chainlesschain 0.162.188 → 0.162.193

package/src/runtime/headless-stream.js

@@ -17,6 +17,7 @@
  */
 
 import { randomUUID } from "node:crypto";
+import { isProxy } from "node:util/types";
 import {
   approvalBindingDigest,
   verifyApprovalBinding,
@@ -85,10 +86,17 @@ import {
   appendToolCallCompact as jsonlAppendToolCallCompact,
   appendLlmRetryCompact as jsonlAppendLlmRetryCompact,
   appendEvent as jsonlAppendEvent,
+  appendAuthorityEvent as jsonlAppendAuthorityEvent,
   readEvents as jsonlReadEvents,
-  rebuildMessages as jsonlRebuildMessages,
+  readVerifiedEvents as jsonlReadVerifiedEvents,
+  readVerifiedProjection as jsonlReadVerifiedProjection,
+  findLatestEvent as jsonlFindLatestEvent,
   sessionExists as jsonlSessionExists,
 } from "../harness/jsonl-session-store.js";
+import {
+  isVerifiedSessionHostSnapshot,
+  readSessionHostResumeState,
+} from "../lib/session-host-snapshot.js";
 import { classifyStreamRetryReason } from "../lib/stream-retry.js";
 import {
   SideEffectLedger,
@@ -100,6 +108,11 @@ import {
   loadSideEffectLedger,
   persistSideEffectLedger,
 } from "../lib/side-effect-ledger-store.js";
+import {
+  createSessionMcpLedgerSink,
+  formatMcpLedgerRecoveryNotice,
+} from "../lib/mcp-call-ledger-store.js";
+import { createMcpHostRecoveryRuntime } from "../lib/mcp-host-recovery-runtime.js";
 import { operationIdempotencyKey } from "../lib/idempotency.js";
 import { TurnBindingLog, createTurnBindingFeed } from "../lib/turn-binding.js";
 import { TURN_BINDING_EVENT } from "../lib/turn-binding-store.js";
@@ -111,6 +124,35 @@ import {
 } from "./session-slash-commands.js";
 import { extractPluginUsageAttribution } from "../lib/plugin-usage-attribution.js";
 
+function invalidMcpRecoveryTransaction(capability, expected) {
+  const error = new TypeError(
+    `${capability} must ${expected} synchronously during MCP recovery`,
+  );
+  error.code = "CC_MCP_LEDGER_RECOVERY_TRANSACTION_INVALID";
+  return error;
+}
+
+function requireSynchronousRecoveryResult(value, capability) {
+  if (
+    value === null ||
+    value === undefined ||
+    (typeof value !== "object" && typeof value !== "function")
+  ) {
+    return value;
+  }
+  if (isProxy(value)) {
+    throw invalidMcpRecoveryTransaction(capability, "return a non-Proxy value");
+  }
+  if (typeof value.then === "function") {
+    // The async result is never authority, but a rejected Promise still needs
+    // an observer so rejecting it fail-closed does not leak an unhandled
+    // rejection into the host process.
+    void Promise.resolve(value).catch(() => {});
+    throw invalidMcpRecoveryTransaction(capability, "complete");
+  }
+  return value;
+}
+
 /**
  * Resolve the streaming-delta coalesce window (ms). Adjacent partial-message
  * text/thinking deltas are batched into a single `stream_event` line over this
@@ -943,6 +985,7 @@ async function runTurn(
           provider: event.provider,
           model: event.model,
           usage: event.usage,
+          ...(event.source ? { source: event.source } : {}),
         });
         if (costBudget) {
           costBudget.add({
@@ -1013,6 +1056,168 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
   const provider = options.provider || "ollama";
   const baseUrl = options.baseUrl || "http://localhost:11434";
   const apiKey = options.apiKey || null;
+  const writeOut = deps.writeOut || ((s) => process.stdout.write(s));
+  const writeErr = deps.writeErr || ((s) => process.stderr.write(s));
+  if (!deps.writeOut && !deps.writeErr) installPipeSafety();
+
+  const sessionId =
+    options.sessionId || `headless-stream-${Date.now()}-${process.pid}`;
+  const persist = Boolean(options.sessionId) && options.ephemeral !== true;
+  const traceId = resolveTraceId(options, process.env, deps);
+  const fieldGate = {
+    seq: true,
+    trace_id: true,
+    tool_use_id: true,
+    permission_decision: true,
+  };
+  const streamCoalescer =
+    deps.streamCoalescer ||
+    createStreamCoalescer({
+      writeOut,
+      coalesceMs: resolveStreamCoalesceMs(options, process.env),
+      traceId,
+      fieldGate,
+    });
+  const emit = streamCoalescer.emit;
+
+  const hasInjectedSessionStore =
+    typeof deps.sessionExists === "function" ||
+    typeof deps.rebuildMessages === "function" ||
+    typeof deps.appendEvent === "function" ||
+    typeof deps.appendAuthorityEvent === "function" ||
+    typeof deps.readVerifiedEvents === "function" ||
+    typeof deps.readVerifiedProjection === "function";
+  const unavailableAuthorityCapability = (operation) => () => {
+    const error = new Error(
+      `Injected session store must provide ${operation} for MCP authority`,
+    );
+    error.code = "SESSION_AUTHORITY_CAPABILITY_UNAVAILABLE";
+    throw error;
+  };
+
+  // A persisted stream resume is an authority boundary, not best-effort chat
+  // history. Resolve it before config/settings, Setup hooks, bootstrap, MCP,
+  // model or tool access. The canonical reader folds active messages and MCP
+  // recovery from one verified, anchored transcript sample under the writer
+  // lock; a damaged or asynchronous seam refuses the entire host session.
+  let canonicalResume = null;
+  let canonicalResumeMessages = null;
+  let canonicalMcpCallRecovery = null;
+  if (persist) {
+    const readResumeState =
+      deps.readSessionHostResumeState || readSessionHostResumeState;
+    const readVerifiedEvents =
+      deps.readVerifiedEvents ||
+      (hasInjectedSessionStore
+        ? unavailableAuthorityCapability("readVerifiedEvents")
+        : jsonlReadVerifiedEvents);
+    const readVerifiedProjection =
+      typeof deps.readVerifiedProjection === "function"
+        ? deps.readVerifiedProjection
+        : !hasInjectedSessionStore
+          ? jsonlReadVerifiedProjection
+          : null;
+    const resumeDependencies = {
+      sessionExists: deps.sessionExists || jsonlSessionExists,
+      readVerifiedEvents: (...args) =>
+        requireSynchronousRecoveryResult(
+          readVerifiedEvents(...args),
+          "readVerifiedEvents",
+        ),
+      ...(readVerifiedProjection
+        ? {
+            readVerifiedProjection: (...args) =>
+              requireSynchronousRecoveryResult(
+                readVerifiedProjection(...args),
+                "readVerifiedProjection",
+              ),
+          }
+        : {}),
+    };
+    try {
+      const existingSession = requireSynchronousRecoveryResult(
+        resumeDependencies.sessionExists(sessionId),
+        "sessionExists",
+      );
+      if (typeof existingSession !== "boolean") {
+        throw invalidMcpRecoveryTransaction(
+          "sessionExists",
+          "return a boolean",
+        );
+      }
+      canonicalResume = existingSession
+        ? requireSynchronousRecoveryResult(
+            readResumeState(sessionId, {
+              ...resumeDependencies,
+              sessionExists: () => true,
+            }),
+            "readSessionHostResumeState",
+          )
+        : null;
+      if (canonicalResume !== null) {
+        if (
+          isProxy(canonicalResume) ||
+          !isVerifiedSessionHostSnapshot(canonicalResume.snapshot) ||
+          !Array.isArray(canonicalResume.messages) ||
+          isProxy(canonicalResume.messages) ||
+          !canonicalResume.recovery ||
+          typeof canonicalResume.recovery !== "object" ||
+          isProxy(canonicalResume.recovery) ||
+          !Array.isArray(canonicalResume.recovery.unsettled) ||
+          isProxy(canonicalResume.recovery.unsettled) ||
+          !Array.isArray(canonicalResume.recovery.incidents) ||
+          isProxy(canonicalResume.recovery.incidents)
+        ) {
+          throw invalidMcpRecoveryTransaction(
+            "readSessionHostResumeState",
+            "return one verified session-host projection",
+          );
+        }
+        if (
+          !canonicalResume.messages.every(
+            (message) =>
+              message &&
+              !isProxy(message) &&
+              ["system", "user", "assistant", "tool"].includes(message.role),
+          )
+        ) {
+          throw invalidMcpRecoveryTransaction(
+            "readSessionHostResumeState",
+            "return plain replay messages with supported roles",
+          );
+        }
+        canonicalResumeMessages = [...canonicalResume.messages];
+        const notice = formatMcpLedgerRecoveryNotice(canonicalResume.recovery);
+        if (notice) {
+          canonicalMcpCallRecovery = {
+            count: canonicalResume.recovery.unsettled.length,
+            incidents: canonicalResume.recovery.incidents.length,
+            items: canonicalResume.recovery.unsettled
+              .slice(0, 10)
+              .map((record) => ({
+                ledgerId: record.ledgerId,
+                server: record.serverName,
+                tool: record.toolName,
+                effect: record.effectContract?.effect || "unknown",
+              })),
+            notice,
+          };
+        }
+      }
+    } catch {
+      const code = "CC_SESSION_HOST_SNAPSHOT_UNVERIFIED";
+      emit({
+        type: "result",
+        subtype: "error_session_resume",
+        is_error: true,
+        code,
+        error: "Canonical stream session could not be verified",
+        session_id: sessionId,
+      });
+      writeErr(`${code}: canonical stream resume was refused\n`);
+      return { exitCode: 1, turns: 0 };
+    }
+  }
   // Vision model (config.llm.visionModel) — image turns switch to it for that
   // turn only (resolveVisionLlm falls back to the default when unset), so a
   // pasted/typed image is read by a vision-capable model even though the
@@ -1067,12 +1272,19 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
   let settingsHooks = options.settingsHooks || null;
   if (!settingsHooks) {
     try {
-      const { loadHooks, projectHookTrustNotice } =
+      const { loadHooks, projectHookTrustNotice, attachAuthorityErrors } =
         await import("../lib/settings-hooks.cjs");
       const loaded = loadHooks({ cwd, settingsFile: options.settingsFile });
+      const { mergePluginHooks } =
+        await import("../lib/plugin-runtime/hooks.js");
+      const effectiveHooks = mergePluginHooks(
+        attachAuthorityErrors(loaded.hooks, loaded.authorityErrors),
+        { cwd },
+      );
       settingsHooks =
-        loaded.hooks && Object.keys(loaded.hooks).length > 0
-          ? loaded.hooks
+        Object.keys(effectiveHooks).length > 0 ||
+        effectiveHooks._authorityErrors.length > 0
+          ? effectiveHooks
           : null;
       // First-run trust notice for an untrusted/cloned repo's shell-running
       // hooks (Claude-Code 2.1.195 parity). stderr keeps the NDJSON stdout clean.
@@ -1085,8 +1297,17 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
       } catch {
         /* trust notice is best-effort */
       }
-    } catch {
-      settingsHooks = null; // fail-open
+    } catch (error) {
+      settingsHooks = {};
+      Object.defineProperty(settingsHooks, "_authorityErrors", {
+        value: Object.freeze([
+          Object.freeze({
+            sourceFile: null,
+            code: error?.code || "CC_HOOK_AUTHORITY_LOAD_FAILED",
+          }),
+        ]),
+        enumerable: false,
+      });
     }
   }
 
@@ -1113,44 +1334,6 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
   const doExpand = deps.expandFileRefs || expandFileRefsAsync;
   const runSessionSlashCommand =
     deps.executeSessionSlashCommand || executeSessionSlashCommand;
-  const writeOut = deps.writeOut || ((s) => process.stdout.write(s));
-  const writeErr = deps.writeErr || ((s) => process.stderr.write(s));
-  // Guard the real stdout/stderr against a downstream `| head` closing the pipe
-  // (unhandled async EPIPE → crash). Only when we own the streams (no injected
-  // seams = production, not tests). Idempotent; shared with the -p runner.
-  if (!deps.writeOut && !deps.writeErr) {
-    installPipeSafety();
-  }
-  // Run-scoped cross-event trace id (additive protocol-v1, docs/PROTOCOL.md
-  // §1.2.1): one id stamped on EVERY stdout line so a consumer can correlate
-  // the whole run across Webview → Bridge → CLI logs, transcripts and
-  // diagnostic bundles. The IDE bridge may thread its own id through
-  // `--trace-id` / options.traceId / CC_TRACE_ID; otherwise a per-process id
-  // is minted (unique even when two runs resume the same session_id).
-  const traceId = resolveTraceId(options, process.env, deps);
-  // Live field-gate for the capability handshake (docs/PROTOCOL.md §1.3): a
-  // client `hello` narrowing the wire features flips these to suppress the
-  // additive fields it can't parse. All true by default = current behavior
-  // byte-for-byte; the coalescer reads it per line.
-  const fieldGate = {
-    seq: true,
-    trace_id: true,
-    tool_use_id: true,
-    permission_decision: true,
-  };
-  // Batch consecutive partial-message text/thinking deltas into one stream_event
-  // line (Claude-Code 2.1.191 streaming-CPU optimization). `emit` flushes any
-  // pending deltas before writing a non-delta line, so ordering is preserved;
-  // CC_STREAM_COALESCE_MS=0 restores the per-token emit behavior.
-  const streamCoalescer =
-    deps.streamCoalescer ||
-    createStreamCoalescer({
-      writeOut,
-      coalesceMs: resolveStreamCoalesceMs(options, process.env),
-      traceId,
-      fieldGate,
-    });
-  const emit = streamCoalescer.emit;
 
   const getApprovalGate =
     deps.getApprovalGate ||
@@ -1181,9 +1364,6 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
     // DB optional — static-prompt fallback.
   }
 
-  const sessionId =
-    options.sessionId || `headless-stream-${Date.now()}-${process.pid}`;
-
   const setupHooks = await executeLifecycleHooks(
     "Setup",
     {
@@ -1216,6 +1396,23 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
   // prior history is rebuilt into the conversation and every new turn is
   // appended, so a later run with the same id picks up where this one left
   // off. Anonymous runs (no id) stay persistence-free, exactly as before.
+  const storeReadEvents = deps.readEvents || jsonlReadEvents;
+  const storeFindLatestEvent =
+    deps.findLatestEvent ||
+    (deps.readEvents
+      ? (sessionId, type, predicate = null) => {
+          const events = storeReadEvents(sessionId) || [];
+          for (let index = events.length - 1; index >= 0; index -= 1) {
+            const event = events[index];
+            if (type != null && event?.type !== type) continue;
+            if (typeof predicate === "function" && !predicate(event)) continue;
+            return event;
+          }
+          return null;
+        }
+      : hasInjectedSessionStore
+        ? () => null
+        : jsonlFindLatestEvent);
   const store = {
     sessionExists: deps.sessionExists || jsonlSessionExists,
     startSession: deps.startSession || jsonlStartSession,
@@ -1223,16 +1420,35 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
     appendAssistantMessage:
       deps.appendAssistantMessage || jsonlAppendAssistantMessage,
     appendToolCallCompact:
-      deps.appendToolCallCompact || jsonlAppendToolCallCompact,
+      deps.appendToolCallCompact ||
+      (hasInjectedSessionStore ? () => true : jsonlAppendToolCallCompact),
     appendLlmRetryCompact:
-      deps.appendLlmRetryCompact || jsonlAppendLlmRetryCompact,
-    appendEvent: deps.appendEvent || jsonlAppendEvent,
-    readEvents: deps.readEvents || jsonlReadEvents,
-    rebuildMessages: deps.rebuildMessages || jsonlRebuildMessages,
+      deps.appendLlmRetryCompact ||
+      (hasInjectedSessionStore ? () => true : jsonlAppendLlmRetryCompact),
+    appendEvent:
+      deps.appendEvent ||
+      (hasInjectedSessionStore ? () => true : jsonlAppendEvent),
+    appendAuthorityEvent:
+      deps.appendAuthorityEvent ||
+      (hasInjectedSessionStore
+        ? unavailableAuthorityCapability("appendAuthorityEvent")
+        : jsonlAppendAuthorityEvent),
+    readEvents: storeReadEvents,
+    readVerifiedEvents:
+      deps.readVerifiedEvents ||
+      (hasInjectedSessionStore
+        ? unavailableAuthorityCapability("readVerifiedEvents")
+        : jsonlReadVerifiedEvents),
+    readVerifiedProjection:
+      deps.readVerifiedProjection ||
+      (hasInjectedSessionStore ? null : jsonlReadVerifiedProjection),
+    findLatestEvent: storeFindLatestEvent,
   };
-  // --ephemeral forces persistence OFF even with an explicit session id (the
-  // id is kept for event correlation only; nothing is written or replayed).
-  const persist = Boolean(options.sessionId) && options.ephemeral !== true;
+  const mcpLedgerSink = persist
+    ? createSessionMcpLedgerSink(sessionId, {
+        appendEvent: store.appendAuthorityEvent,
+      })
+    : null;
 
   // ── P0-2: crash-safe side-effect ledger — the stream twin of the
   // single-prompt runner (headless-runner.js) and the WS bridge
@@ -1328,17 +1544,13 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
   };
   if (persist) {
     try {
-      const priorEvents = store.readEvents(sessionId) || [];
-      for (let index = priorEvents.length - 1; index >= 0; index--) {
-        const event = priorEvents[index];
-        if (
-          event?.type === TURN_BINDING_EVENT &&
-          event.data &&
-          typeof event.data === "object"
-        ) {
-          turnBindingLog = TurnBindingLog.fromJSON(event.data);
-          break;
-        }
+      const event = store.findLatestEvent(
+        sessionId,
+        TURN_BINDING_EVENT,
+        (candidate) => candidate?.data && typeof candidate.data === "object",
+      );
+      if (event) {
+        turnBindingLog = TurnBindingLog.fromJSON(event.data);
       }
     } catch (error) {
       recordTurnBindingFailure(error, "read");
@@ -1705,34 +1917,53 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
   // leads; persisted system turns are dropped, mirroring runAgentHeadless).
   let resumedMessages = 0;
   let sideEffectRecovery = null;
+  let mcpCallRecovery = null;
+  let mcpLedgerRecovery = null;
+  let mcpLedgerRecoveryError = null;
   if (persist) {
-    try {
-      if (store.sessionExists(sessionId)) {
-        // P0-2: reconcile the crash-safe ledger on resume (parity with
-        // runAgentHeadless + the WS bridge). The verify-before-replay system
-        // note goes BEFORE the replayed history — the same slot the
-        // single-prompt runner uses — which also keeps the trailing-role
-        // resume-degeneracy check below intact.
-        if (sideEffectLedger) {
-          sideEffectRecovery = buildSideEffectRecovery(sideEffectLedger);
-        }
-        if (sideEffectRecovery) {
-          messages.push({ role: "system", content: sideEffectRecovery.notice });
-        }
-        const history = (store.rebuildMessages(sessionId) || []).filter(
-          (m) => m && m.role !== "system",
+    if (canonicalResume) {
+      // The history and MCP authority below came from the same verified head.
+      // No second pathname read is allowed between verification and replay.
+      if (sideEffectLedger) {
+        sideEffectRecovery = buildSideEffectRecovery(sideEffectLedger);
+      }
+      if (sideEffectRecovery) {
+        messages.push({ role: "system", content: sideEffectRecovery.notice });
+      }
+      mcpLedgerRecovery = canonicalResume.recovery;
+      mcpCallRecovery = canonicalMcpCallRecovery;
+      if (mcpCallRecovery) {
+        messages.push({ role: "system", content: mcpCallRecovery.notice });
+      }
+      messages.push(...canonicalResumeMessages);
+      // Preserve the existing public counter semantics: control-plane stream
+      // metadata counts conversational turns, never private system context.
+      resumedMessages = canonicalResumeMessages.filter(
+        (message) => message.role !== "system",
+      ).length;
+    } else {
+      try {
+        requireSynchronousRecoveryResult(
+          store.startSession(sessionId, {
+            title: "stream session",
+            provider,
+            model,
+          }),
+          "startSession",
         );
-        messages.push(...history);
-        resumedMessages = history.length;
-      } else {
-        store.startSession(sessionId, {
-          title: "stream session",
-          provider,
-          model,
+      } catch {
+        const code = "CC_SESSION_PERSISTENCE_START_FAILED";
+        emit({
+          type: "result",
+          subtype: "error_session_persistence",
+          is_error: true,
+          code,
+          error: "Canonical stream session could not be created",
+          session_id: sessionId,
         });
+        writeErr(`${code}: canonical stream session creation was refused\n`);
+        return { exitCode: 1, turns: 0 };
       }
-    } catch {
-      // persistence is best-effort — never fail the stream over it
     }
   }
 
@@ -1794,6 +2025,17 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
       session_id: sessionId,
     });
   }
+  if (mcpCallRecovery) {
+    emit({
+      type: "raw",
+      subtype: "mcp_call_recovery",
+      text: `⚠️ ${mcpCallRecovery.count} interrupted MCP call(s) and ${mcpCallRecovery.incidents} ledger incident(s) need inspection before replay (resume ${sessionId}).`,
+      count: mcpCallRecovery.count,
+      incidents: mcpCallRecovery.incidents,
+      items: mcpCallRecovery.items,
+      session_id: sessionId,
+    });
+  }
 
   // Goal binding (cc goal, Phase 1) — resolved once and injected on every turn.
   // `--goal <id>` binds explicitly; `--goal` with no value auto-resolves.
@@ -1872,6 +2114,17 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
     }
   }
 
+  const mcpRecoveryRuntime = createMcpHostRecoveryRuntime({
+    bundle: mcp,
+    sessionId,
+    sink: mcpLedgerSink,
+    recovery: mcpLedgerRecovery,
+    recoveryError: mcpLedgerRecoveryError,
+  });
+  const hostMcp = mcp
+    ? { ...mcp, mcpClient: mcpRecoveryRuntime.client || mcp.mcpClient }
+    : null;
+
   // MCP servers may pause a tool flow with `elicitation/create`. Register the
   // handler only after MCP resolution so the client is initialized before use.
   // Reuse the structured Desktop/headless question channel, while preserving
@@ -1968,12 +2221,12 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
   // workspace-root list to connected MCP servers when the stream session started
   // with extra roots. No --add-dir → workspaceRootDirs = [cwd] → no-op. Mirrors
   // the single-prompt runner + the REPL /add-dir path. Best-effort.
-  if (mcp?.mcpClient && additionalDirectories.length > 0) {
+  if (hostMcp?.mcpClient && additionalDirectories.length > 0) {
     try {
       const { notifyMcpRootsChanged, workspaceRootDirs } =
         await import("../repl/add-dir.js");
       notifyMcpRootsChanged(
-        [mcp.mcpClient],
+        [hostMcp.mcpClient],
         workspaceRootDirs(options.cwd || process.cwd(), additionalDirectories),
       );
     } catch {
@@ -2000,7 +2253,7 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
     if (approvalGate && typeof approvalGate.setConfirmer === "function") {
       approvalGate.setConfirmer(
         makePermissionPromptConfirmer({
-          mcpClient: mcp.mcpClient,
+          mcpClient: hostMcp.mcpClient,
           server: ppt.server,
           tool: ppt.tool,
         }),
@@ -2057,6 +2310,7 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
     cwd,
     additionalDirectories,
     sessionId,
+    sessionHostSnapshot: canonicalResume?.snapshot || null,
     // Auto-checkpoint (Claude-Code parity): snapshot the work tree before each
     // mutating tool so a stream consumer (e.g. the IDE chat panel) can rewind.
     // Keyed by this run's sessionId — agent-core falls back to it — so the panel
@@ -2065,6 +2319,9 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
     // only, a no-op outside a git repo.
     autoCheckpoint: options.autoCheckpoint || false,
     checkpointSession: options.checkpointSession || sessionId,
+    managedCheckpoint: options.managedCheckpoint === true,
+    managedCheckpointStateDir: options.managedCheckpointStateDir || null,
+    managedCheckpointExclusions: options.managedCheckpointExclusions || [],
     hookDb: db,
     approvalGate,
     permissionRules,
@@ -2086,9 +2343,13 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
     prepareCall: goalPrepareCallFn,
     // --mcp-config wiring (tool defs + dispatch map + live client).
     mcpClient: mcp?.mcpClient || null,
+    mcpHostClient: mcpRecoveryRuntime.client || mcp?.mcpClient || null,
     extraToolDefinitions: mcp?.extraToolDefinitions || undefined,
     externalToolExecutors: mcp?.externalToolExecutors || undefined,
     externalToolDescriptors: mcp?.externalToolDescriptors || undefined,
+    // A null sink disables durable writes, not recovery admission. Retain the
+    // guarded ledger so outcome-unknown calls cannot be retried in-process.
+    mcpCallLedger: mcpRecoveryRuntime.ledger,
     chatFn: deps.chatFn || options.chatFn || undefined,
     signal: options.signal || undefined,
     // --include-partial-messages: stream live assistant-text deltas as
@@ -2709,11 +2970,11 @@ async function runAgentHeadlessStreamInWorkspace(options = {}, deps = {}) {
     try {
       const ideCtx = await (
         deps.buildIdePromptContext || buildIdePromptContext
-      )(mcp);
+      )(hostMcp);
       if (ideCtx) userContent += `\n\n${ideCtx}`;
       // Explicit @selection / @diagnostics mentions (Claude-Code parity);
       // scan the original user event text, append the expansion ephemerally.
-      const mentioned = await expandIdeMentions(parsed.text, mcp);
+      const mentioned = await expandIdeMentions(parsed.text, hostMcp);
       for (const w of mentioned.warnings) writeErr(`  @ide: ${w}\n`);
       if (mentioned.block) userContent += `\n\n${mentioned.block}`;
     } catch {