chainlesschain 0.162.182 → 0.162.184

package/src/commands/team.js

@@ -24,14 +24,48 @@ import { TeamWorktreeCoordinator } from "../lib/agent-team/team-worktree.js";
 import { TeamBudget } from "../lib/agent-team/team-budget.js";
 import { TeamMailbox } from "../lib/agent-team/team-mailbox.js";
 import { executionBroker } from "../lib/process-execution-broker/index.js";
+import {
+  createCollaborationRun,
+  createCollaborationRunId,
+  createCollaborationSessionId,
+  finalizeCollaborationRun,
+  readCollaborationRun,
+  updateCollaborationUnit,
+} from "../lib/collaboration-run-store.js";
+import { loadSideEffectLedger } from "../lib/side-effect-ledger-store.js";
 
 export const _deps = {
   spawn: (...args) => executionBroker.spawn(...args),
+  collaborationStore: {
+    createRun: createCollaborationRun,
+    createRunId: createCollaborationRunId,
+    createSessionId: createCollaborationSessionId,
+    readRun: readCollaborationRun,
+    updateUnit: updateCollaborationUnit,
+    finalizeRun: finalizeCollaborationRun,
+    loadSideEffects: (sessionId) =>
+      loadSideEffectLedger(sessionId, { failIfUnavailable: false }),
+  },
 };
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const BIN = path.resolve(__dirname, "..", "..", "bin", "chainlesschain.js");
 
+function normalizePermissionMode(value) {
+  const mode = String(value || "acceptEdits");
+  return new Set([
+    "manual",
+    "auto",
+    "dontAsk",
+    "default",
+    "plan",
+    "acceptEdits",
+    "bypassPermissions",
+  ]).has(mode)
+    ? mode
+    : "acceptEdits";
+}
+
 /** Load + validate a task-graph file into a registry (throws on bad input). */
 export function loadRegistry(file, { ttlMs } = {}) {
   const abs = path.resolve(process.cwd(), file);
@@ -136,6 +170,13 @@ export function spawnAgent(prompt, cwd, opts = {}) {
       "text",
     ];
     if (opts.model) args.push("--model", opts.model);
+    if (opts.sessionId) args.push("--session", opts.sessionId);
+    if (Number(opts.maxTurns) > 0) {
+      args.push("--max-turns", String(opts.maxTurns));
+    }
+    if (Number(opts.maxBudgetUsd) > 0) {
+      args.push("--max-budget-usd", String(opts.maxBudgetUsd));
+    }
     const child = _deps.spawn(process.execPath, args, {
       cwd,
       env: { ...process.env, CLAUDECODE: "1" },
@@ -162,12 +203,15 @@ export function spawnAgent(prompt, cwd, opts = {}) {
 
 /** Real executor: hand a task's `prompt` to a headless `cc agent -p` in cwd. */
 function makeAgentRunTask(opts = {}) {
-  return function runTask({ task }) {
+  return function runTask({ key, task }) {
     const prompt = task.metadata?.prompt || task?.prompt;
     if (!prompt) {
       throw new Error(`task "${task.key}" has no \`prompt\` to --agent`);
     }
-    return spawnAgent(prompt, process.cwd(), opts);
+    return spawnAgent(prompt, process.cwd(), {
+      ...opts,
+      sessionId: opts.sessionIdForTask?.(key) || null,
+    });
   };
 }
 
@@ -220,6 +264,13 @@ export function registerTeamCommand(program, { logger } = {}) {
       "Hand each task's `prompt` to a headless cc agent (real)",
     )
     .option("--model <model>", "Model for --agent runs")
+    .option(
+      "--permission-mode <mode>",
+      "Permission mode for each --agent task",
+      "acceptEdits",
+    )
+    .option("--agent-max-turns <n>", "Per-agent task turn cap")
+    .option("--agent-max-budget-usd <amount>", "Per-agent task cost cap")
     .option(
       "--worktree",
       "Run each task's `command` in its own git worktree (parallel isolation)",
@@ -272,6 +323,7 @@ export function registerTeamCommand(program, { logger } = {}) {
           : null,
       });
       let priorMembers = [];
+      let priorCollaborationRunId = null;
       try {
         // Resume from a prior (possibly crashed) run's state: completed tasks
         // stay COMPLETED, and any lease left dangling by a crash is reclaimed so
@@ -297,6 +349,7 @@ export function registerTeamCommand(program, { logger } = {}) {
                 },
               });
             priorMembers = Array.isArray(snap.members) ? snap.members : [];
+            priorCollaborationRunId = snap.collaborationRunId || null;
           }
           // A teammate whose lease is still dangling here crashed last run — its
           // task is about to be reclaimed, so report it LOST before the sweep.
@@ -331,6 +384,86 @@ export function registerTeamCommand(program, { logger } = {}) {
         return;
       }
 
+      const permissionMode = normalizePermissionMode(options.permissionMode);
+      let priorCollaborationRun = null;
+      if (priorCollaborationRunId) {
+        try {
+          priorCollaborationRun = _deps.collaborationStore.readRun(
+            priorCollaborationRunId,
+          );
+        } catch {
+          // A malformed/foreign v3 pointer must not block registry recovery.
+          priorCollaborationRun = null;
+        }
+      }
+      const priorUnits = new Map(
+        (priorCollaborationRun?.units || []).map((unit) => [unit.key, unit]),
+      );
+      let collaborationRun;
+      try {
+        const runId = _deps.collaborationStore.createRunId("team");
+        collaborationRun = _deps.collaborationStore.createRun({
+          id: runId,
+          kind: "team",
+          repoRoot: process.cwd(),
+          permissionMode: options.agent ? permissionMode : "default",
+          resourceBudget: {
+            maxTurns: options.agentMaxTurns,
+            maxCostUsd: options.agentMaxBudgetUsd,
+            maxTasks: options.maxTasks,
+            maxTokens: options.maxTokens,
+            maxWallMs: options.maxWall
+              ? Math.max(1, Number(options.maxWall)) * 1000
+              : null,
+          },
+          units: reg.list().map((task) => ({
+            key: task.key,
+            branch: options.worktree ? `team/${task.key}` : null,
+            sessionId: options.agent
+              ? priorUnits.get(task.key)?.sessionId ||
+                _deps.collaborationStore.createSessionId(runId, task.key)
+              : null,
+            status:
+              String(task.status || "").toLowerCase() === "completed"
+                ? "completed"
+                : "pending",
+          })),
+        });
+      } catch (err) {
+        (log.error || console.error)(
+          `Failed to persist team governance: ${err.message}`,
+        );
+        process.exitCode = 1;
+        return;
+      }
+      const collaborationUnits = new Map(
+        collaborationRun.units.map((unit) => [unit.key, unit]),
+      );
+      const settleGovernance = (key, status, extra = {}) => {
+        const unit = collaborationUnits.get(key);
+        let sideEffects = null;
+        if (unit?.sessionId) {
+          try {
+            sideEffects = _deps.collaborationStore.loadSideEffects(
+              unit.sessionId,
+            );
+          } catch {
+            /* side-effect summary is additive */
+          }
+        }
+        const updated = _deps.collaborationStore.updateUnit(
+          collaborationRun.id,
+          key,
+          {
+            status,
+            ...extra,
+            ...(sideEffects ? { sideEffects } : {}),
+          },
+        );
+        const next = updated.units.find((candidate) => candidate.key === key);
+        if (next) collaborationUnits.set(key, next);
+      };
+
       // Persist a snapshot after each task settles so a crash mid-run is
       // resumable (persist-after-run alone would lose everything on a crash).
       // v2 bundles registry + mailbox + budget + member lifecycle so a resume
@@ -347,11 +480,12 @@ export function registerTeamCommand(program, { logger } = {}) {
             tmp,
             JSON.stringify(
               {
-                version: 2,
+                version: 3,
                 registry: reg.snapshot(),
                 mailbox: mailbox.snapshot(),
                 budget: budget.snapshot(),
                 members: runnerRef ? runnerRef.members() : priorMembers,
+                collaborationRunId: collaborationRun.id,
               },
               null,
               2,
@@ -379,8 +513,20 @@ export function registerTeamCommand(program, { logger } = {}) {
         coord = new TeamWorktreeCoordinator(process.cwd(), {
           sparsePaths: splitList(options.sparsePaths),
           symlinkDirectories: splitList(options.symlinkDirs),
+          onWorktree: ({ key, branch, path: worktreePath }) => {
+            settleGovernance(key, "running", {
+              branch,
+              worktreePath,
+              startedAt: Date.now(),
+            });
+          },
         });
         if (!coord.isGitRepo()) {
+          try {
+            _deps.collaborationStore.finalizeRun(collaborationRun.id, "failed");
+          } catch {
+            /* the original validation error remains primary */
+          }
           (log.error || console.error)(
             "--worktree requires a git repository (run inside one)",
           );
@@ -397,7 +543,13 @@ export function registerTeamCommand(program, { logger } = {}) {
               if (!prompt) {
                 throw new Error(`task "${key}" has no \`prompt\` to --agent`);
               }
-              await spawnAgent(prompt, cwd, { model: options.model });
+              await spawnAgent(prompt, cwd, {
+                model: options.model,
+                permissionMode,
+                maxTurns: options.agentMaxTurns,
+                maxBudgetUsd: options.agentMaxBudgetUsd,
+                sessionId: collaborationUnits.get(key)?.sessionId,
+              });
             },
           });
         } else {
@@ -412,7 +564,13 @@ export function registerTeamCommand(program, { logger } = {}) {
         );
         runTask = makeShellRunTask(log);
       } else if (options.agent)
-        runTask = makeAgentRunTask({ model: options.model });
+        runTask = makeAgentRunTask({
+          model: options.model,
+          permissionMode,
+          maxTurns: options.agentMaxTurns,
+          maxBudgetUsd: options.agentMaxBudgetUsd,
+          sessionIdForTask: (key) => collaborationUnits.get(key)?.sessionId,
+        });
       else runTask = async () => ({ dryRun: true });
 
       // Optional workflow tracing (Claude-Code 2.1.202 parity): every task
@@ -439,6 +597,19 @@ export function registerTeamCommand(program, { logger } = {}) {
         mailbox,
         recorder,
         onEvent: (e) => {
+          if (e.type === "task:claimed") {
+            settleGovernance(e.key, "running", {
+              startedAt: Date.now(),
+            });
+          } else if (e.type === "task:completed") {
+            settleGovernance(e.key, "completed", {
+              endedAt: Date.now(),
+            });
+          } else if (e.type === "task:failed") {
+            settleGovernance(e.key, e.retry ? "pending" : "failed", {
+              endedAt: e.retry ? null : Date.now(),
+            });
+          }
           if (options.json) console.log(JSON.stringify(e));
           else if (e.type === "task:claimed")
             (log.info || console.log)(`  → ${e.key} [${e.holder}]`);
@@ -459,8 +630,43 @@ export function registerTeamCommand(program, { logger } = {}) {
       runner.seedMembers(priorMembers);
       runnerRef = runner;
 
-      const summary = await runner.run();
+      let summary;
+      try {
+        summary = await runner.run();
+      } catch (err) {
+        try {
+          _deps.collaborationStore.finalizeRun(collaborationRun.id, "failed");
+        } catch {
+          /* retain the original runner failure */
+        }
+        throw err;
+      }
       persist();
+      try {
+        // Reconcile from the authoritative registry after all event callbacks.
+        // This closes any best-effort onEvent write that failed mid-run.
+        for (const task of reg.list()) {
+          const state = String(task.status || "").toLowerCase();
+          const status =
+            state === "completed"
+              ? "completed"
+              : state === "cancelled" || state === "pending"
+                ? "cancelled"
+                : "failed";
+          settleGovernance(task.key, status, {
+            endedAt: Date.now(),
+          });
+        }
+        _deps.collaborationStore.finalizeRun(
+          collaborationRun.id,
+          summary.done ? "completed" : "failed",
+        );
+      } catch (err) {
+        (log.error || console.error)(
+          `Failed to finalize team governance: ${err.message}`,
+        );
+        process.exitCode = 1;
+      }
 
       if (recorder && options.otlp) {
         try {

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.162.184",
+      "cliVersions": ["0.4.75", "0.37.36", "0.162.183", "0.162.184"],
+      "date": "2026-07-28",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.162.184 + IDE retry, collaboration, and recovery governance",
+          "body": "> `chainlesschain` **0.162.183 → 0.162.184**, VS Code\n> **0.37.35 → 0.37.36**, and JetBrains **0.4.74 → 0.4.75** (2026-07-28).\n> `@chainlesschain/personal-data-hub` remains **0.4.57** and\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Measured retry and tool attribution**: compact transcripts now record\n  bounded tool durations, observed same-turn retries, and secret-free streaming\n  LLM retry reasons with actual provider/model identity. CLI and both IDE usage\n  reports consume the same authoritative aggregates.\n- **Durable team/batch governance**: collaboration runs persist bounded\n  owner/session, permission mode, resource budget, lifecycle, and side-effect\n  counts without prompts, argv, tool arguments, output, or credentials. IDE\n  worktree views project these records as managed tasks without exposing\n  background attach/stop controls.\n- **Transactional plugin upgrades**: staged installs revalidate manifests and\n  signed SBOMs before atomic activation. Failed copies, load checks,\n  post-install handling, or declined capability widening restore the prior\n  active version; forced same-version reinstalls restore the exact old bytes.\n- **IDE activation feedback**: VS Code and JetBrains parse controlled\n  `activated / rolled_back / unchanged` results, reload live sessions only\n  after activation, and require explicit user approval before retrying with a\n  widened capability grant.\n- **Process-boundary hardening**: plugin hooks, MCP/LSP servers, monitors, and\n  native bins retain sandbox policy through the centralized execution broker;\n  Linux bubblewrap setup fails closed with bounded diagnostics.\n- **Release validation**: publication requires this exact release commit to\n  pass CLI CI and CLI Strict Sandbox on Linux, Windows, and macOS plus the\n  packaged VSIX and JetBrains unit/build/Remote Robot gates."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.162.183",
+      "cliVersions": ["0.4.74", "0.37.35", "0.162.182", "0.162.183"],
+      "date": "2026-07-27",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.162.183 + IDE quality, plugin, and worktree governance",
+          "body": "> `chainlesschain` **0.162.182 → 0.162.183**, VS Code\n> **0.37.34 → 0.37.35**, and JetBrains **0.4.73 → 0.4.74** (2026-07-27).\n> `@chainlesschain/personal-data-hub` remains **0.4.57** and\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **IDE-native quality context**: both IDE bridges negotiate bounded\n  `cc-ide-quality/v1` test-result, coverage, and debugger snapshots with\n  Context v2 freshness metadata; VS Code notebook execution now carries its\n  real notebook context.\n- **Installation Doctor depth**: VS Code and JetBrains report Node/Java\n  availability plus managed-CLI and plugin-registry offline recovery state,\n  without probing executables from an untrusted workspace directory.\n- **Plugin lifecycle and supply-chain UI**: scoped enable/disable, source-aware\n  upgrades, live-session reload, signature/SBOM summaries, managed-policy\n  provenance, and sanitized registry/Git/local source metadata stay governed\n  by the CLI runtime.\n- **Plugin usage attribution**: compact transcripts and usage reports now\n  attribute plugin-bin and plugin-provided MCP calls by plugin/version without\n  persisting tool arguments.\n- **Supervised worktree tasks**: IDE-created isolated tasks run as background\n  worktree agents and display canonical lifecycle, owner/session, permission\n  mode, resource budget, and bounded side-effect counts. Team and batch rows\n  remain explicitly unmanaged until they expose equivalent durable state.\n- **Release validation**: publication remains gated on the exact release\n  commit passing CLI CI, CLI Strict Sandbox, background reconnect E2E, packaged\n  VSIX Extension Host gates, JetBrains unit/build/Remote Robot gates, and\n  public marketplace readback."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.162.182",

package/src/harness/jsonl-session-store.js

@@ -164,20 +164,73 @@ export function appendToolCall(sessionId, toolName, args) {
 
 /**
  * Compact tool-call record for usage attribution (用量归因): tool name +
- * error flag (+ an optional skill hint for `run_skill`) — deliberately NOT
- * the args, which can carry whole file bodies (write_file content) and would
- * bloat the transcript. Written at tool-result time by the agent drivers so
- * `cc session usage --by tool|mcp` and `cc insights` can aggregate tool use
- * for any persisted session.
+ * error flag (+ optional skill, plugin/version, and bounded observed duration)
+ * — deliberately NOT the args, which can carry whole file bodies (write_file
+ * content) and would bloat the transcript. Written at tool-result time by the
+ * agent drivers so `cc session usage --by tool|mcp|plugin` and `cc insights`
+ * can aggregate tool use for any persisted session.
  */
 export function appendToolCallCompact(
   sessionId,
-  { tool, isError, skill } = {},
+  { tool, isError, skill, plugin, pluginVersion, durationMs } = {},
 ) {
+  const duration = normalizeCompactDuration(durationMs);
   appendEvent(sessionId, "tool_call", {
     tool: tool || "?",
     is_error: Boolean(isError),
     ...(skill ? { skill: String(skill) } : {}),
+    ...(plugin ? { plugin: String(plugin) } : {}),
+    ...(pluginVersion ? { plugin_version: String(pluginVersion) } : {}),
+    ...(duration !== null ? { duration_ms: duration } : {}),
+  });
+}
+
+/** Hard cap for one observed failed LLM/tool attempt (seven days). */
+export const MAX_COMPACT_DURATION_MS = 7 * 24 * 60 * 60 * 1000;
+
+function normalizeCompactDuration(value) {
+  if (value === null || value === undefined || value === "") return null;
+  const number = Number(value);
+  if (!Number.isFinite(number) || number < 0) return null;
+  return Math.min(MAX_COMPACT_DURATION_MS, Math.round(number));
+}
+
+/**
+ * Persist one automatic LLM stream retry without raw errors, prompts, URLs, or
+ * credentials. Provider/model are bounded identity labels; reason is a closed
+ * vocabulary produced by classifyStreamRetryReason().
+ */
+export function appendLlmRetryCompact(
+  sessionId,
+  { attempt, durationMs, provider, model, reason } = {},
+) {
+  const attemptNumber = Math.max(
+    1,
+    Math.min(15, Math.trunc(Number(attempt) || 1)),
+  );
+  const duration = normalizeCompactDuration(durationMs);
+  const cleanLabel = (value, max) => {
+    if (typeof value !== "string") return null;
+    const clean = value.replace(/\p{Cc}/gu, "").trim();
+    return clean ? clean.slice(0, max) : null;
+  };
+  const allowedReasons = new Set([
+    "timeout",
+    "dns",
+    "connection_refused",
+    "network_unreachable",
+    "connection_reset",
+    "unknown",
+  ]);
+  const cleanReason = allowedReasons.has(reason) ? reason : "unknown";
+  const cleanProvider = cleanLabel(provider, 64);
+  const cleanModel = cleanLabel(model, 128);
+  appendEvent(sessionId, "llm_retry", {
+    attempt: attemptNumber,
+    duration_ms: duration ?? 0,
+    reason: cleanReason,
+    ...(cleanProvider ? { provider: cleanProvider } : {}),
+    ...(cleanModel ? { model: cleanModel } : {}),
   });
 }
 

package/src/harness/mcp-client.js

@@ -14,6 +14,7 @@ import { EventEmitter } from "events";
 import { pathToFileURL } from "url";
 import { safeJsonParse } from "../lib/safe-json.js";
 import { EventRuntimeProducer } from "../lib/event-runtime-producer.js";
+import { resolvePluginWorkspaceAuthority } from "../lib/plugin-runtime/sandbox-policy.js";
 
 /**
  * Injectable dependencies — overridable from tests.
@@ -62,8 +63,7 @@ const URL_ELICITATION_REQUIRED = -32042;
 function supportsUrlElicitationVersion(version) {
   const normalized = String(version || "");
   return (
-    /^\d{4}-\d{2}-\d{2}$/.test(normalized) &&
-    normalized >= MCP_PROTOCOL_VERSION
+    /^\d{4}-\d{2}-\d{2}$/.test(normalized) && normalized >= MCP_PROTOCOL_VERSION
   );
 }
 
@@ -130,9 +130,7 @@ export function normalizeMcpElicitationRequest(
 
   const elicitationId = String(params.elicitationId || "").trim();
   if (!elicitationId) {
-    const error = new Error(
-      "URL mode MCP elicitation requires elicitationId",
-    );
+    const error = new Error("URL mode MCP elicitation requires elicitationId");
     error.code = "CC_MCP_ELICITATION_INVALID";
     throw error;
   }
@@ -267,10 +265,14 @@ export class MCPClient extends EventEmitter {
       Number(options.maxConcurrentElicitations) > 0
         ? Math.min(128, Number(options.maxConcurrentElicitations))
         : 32;
-    this._protocolVersion =
-      String(options.protocolVersion || MCP_PROTOCOL_VERSION);
+    this._protocolVersion = String(
+      options.protocolVersion || MCP_PROTOCOL_VERSION,
+    );
     this._runtimeProducer = options.eventRuntimeStore
-      ? new EventRuntimeProducer({ store: options.eventRuntimeStore, emitter: this })
+      ? new EventRuntimeProducer({
+          store: options.eventRuntimeStore,
+          emitter: this,
+        })
       : null;
   }
 
@@ -279,11 +281,11 @@ export class MCPClient extends EventEmitter {
     const sessionId = options.sessionId;
     if (sessionId != null && sessionId !== "") {
       const key = String(sessionId);
-      if (typeof handler === "function") this._elicitationHandlers.set(key, handler);
+      if (typeof handler === "function")
+        this._elicitationHandlers.set(key, handler);
       else this._elicitationHandlers.delete(key);
     } else {
-      this._elicitationHandler =
-        typeof handler === "function" ? handler : null;
+      this._elicitationHandler = typeof handler === "function" ? handler : null;
     }
     if (Number(options.timeoutMs) > 0) {
       this._elicitationTimeoutMs = Number(options.timeoutMs);
@@ -389,8 +391,9 @@ export class MCPClient extends EventEmitter {
       requestId,
       params,
     );
-    const negotiatedVersion =
-      this.servers.get(String(serverName))?.protocolVersion;
+    const negotiatedVersion = this.servers.get(
+      String(serverName),
+    )?.protocolVersion;
     if (
       request.mode === "url" &&
       negotiatedVersion &&
@@ -431,10 +434,7 @@ export class MCPClient extends EventEmitter {
           direct !== undefined &&
           String(direct?.action || "").toLowerCase() !== "defer"
         ) {
-          const response = this._normalizeElicitationResponse(
-            direct,
-            request,
-          );
+          const response = this._normalizeElicitationResponse(direct, request);
           this._settleUrlElicitation(request, response);
           try {
             this._runtimeProducer?.store.acknowledgeInbox(
@@ -504,7 +504,8 @@ export class MCPClient extends EventEmitter {
       });
       this.emit("elicitation-request", {
         ...request,
-        respond: (response) => this.respondElicitation(serverName, requestId, response),
+        respond: (response) =>
+          this.respondElicitation(serverName, requestId, response),
         cancel: () => this.cancelElicitation(serverName, requestId),
       });
     });
@@ -515,9 +516,7 @@ export class MCPClient extends EventEmitter {
     if (!id) return;
     const existing = this._urlElicitations.get(id);
     if (existing && existing.server !== request.server) {
-      throw new Error(
-        `MCP URL elicitation id collision across servers: ${id}`,
-      );
+      throw new Error(`MCP URL elicitation id collision across servers: ${id}`);
     }
     if (existing && existing.request?.url !== request.url) {
       throw new Error(
@@ -544,7 +543,9 @@ export class MCPClient extends EventEmitter {
     const entry = this._urlElicitations.get(request.elicitationId);
     if (!entry || entry.status === "completed") return;
     entry.status =
-      response?.action === "accept" ? "accepted" : response?.action || "decline";
+      response?.action === "accept"
+        ? "accepted"
+        : response?.action || "decline";
     if (entry.status === "accepted" && entry.completionNotified) {
       this._completeUrlElicitation(entry);
     }
@@ -757,7 +758,26 @@ export class MCPClient extends EventEmitter {
             `stdio transport requires a command (server "${name}")`,
           );
         }
-        const proc = _deps.spawn(config.command, config.args || [], {
+        const isPlugin = config.origin === "plugin:mcp";
+        const pluginWorkspaceRoot = isPlugin
+          ? resolvePluginWorkspaceAuthority(config.pluginWorkspaceAuthority, {
+              origin: config.origin,
+              pluginId: config.pluginId,
+              pluginVersion: config.pluginVersion,
+              pluginSource: config.pluginSource,
+            })
+          : null;
+        if (
+          isPlugin &&
+          config.sandboxPolicy?.requiredBoundaries?.length > 0 &&
+          !pluginWorkspaceRoot
+        ) {
+          throw new Error(
+            `plugin MCP server "${name}" is missing its trusted workspace authority`,
+          );
+        }
+        const spawnOptions = {
+          cwd: pluginWorkspaceRoot || process.cwd(),
           stdio: ["pipe", "pipe", "pipe"],
           // process.env < agent identity (CLAUDECODE / session id) < the
           // server's own config.env, so an explicit per-server override wins.
@@ -776,6 +796,19 @@ export class MCPClient extends EventEmitter {
           ...(config.sandboxPolicy
             ? { sandboxPolicy: config.sandboxPolicy }
             : {}),
+        };
+        const sandboxExecutionContract =
+          !isPlugin || pluginWorkspaceRoot
+            ? executionBroker.issueLinuxWorkspaceSandboxExecutionContract(
+                config.command,
+                config.args || [],
+                spawnOptions,
+                pluginWorkspaceRoot || process.cwd(),
+              )
+            : null;
+        const proc = _deps.spawn(config.command, config.args || [], {
+          ...spawnOptions,
+          ...(sandboxExecutionContract ? { sandboxExecutionContract } : {}),
         });
 
         entry.process = proc;
@@ -1113,7 +1146,8 @@ export class MCPClient extends EventEmitter {
       } catch {
         return false;
       }
-      if (request.mode !== "url" || ids.has(request.elicitationId)) return false;
+      if (request.mode !== "url" || ids.has(request.elicitationId))
+        return false;
       ids.add(request.elicitationId);
       normalized.push(request);
     }
@@ -1392,10 +1426,7 @@ export class MCPClient extends EventEmitter {
     entry._httpMessageStream = stream;
     stream.promise = (async () => {
       try {
-        while (
-          !stream.stopped &&
-          this.servers.get(serverName) === entry
-        ) {
+        while (!stream.stopped && this.servers.get(serverName) === entry) {
           stream.controller =
             typeof AbortController === "function"
               ? new AbortController()
@@ -1427,9 +1458,7 @@ export class MCPClient extends EventEmitter {
               );
             }
             const contentType = response.headers?.get
-              ? String(
-                  response.headers.get("content-type") || "",
-                ).toLowerCase()
+              ? String(response.headers.get("content-type") || "").toLowerCase()
               : "";
             if (!contentType.includes("text/event-stream")) return;
             const cap = Number.isFinite(entry.config?.maxBufferChars)
@@ -1438,8 +1467,7 @@ export class MCPClient extends EventEmitter {
             await _consumeSseMessageStream(response, {
               cap,
               stream,
-              onMessage: (message) =>
-                this._handleMessage(serverName, message),
+              onMessage: (message) => this._handleMessage(serverName, message),
             });
           } catch (error) {
             if (stream.stopped || stream.controller?.signal.aborted) return;
@@ -1564,11 +1592,8 @@ export class MCPClient extends EventEmitter {
 
       let envelope;
       if (contentType.includes("text/event-stream")) {
-        envelope = await _extractSseResponse(
-          response,
-          id,
-          cap,
-          (message) => this._handleMessage(serverName, message),
+        envelope = await _extractSseResponse(response, id, cap, (message) =>
+          this._handleMessage(serverName, message),
         );
       } else {
         const text = await _readBodyCapped(response, cap);
@@ -1813,8 +1838,7 @@ export class MCPClient extends EventEmitter {
         ...(entry.httpSessionId
           ? { "Mcp-Session-Id": entry.httpSessionId }
           : {}),
-        "MCP-Protocol-Version":
-          entry.protocolVersion || this._protocolVersion,
+        "MCP-Protocol-Version": entry.protocolVersion || this._protocolVersion,
       };
       try {
         const pending = _deps.fetch(entry.httpUrl, {
@@ -1986,9 +2010,7 @@ async function _consumeSseMessageStream(
       if (done) break;
       buffer += decoder.decode(value, { stream: true });
       if (cap > 0 && buffer.length > cap) {
-        throw new Error(
-          `MCP HTTP SSE event exceeded the ${cap}-char cap`,
-        );
+        throw new Error(`MCP HTTP SSE event exceeded the ${cap}-char cap`);
       }
       let boundary;
       while ((boundary = buffer.search(/\r?\n\r?\n/)) >= 0) {