chainlesschain 0.162.180 → 0.162.181

package/src/lib/project-mcp-trust.js

@@ -13,12 +13,16 @@
  * Store: ~/.chainlesschain/trusted-project-mcp.json  { [absPath]: {fingerprint, trustedAt} }
  */
 
-import fs from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
 import { getHomeDir } from "./paths.js";
+import { withFileLock } from "./with-file-lock.js";
+import {
+  mutateSecurityStore,
+  readSecurityStore,
+} from "./durable-security-store.js";
 
-export const _deps = { fs };
+export const _deps = { withFileLock };
 
 function storePath(opts = {}) {
   return (
@@ -33,13 +37,7 @@ export function projectMcpFingerprint(content) {
 }
 
 function readStore(opts) {
-  try {
-    const raw = _deps.fs.readFileSync(storePath(opts), "utf-8");
-    const data = JSON.parse(raw);
-    return data && typeof data === "object" ? data : {};
-  } catch {
-    return {};
-  }
+  return readSecurityStore(storePath(opts), "project MCP trust");
 }
 
 /**
@@ -61,23 +59,20 @@ export function checkProjectMcpTrust(file, content, opts = {}) {
 /** Record (or re-record) the trusted fingerprint for a file. */
 export function recordProjectMcpTrust(file, content, opts = {}) {
   const target = storePath(opts);
-  const store = readStore(opts);
-  store[path.resolve(file)] = {
-    fingerprint: projectMcpFingerprint(content),
-    trustedAt: new Date(
-      typeof opts.now === "number" ? opts.now : Date.now(),
-    ).toISOString(),
-  };
-  try {
-    _deps.fs.mkdirSync(path.dirname(target), { recursive: true });
-    _deps.fs.writeFileSync(target, JSON.stringify(store, null, 2), {
-      encoding: "utf-8",
-      mode: 0o600,
-    });
-    return true;
-  } catch {
-    return false; // best-effort — a failed record just re-prompts next run
-  }
+  return mutateSecurityStore(
+    target,
+    "project MCP trust",
+    (store) => {
+      store[path.resolve(file)] = {
+        fingerprint: projectMcpFingerprint(content),
+        trustedAt: new Date(
+          typeof opts.now === "number" ? opts.now : Date.now(),
+        ).toISOString(),
+      };
+      return true;
+    },
+    { lock: _deps.withFileLock },
+  );
 }
 
 /** Truthy CC_PROJECT_MCP_TRUST → the user explicitly re-trusts this run. */

package/src/lib/protocol-replay.js

@@ -15,10 +15,11 @@
  *      client must never receive a vN+1 field; a recording that violates that is
  *      a compat bug this catches deterministically, offline, in CI.
  *
- * The set of gateable wire fields ({seq, trace_id, tool_use_id}) is projected
- * from the ONE canonical [[capability-manifest.js]] via `toFieldGate()` — it can
- * NOT drift from the negotiated feature list. All non-negotiable frame fields
- * (type, content, tool name, …) always pass through untouched.
+ * The gateable wire fields are projected from the ONE canonical
+ * [[capability-manifest.js]] via `toGateableFieldGate()` — including companion
+ * fields controlled by the same logical feature. They cannot drift from the
+ * negotiated feature list. All non-negotiable frame fields (type, content,
+ * tool name, …) always pass through untouched.
  *
  * PURE + deterministic: no fs / process / clock / RNG. The `digest` lets a golden
  * recording be pinned so any change to negotiation/gating that alters wire output
@@ -30,13 +31,19 @@ import {
   negotiateProtocol,
   applyNegotiationToGate,
 } from "./capability-negotiation.js";
-import { toFieldGate } from "./capability-manifest.js";
+import { toGateableFieldGate } from "./capability-manifest.js";
 
-/** Negotiable wire field names ({seq, trace_id, tool_use_id}), single-sourced. */
+/** Negotiable wire field → primary gate field, single-sourced. */
+const GATEABLE_FIELD_GATE = Object.freeze(toGateableFieldGate());
+
+/** Every negotiable wire field name, including same-feature companions. */
 export const GATEABLE_FIELDS = Object.freeze(
-  [...new Set(Object.values(toFieldGate()))].sort(),
+  Object.keys(GATEABLE_FIELD_GATE).sort(),
 );
 
+const gateOn = (gate, field) =>
+  gate[GATEABLE_FIELD_GATE[field] || field] === true;
+
 /**
  * Run negotiation and fold it into a per-field gate the replay/audit read.
  * On an incompatible (ok:false) negotiation the gate stays empty → every gateable
@@ -50,8 +57,8 @@ export const GATEABLE_FIELDS = Object.freeze(
 export function gateFromNegotiation({ server = {}, client = null } = {}) {
   const negotiation = negotiateProtocol(server, client ?? null);
   const gate = applyNegotiationToGate(negotiation, {});
-  const enabledFields = GATEABLE_FIELDS.filter((f) => gate[f] === true);
-  const gatedFields = GATEABLE_FIELDS.filter((f) => gate[f] !== true);
+  const enabledFields = GATEABLE_FIELDS.filter((f) => gateOn(gate, f));
+  const gatedFields = GATEABLE_FIELDS.filter((f) => !gateOn(gate, f));
   return { negotiation, gate, enabledFields, gatedFields };
 }
 
@@ -61,14 +68,14 @@ export function gateFromNegotiation({ server = {}, client = null } = {}) {
  * Returns a shallow copy — the input frame is never mutated.
  *
  * @param {object} frame
- * @param {object} gate  {seq?:boolean, trace_id?:boolean, tool_use_id?:boolean}
+ * @param {object} gate  negotiated primary-field gate
  * @returns {object}
  */
 export function replayFrame(frame, gate = {}) {
   if (!frame || typeof frame !== "object") return frame;
   const out = {};
   for (const [k, v] of Object.entries(frame)) {
-    if (GATEABLE_FIELDS.includes(k) && gate[k] !== true) continue;
+    if (GATEABLE_FIELDS.includes(k) && !gateOn(gate, k)) continue;
     out[k] = v;
   }
   return out;
@@ -116,7 +123,7 @@ export function auditRecordedSession(frames, ctx = {}) {
     if (!frame || typeof frame !== "object") return;
     for (const field of GATEABLE_FIELDS) {
       if (
-        gate[field] !== true &&
+        !gateOn(gate, field) &&
         Object.prototype.hasOwnProperty.call(frame, field)
       ) {
         violations.push({

package/src/lib/settings-hooks.cjs

@@ -256,6 +256,19 @@ function collectHooks(hooksBlock, event, toolName) {
           pluginId: h.pluginId || null,
           pluginVersion: h.pluginVersion || null,
           pluginSource: h.pluginSource || null,
+          ...(h.shell != null ? { shell: h.shell } : {}),
+          ...(h.environmentAllowlist != null
+            ? { environmentAllowlist: h.environmentAllowlist }
+            : {}),
+          ...(h.envAllowlist != null
+            ? { envAllowlist: h.envAllowlist }
+            : {}),
+          ...(h.sandboxPolicy !== undefined
+            ? { sandboxPolicy: h.sandboxPolicy }
+            : {}),
+          ...(h.requiredBoundaries !== undefined
+            ? { requiredBoundaries: h.requiredBoundaries }
+            : {}),
         });
     }
   }

package/src/lib/skill-loader.js

@@ -332,6 +332,7 @@ export class CLISkillLoader {
     this._cacheStats = {
       descriptorScans: 0,
       descriptorCacheHits: 0,
+      descriptorUses: new Map(),
       bodyCacheHits: 0,
       bodyCacheMisses: 0,
       bodyLoads: new Map(),
@@ -579,10 +580,16 @@ export class CLISkillLoader {
       estimatedTokens: cached.estimatedTokens,
       loads: 0,
       cacheHits: 0,
+      contextLoads: 0,
+      contextCacheHits: 0,
       loadedBecause: [],
     };
     prior.loads += 1;
     if (cacheRead) prior.cacheHits += 1;
+    if (context.bodyIncluded === true) {
+      prior.contextLoads += 1;
+      if (cacheRead) prior.contextCacheHits += 1;
+    }
     const reason = context.loadedBecause || "explicit";
     if (!prior.loadedBecause.includes(reason)) prior.loadedBecause.push(reason);
     this._cacheStats.bodyLoads.set(skill.skillMdPath, prior);
@@ -594,12 +601,17 @@ export class CLISkillLoader {
         sourceType: "skill",
         sourceId: skill.id,
         permissionMode: context.permissionMode || "agent",
-        tokenCount: cached.estimatedTokens,
+        // Only text that actually entered a model prompt consumes context
+        // tokens. Ordinary run_skill materialization is still recorded, but
+        // as a content-size/cache observation rather than a false token charge.
+        tokenCount:
+          context.bodyIncluded === true ? cached.estimatedTokens : 0,
         metadata: {
           source: skill.source,
           loadedBecause: reason,
           cacheRead,
           bodyIncluded: context.bodyIncluded === true,
+          estimatedBodyTokens: cached.estimatedTokens,
         },
       });
     } catch {
@@ -612,6 +624,22 @@ export class CLISkillLoader {
   recordDescriptorUse(skills, context = {}) {
     for (const skill of Array.isArray(skills) ? skills : []) {
       const descriptorText = `${skill.id}\n${skill.description || ""}\n${skill.category || ""}`;
+      const estimatedTokens = estimateSkillTokens(descriptorText);
+      const prior = this._cacheStats.descriptorUses.get(skill.id) || {
+        id: skill.id,
+        source: skill.source,
+        estimatedTokens,
+        contextLoads: 0,
+        contextTokens: 0,
+        loadedBecause: [],
+      };
+      prior.contextLoads += 1;
+      prior.contextTokens += estimatedTokens;
+      const reason = context.loadedBecause || "list_skills";
+      if (!prior.loadedBecause.includes(reason)) {
+        prior.loadedBecause.push(reason);
+      }
+      this._cacheStats.descriptorUses.set(skill.id, prior);
       try {
         this._contextLedger?.recordRead?.({
           sessionId: context.sessionId || "unknown",
@@ -619,10 +647,10 @@ export class CLISkillLoader {
           sourceType: "skill_descriptor",
           sourceId: skill.id,
           permissionMode: context.permissionMode || "agent",
-          tokenCount: estimateSkillTokens(descriptorText),
+          tokenCount: estimatedTokens,
           metadata: {
             source: skill.source,
-            loadedBecause: context.loadedBecause || "list_skills",
+            loadedBecause: reason,
             bodyLoaded: skill.bodyLoaded === true,
           },
         });
@@ -635,10 +663,28 @@ export class CLISkillLoader {
   /** Content-free cache/cost snapshot for `cc context --sources`. */
   getCacheLedger() {
     const descriptors = Array.isArray(this._cache) ? this._cache : [];
-    const descriptorChars = descriptors.reduce(
-      (sum, skill) =>
-        sum +
-        `${skill.id}\n${skill.displayName}\n${skill.description}\n${skill.category}`.length,
+    const descriptorEntries = descriptors.map((skill) => {
+      const descriptorText = `${skill.id}\n${skill.displayName}\n${skill.description}\n${skill.category}`;
+      const used = this._cacheStats.descriptorUses.get(skill.id);
+      return {
+        id: skill.id,
+        source: skill.source,
+        estimatedTokens: estimateSkillTokens(descriptorText),
+        contextLoads: Number(used?.contextLoads) || 0,
+        contextTokens: Number(used?.contextTokens) || 0,
+        loadedBecause: [...(used?.loadedBecause || [])],
+      };
+    });
+    const descriptorTokens = descriptorEntries.reduce(
+      (sum, entry) => sum + entry.estimatedTokens,
+      0,
+    );
+    const descriptorContextLoads = descriptorEntries.reduce(
+      (sum, entry) => sum + entry.contextLoads,
+      0,
+    );
+    const descriptorContextTokens = descriptorEntries.reduce(
+      (sum, entry) => sum + entry.contextTokens,
       0,
     );
     const residentPaths = new Set(this._bodyCache.keys());
@@ -649,20 +695,46 @@ export class CLISkillLoader {
       0,
     );
     const bodyLoads = Array.from(this._cacheStats.bodyLoads.values()).map(
-      (entry) => ({ ...entry, loadedBecause: [...entry.loadedBecause] }),
+      (entry) => ({
+        ...entry,
+        cacheMisses: Math.max(0, entry.loads - entry.cacheHits),
+        contextTokens: entry.estimatedTokens * entry.contextLoads,
+        loadedBecause: [...entry.loadedBecause],
+      }),
+    );
+    const bodyTotals = bodyLoads.reduce(
+      (totals, entry) => {
+        totals.estimatedTokensResident += entry.estimatedTokens;
+        totals.estimatedTokensServed += entry.estimatedTokens * entry.loads;
+        totals.estimatedTokensAvoidedByCache +=
+          entry.estimatedTokens * entry.cacheHits;
+        totals.contextLoads += entry.contextLoads;
+        totals.contextTokens += entry.contextTokens;
+        return totals;
+      },
+      {
+        estimatedTokensResident: 0,
+        estimatedTokensServed: 0,
+        estimatedTokensAvoidedByCache: 0,
+        contextLoads: 0,
+        contextTokens: 0,
+      },
     );
     return {
       descriptors: {
         resident: descriptors.length,
         scans: this._cacheStats.descriptorScans,
         cacheHits: this._cacheStats.descriptorCacheHits,
-        rawChars: descriptorChars,
-        estimatedTokens: estimateSkillTokens(descriptorChars),
+        estimatedTokens: descriptorTokens,
+        contextLoads: descriptorContextLoads,
+        contextTokens: descriptorContextTokens,
+        entries: descriptorEntries,
       },
       bodies: {
         resident: this._bodyCache.size,
         cacheHits: this._cacheStats.bodyCacheHits,
         cacheMisses: this._cacheStats.bodyCacheMisses,
+        ...bodyTotals,
         entries: bodyLoads,
       },
       savings: {
@@ -770,6 +842,7 @@ export class CLISkillLoader {
     this._cacheStats = {
       descriptorScans: 0,
       descriptorCacheHits: 0,
+      descriptorUses: new Map(),
       bodyCacheHits: 0,
       bodyCacheMisses: 0,
       bodyLoads: new Map(),

package/src/lib/sync-credentials.js

@@ -214,14 +214,15 @@ function setCredentials(providerId, creds) {
   if (!creds || typeof creds !== "object") {
     throw new Error("sync-credentials: creds must be an object");
   }
-  // Serialize the decrypt-modify-encrypt across processes so a concurrent write
-  // to a different provider doesn't drop this one (best-effort, never hangs).
+  // Credential metadata is security-critical: never decrypt-modify-encrypt
+  // without exclusion, because a lost update can silently restore/revoke the
+  // wrong provider credentials.
   return withFileLock(_vaultPath(), () => {
     const all = loadAll();
     if (!all.sync || typeof all.sync !== "object") all.sync = {};
     all.sync[providerId] = { ...creds };
     return saveAll(all);
-  });
+  }, { failIfUnavailable: true });
 }
 
 function clearCredentials(providerId) {
@@ -233,7 +234,7 @@ function clearCredentials(providerId) {
       return saveAll(all);
     }
     return true;
-  });
+  }, { failIfUnavailable: true });
 }
 
 /** Test seam: override the resolved chainlesschain dir without env leak. */

package/src/lib/turn-binding.js

@@ -555,12 +555,14 @@ export function createTurnBindingFeed({
           // New core events expose the exact decision id. Legacy/custom event
           // sources retain the deterministic compatibility derivation.
           const policy = event.result?.policy;
-          if (policy && (policy.via || policy.decision)) {
-            log.recordPermissionDecision(
-              turnId,
-              event.permission_decision_id ||
-                `${callId || "call"}:perm:${policy.via || policy.decision}`,
-            );
+          const decisionId =
+            event.permission_decision_id ||
+            event.permission_decision?.id ||
+            (policy && (policy.via || policy.decision)
+              ? `${callId || "call"}:perm:${policy.via || policy.decision}`
+              : null);
+          if (decisionId) {
+            log.recordPermissionDecision(turnId, decisionId);
             dirty = true;
           }
           if (event.result?.userEdited === true) {

package/src/repl/agent-repl.js

@@ -48,9 +48,11 @@ import {
   appendCompactEvent,
   appendTokenUsage,
   appendToolCallCompact,
+  appendEvent,
   rebuildMessages,
   sessionExists,
 } from "../harness/jsonl-session-store.js";
+import { CLISkillLoader } from "../lib/skill-loader.js";
 import { storeMemory, consolidateMemory } from "../lib/hierarchical-memory.js";
 import { CLIContextEngineering } from "../lib/cli-context-engineering.js";
 import { defaultPrepareCall } from "../lib/turn-context.js";
@@ -64,6 +66,7 @@ import { CLIPermanentMemory } from "../lib/permanent-memory.js";
 import { CLIAutonomousAgent, GoalStatus } from "../lib/autonomous-agent.js";
 import {
   PromptCompressor,
+  estimateTokens,
   getContextWindow,
 } from "../harness/prompt-compressor.js";
 import {
@@ -1088,20 +1091,31 @@ export async function startAgentRepl(options = {}) {
   // their existing behaviour byte-identically.
   const _leanNoProjectMemory = options.projectMemory === false;
   let _loadedReplInstructions = null;
-  let _replBaseSystem = composeSystemPrompt(
-    buildSystemPrompt(process.cwd(), {
-      additionalDirectories,
-      projectMemory: options.projectMemory,
-    }),
-    {
-      systemPrompt: options.systemPrompt,
-      appendSystemPrompt: options.appendSystemPrompt,
-      projectMemory: _leanNoProjectMemory ? false : undefined,
-      onInstructionsLoaded: (loaded) => {
-        _loadedReplInstructions = loaded;
+  let _loadedReplPersonaSkills = [];
+  let _replSkillCacheLedger = null;
+  const _replSkillLoader = options.skillLoader || new CLISkillLoader();
+  const _buildReplBaseSystem = () =>
+    composeSystemPrompt(
+      buildSystemPrompt(process.cwd(), {
+        additionalDirectories,
+        projectMemory: options.projectMemory,
+        sessionId,
+        skillLoader: _replSkillLoader,
+        onSkillsLoaded: (skills, cacheLedger) => {
+          _loadedReplPersonaSkills = Array.isArray(skills) ? skills : [];
+          _replSkillCacheLedger = cacheLedger || null;
+        },
+      }),
+      {
+        systemPrompt: options.systemPrompt,
+        appendSystemPrompt: options.appendSystemPrompt,
+        projectMemory: _leanNoProjectMemory ? false : undefined,
+        onInstructionsLoaded: (loaded) => {
+          _loadedReplInstructions = loaded;
+        },
       },
-    },
-  );
+    );
+  let _replBaseSystem = _buildReplBaseSystem();
   let _activeOutputStyle = null; // { name, body }
   const messages = [{ role: "system", content: _replBaseSystem }];
   // Resume-degenerate role sanitation (Claude Code 2.1.187 parity): a one-shot
@@ -1184,6 +1198,46 @@ export async function startAgentRepl(options = {}) {
   // for this session via the shared mcp-config engine. Holds {mcpClient,
   // extraToolDefinitions, externalToolExecutors, externalToolDescriptors}.
   let _adhocMcp = null;
+  const _persistReplContextSources = () => {
+    if (!useJsonl || !sessionId) return false;
+    _replSkillCacheLedger =
+      _replSkillLoader.getCacheLedger?.() || _replSkillCacheLedger;
+    const mcpDefinitions = _adhocMcp?.extraToolDefinitions || [];
+    if (
+      mcpDefinitions.length === 0 &&
+      _loadedReplPersonaSkills.length === 0 &&
+      !_replSkillCacheLedger?.descriptors?.resident
+    ) {
+      return false;
+    }
+    try {
+      appendEvent(sessionId, "context_sources", {
+        mcp: mcpDefinitions.map((definition) => ({
+          function: {
+            name: definition?.function?.name || null,
+            description: definition?.function?.description || "",
+            parameters: definition?.function?.parameters || {},
+          },
+        })),
+        skills: _loadedReplPersonaSkills.map((skill) => ({
+          id: skill?.id || skill?.displayName || "skill",
+          displayName: skill?.displayName || skill?.id || "skill",
+          source: skill?.source || "skill",
+          tokens: estimateTokens(
+            `## Persona: ${skill?.displayName || skill?.id || "skill"}\n${
+              typeof skill?.body === "string" ? skill.body : ""
+            }`,
+          ),
+          bodyLoaded: skill?.bodyLoaded === true,
+        })),
+        skillCache: _replSkillCacheLedger,
+      });
+      return true;
+    } catch {
+      // Source attribution must never make an interactive turn fail.
+      return false;
+    }
+  };
   if (options.bundlePath) {
     try {
       const { loadBundle } =
@@ -1338,6 +1392,7 @@ export async function startAgentRepl(options = {}) {
       _adhocMcp = null;
     }
   }
+  _persistReplContextSources();
 
   // Seed connected MCP servers with the startup workspace roots when the session
   // began with extra `--add-dir` roots — otherwise `roots/list` would only ever
@@ -1779,6 +1834,36 @@ export async function startAgentRepl(options = {}) {
         new Promise((resolve) => {
           const label =
             request.message || "MCP server requests additional input";
+          if (request.mode === "url") {
+            rl.question(
+              chalk.yellow(
+                `\n  MCP [${request.server}] ${label}\n` +
+                  `  Host: ${request.urlHost}\n` +
+                  `  URL: ${request.url}\n` +
+                  "  Open this secure page? [y/N] ",
+              ),
+              async (answer) => {
+                const approved = /^(y|yes)$/i.test(
+                  String(answer || "").trim(),
+                );
+                if (!approved) {
+                  resolve({ action: "decline" });
+                  rl.prompt();
+                  return;
+                }
+                try {
+                  const { defaultOpenBrowser } =
+                    await import("../lib/mcp-oauth.js");
+                  const opened = defaultOpenBrowser(request.url);
+                  resolve(opened ? { action: "accept" } : { action: "cancel" });
+                } catch {
+                  resolve({ action: "cancel" });
+                }
+                rl.prompt();
+              },
+            );
+            return;
+          }
           rl.question(
             chalk.yellow(`\n  MCP [${request.server}] ${label}\n  > `),
             (answer) => {
@@ -2531,17 +2616,7 @@ export async function startAgentRepl(options = {}) {
             additionalDirectories.push(res.dir);
             // Re-advertise the updated roots in the system prompt; keep the
             // active output-style body layered on top (same as /output-style).
-            _replBaseSystem = composeSystemPrompt(
-              buildSystemPrompt(process.cwd(), {
-                additionalDirectories,
-                projectMemory: options.projectMemory,
-              }),
-              {
-                systemPrompt: options.systemPrompt,
-                appendSystemPrompt: options.appendSystemPrompt,
-                projectMemory: _leanNoProjectMemory ? false : undefined,
-              },
-            );
+            _replBaseSystem = _buildReplBaseSystem();
             messages[0].content = _activeOutputStyle
               ? `${_replBaseSystem}\n\n${_activeOutputStyle.body}`
               : _replBaseSystem;
@@ -3709,11 +3784,16 @@ export async function startAgentRepl(options = {}) {
     // layers (incl. .claude/skills) without restarting the session.
     if (trimmed === "/reload-skills") {
       try {
-        const { reloadSkills } = await import("../runtime/agent-core.js");
-        const n = reloadSkills();
+        _replSkillLoader.clearCache();
+        const n = _replSkillLoader.loadAll().length;
+        _replBaseSystem = _buildReplBaseSystem();
+        messages[0].content = _activeOutputStyle
+          ? `${_replBaseSystem}\n\n${_activeOutputStyle.body}`
+          : _replBaseSystem;
+        _persistReplContextSources();
         logger.log(
           chalk.green(
-            `✔ skills reloaded — ${n} available (6 layers re-scanned)`,
+            `✔ skills reloaded — ${n} available (${_replSkillLoader.getLayerPaths().length} layers re-scanned)`,
           ),
         );
       } catch (err) {
@@ -5311,7 +5391,9 @@ export async function startAgentRepl(options = {}) {
             },
           });
         }
-        _turnBindingProducer?.beginTurn(messages.length);
+        _turnBindingProducer?.beginTurn(messages.length, {
+          worktreeId: options.worktreeId ?? null,
+        });
       } catch (error) {
         _turnBindingCriticalError =
           error instanceof Error ? error : new Error(String(error));
@@ -5527,6 +5609,7 @@ export async function startAgentRepl(options = {}) {
         contextEngine,
         iterationBudget,
         sessionId,
+        skillLoader: _replSkillLoader,
         cwd: process.cwd(),
         additionalDirectories,
         sandbox: _sandbox,
@@ -5568,6 +5651,7 @@ export async function startAgentRepl(options = {}) {
         externalToolDescriptors: _adhocMcp?.externalToolDescriptors,
         chatFn: _fallbackChatFn,
       });
+      _persistReplContextSources();
       _turnAbort = null;
 
       // Strip the one-shot /btw aside now the model has seen it — so it is never
@@ -5933,6 +6017,7 @@ export async function startAgentRepl(options = {}) {
     if (sessionId) {
       try {
         if (useJsonl) {
+          _persistReplContextSources();
           // JSONL: write final compact snapshot for fast rebuild
           appendCompactEvent(sessionId, {
             strategy: "session-end",

package/src/repl/repl-turn-binding.js

@@ -71,7 +71,7 @@ export function createReplTurnBindingProducer({
      * appended, with `conversationOffset = messages.length` — the exact-match
      * contract `pickPersistedTurn` relies on.
      */
-    beginTurn(conversationOffset) {
+    beginTurn(conversationOffset, { worktreeId = null } = {}) {
       try {
         if (!feed) {
           feed = createTurnBindingFeed({
@@ -79,7 +79,10 @@ export function createReplTurnBindingProducer({
             nonce: runNonce,
           });
         }
-        return feed.beginTurn(conversationOffset, { supersede: true });
+        return feed.beginTurn(conversationOffset, {
+          supersede: true,
+          worktreeId,
+        });
       } catch (error) {
         return rejectOr(error, "load", null);
       }