ type: "result", data: result || "Done" });

package/src/harness/golden-transcript.js

@@ -18,6 +18,9 @@ const VOLATILE_KEYS = new Set([
   "updatedAt",
   "duration",
   "durationMs",
+  "permission_decision_id",
+  "tool_use_id",
+  "turn_id",
   "toolTelemetryRecord",
 ]);
 

package/src/harness/mcp-client.js

@@ -8,7 +8,6 @@
  * thin re-export shim for backwards compatibility.
  */
 
-import { spawn } from "child_process";
 import { executionBroker } from "../lib/process-execution-broker/index.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { EventEmitter } from "events";
@@ -21,7 +20,7 @@ import { EventRuntimeProducer } from "../lib/event-runtime-producer.js";
  * `fetch` defaults to the global fetch (Node 18+).
  */
 export const _deps = {
-  spawn,
+  spawn: executionBroker.spawn.bind(executionBroker),
   fetch: (...args) => globalThis.fetch(...args),
   // Backoff sleep seam (tests override with a no-op so retries don't wait).
   sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
@@ -486,10 +485,7 @@ export class MCPClient extends EventEmitter {
             `stdio transport requires a command (server "${name}")`,
           );
         }
-        const spawnFn = String(config.origin || "").startsWith("plugin:")
-          ? executionBroker.spawn.bind(executionBroker)
-          : _deps.spawn;
-        const proc = spawnFn(config.command, config.args || [], {
+        const proc = _deps.spawn(config.command, config.args || [], {
           stdio: ["pipe", "pipe", "pipe"],
           // process.env < agent identity (CLAUDECODE / session id) < the
           // server's own config.env, so an explicit per-server override wins.
@@ -498,15 +494,13 @@ export class MCPClient extends EventEmitter {
             ...this._agentIdentityEnv(),
             ...(config.env || {}),
           },
-          ...(config.origin
-            ? {
-                origin: config.origin,
-                policy: config.policy || "allow",
-                pluginId: config.pluginId,
-                pluginVersion: config.pluginVersion,
-                pluginSource: config.pluginSource,
-              }
-            : {}),
+          origin: config.origin || `mcp:server:${name}`,
+          policy: config.policy || "allow",
+          scope: config.scope || "mcp",
+          shell: false,
+          pluginId: config.pluginId,
+          pluginVersion: config.pluginVersion,
+          pluginSource: config.pluginSource,
         });
 
         entry.process = proc;

package/src/harness/worktree-isolator.js

@@ -7,7 +7,6 @@
  * Feature-flag gated: WORKTREE_ISOLATION
  */
 
-import { execSync } from "node:child_process";
 import { existsSync, rmSync, symlinkSync, mkdirSync } from "node:fs";
 import { resolve, dirname } from "node:path";
 import {
@@ -93,10 +92,10 @@ export function removeWorktree(repoDir, worktreePath, options = {}) {
   let branch = null;
   if (deleteBranch) {
     try {
-      branch = execSync("git rev-parse --abbrev-ref HEAD", {
-        cwd: worktreePath,
-        encoding: "utf-8",
-      }).trim();
+      branch = gitExecArgs(
+        ["rev-parse", "--abbrev-ref", "HEAD"],
+        worktreePath,
+      ).trim();
     } catch (_e) {
       // Can't determine branch, skip branch deletion.
     }
@@ -215,11 +214,7 @@ function _worktreeCleanupState(repoDir, wt) {
 
   // Dirty state: separate tracked modifications from untracked files.
   try {
-    const porcelain = execSync("git status --porcelain", {
-      cwd: wt.path,
-      encoding: "utf-8",
-      maxBuffer: 64 * 1024 * 1024,
-    });
+    const porcelain = gitExecArgs(["status", "--porcelain"], wt.path);
     const lines = porcelain.split("\n").filter((l) => l.trim().length > 0);
     state.untracked = lines.some((l) => l.startsWith("??"));
     state.uncommitted = lines.some((l) => !l.startsWith("??"));
@@ -393,8 +388,16 @@ export function mergeWorktree(repoDir, branchName, options = {}) {
     };
   } catch (err) {
     const errMsg = err.message || String(err);
-    if (errMsg.includes("CONFLICT") || errMsg.includes("conflict")) {
-      const conflictPaths = _collectConflictFiles(repoDir);
+    // Git can report merge conflicts on stdout while execSync's Error.message
+    // contains only the failed command (and localized installations need not
+    // include the English word "conflict"). The unmerged index is the
+    // authoritative signal.
+    const conflictPaths = _collectConflictFiles(repoDir);
+    if (
+      conflictPaths.length > 0 ||
+      errMsg.includes("CONFLICT") ||
+      errMsg.includes("conflict")
+    ) {
       if (conflictPaths.length === 0) {
         conflictPaths.push(..._extractConflictPathsFromMessage(errMsg));
       }
@@ -690,15 +693,9 @@ function _fileStatus(repoDir, base, branch, filePath) {
 
 function _hasUncommittedChanges(worktreePath) {
   try {
-    const output = execSync("git status --porcelain", {
-      cwd: worktreePath,
-      encoding: "utf-8",
-      // A worktree with many dirty files produces >1 MB of porcelain output and
-      // would ENOBUFS on the default cap — the catch below then reports "clean"
-      // (fail-OPEN), which could let a caller discard a worktree full of
-      // uncommitted work. Give it the same 64 MB headroom as gitExec.
-      maxBuffer: 64 * 1024 * 1024,
-    });
+    // gitExecArgs carries the shared 64 MB maxBuffer, avoiding a fail-open
+    // "clean" result when a large worktree exceeds Node's default output cap.
+    const output = gitExecArgs(["status", "--porcelain"], worktreePath);
     return output.trim().length > 0;
   } catch (_e) {
     return false;

package/src/index.js

@@ -9,6 +9,10 @@ import { pathToFileURL } from "node:url";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import manifest from "./command-manifest.json" with { type: "json" };
+import {
+  startDefaultEventRuntimeHost,
+  stopDefaultEventRuntimeHost,
+} from "./lib/event-runtime-host.js";
 
 // The manifest entry is the canonical registration point for learning.  Keep
 // these names visible here for tooling that audits the CLI's command surface:
@@ -132,12 +136,19 @@ const isDirectRun =
     process.argv[1].endsWith("\\cli\\bin\\cli.js"));
 
 if (isDirectRun) {
+  // One lifecycle owner for every CLI surface. The timer is unref'ed, so a
+  // short command is never kept alive solely by the Event Runtime; resident
+  // commands keep draining while their own handles are active.
+  startDefaultEventRuntimeHost();
   const program = createProgram();
-  program.parseAsync(process.argv).catch((err) => {
-    console.error(chalk.red("\nUnexpected error:"), err.message);
-    if (process.env.DEBUG) {
-      console.error(err.stack);
-    }
-    process.exit(1);
-  });
+  program
+    .parseAsync(process.argv)
+    .catch((err) => {
+      console.error(chalk.red("\nUnexpected error:"), err.message);
+      if (process.env.DEBUG) {
+        console.error(err.stack);
+      }
+      process.exitCode = 1;
+    })
+    .finally(() => stopDefaultEventRuntimeHost({ drain: true }));
 }

package/src/lib/agent-core.js

@@ -13,6 +13,8 @@ export {
   getAgentToolDescriptors,
   getCachedPython,
   getEnvironmentInfo,
+  _environmentProcessDeps,
+  _agentToolProcessDeps,
   getBaseSystemPrompt,
   buildSystemPrompt,
   executeTool,
@@ -29,6 +31,9 @@ export {
   killBackgroundShellTask,
   killAllBackgroundShellTasks,
   killAllBackgroundShellTasksSync,
+  _backgroundProcessDeps,
+  _runBackgroundTaskkill,
+  _gitProcessDeps,
   reapIdleBackgroundShellTasks,
   _ingestSearchOutput,
   writeFileVerified,

package/src/lib/agent-ipc-bus.js

@@ -13,6 +13,11 @@ import { EventEmitter } from "node:events";
 import crypto from "node:crypto";
 import { EventRuntimeProducer } from "./event-runtime-producer.js";
 import { EventRuntimeStore } from "./event-runtime-store.js";
+import executionBroker from "./process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: executionBroker.spawn.bind(executionBroker),
+};
 
 /**
  * @typedef {Object} InteractionRequest
@@ -170,12 +175,12 @@ class AgentIPCBus extends EventEmitter {
    * @returns {Promise<{process: ChildProcess, agentId: string}>}
    */
   async spawnAgentProcess(command, args = [], options = {}) {
-    const { spawn } = await import("node:child_process");
     const agentId = options.agentId || crypto.randomUUID();
     const heartbeatMs = options.heartbeatMs || 30000;
 
     return new Promise((resolve, reject) => {
-      const child = spawn(command, args, {
+      const spawnOptions = options.spawnOptions || {};
+      const child = _deps.spawn(command, args, {
         stdio: ["pipe", "pipe", "pipe"],
         env: {
           ...process.env,
@@ -184,7 +189,11 @@ class AgentIPCBus extends EventEmitter {
           CHAINLESSCHAIN_IPC_PROTOCOL: "jsonrpc-stdio-v1",
           ...options.env,
         },
-        ...options.spawnOptions,
+        ...spawnOptions,
+        origin: spawnOptions.origin || "agent-ipc:subagent",
+        policy: spawnOptions.policy || "allow",
+        scope: spawnOptions.scope || "agent-ipc",
+        shell: spawnOptions.shell === true,
       });
 
       let buffer = "";