chainlesschain 0.162.193 → 0.162.198

package/src/commands/skill.js

@@ -46,6 +46,7 @@ import {
   autoFailStuckExecutionsV2,
   getSkillLoaderStatsV2,
 } from "../lib/skill-loader.js";
+import { raceWithAbort, throwIfAborted } from "../lib/abort-utils.js";
 import { getElectronUserDataDir } from "../lib/paths.js";
 import { findProjectRoot } from "../lib/project-detector.js";
 import { loadConfig } from "../lib/config-manager.js";
@@ -130,6 +131,10 @@ export function createControlledSkillScaffold(name, targetDir, io = fs) {
 
 export function createCliSkillReauthorizer(options = {}) {
   return async (request) => {
+    throwIfAborted(
+      request?.signal,
+      "Skill authorization prompt was interrupted",
+    );
     if (options.assumeYes === true) return { authorized: true };
     const stdin = options.stdin || process.stdin;
     const stdout = options.stdout || process.stdout;
@@ -140,12 +145,19 @@ export function createCliSkillReauthorizer(options = {}) {
     const skillId = request?.skill?.id || "unknown";
     const source = request?.skill?.source || "unknown";
     const digest = String(request?.currentDigest || "").slice(0, 24);
-    const authorized = await confirm({
-      message:
-        `Authorize isolated skill "${skillId}" from ${source} ` +
-        `for this process (${digest || "digest unavailable"})?`,
-      default: false,
-    });
+    const authorized = await raceWithAbort(
+      confirm(
+        {
+          message:
+            `Authorize isolated skill "${skillId}" from ${source} ` +
+            `for this process (${digest || "digest unavailable"})?`,
+          default: false,
+        },
+        request?.signal ? { signal: request.signal } : undefined,
+      ),
+      request?.signal,
+      "Skill authorization prompt was interrupted",
+    );
     return { authorized: authorized === true };
   };
 }
@@ -179,7 +191,9 @@ export async function runControlledSkill(options = {}) {
     loader,
     executeTool = null,
     llmOptions = null,
+    signal = null,
   } = options;
+  throwIfAborted(signal, "Skill command interrupted before discovery");
   if (
     !loader ||
     (typeof loader.getResolvedSkills !== "function" &&
@@ -197,52 +211,75 @@ export async function runControlledSkill(options = {}) {
   if (!skill) {
     return { error: `Skill not found: ${name}`, code: "CC_SKILL_NOT_FOUND" };
   }
-  const executionContext = {
-    loadedBecause: "run_skill",
-    bodyIncluded: false,
-  };
-  if (typeof loader.materializeSkillForExecution === "function") {
-    skill = await loader.materializeSkillForExecution(skill, executionContext);
-  } else if (typeof loader.materializeSkill === "function") {
-    skill = loader.materializeSkill(skill, executionContext);
-  }
-  if (skill.isolation !== true) {
-    return {
-      error:
-        `Skill "${skill.id}" is not configured for controlled execution. ` +
-        "Add isolation: true before running it.",
-      code: "CC_SKILL_DIRECT_HANDLER_BLOCKED",
-    };
-  }
-  if (!canRunOnPlatform(skill)) {
-    return {
-      error: `Skill "${skill.id}" is not supported on ${process.platform}`,
-      code: "CC_SKILL_PLATFORM_UNSUPPORTED",
-    };
-  }
-  const dispatch =
-    executeTool || (await import("../runtime/agent-core.js")).executeTool;
-  const result = await dispatch(
-    "run_skill",
-    { skill_name: skill.id, input: String(input) },
-    {
-      cwd,
-      skillLoader: loader,
-      ...(llmOptions ? { llmOptions: { ...llmOptions } } : {}),
-    },
-  );
-  const nestedFailure = /^\s*Sub-agent failed:/i.test(
-    String(result?.summary || ""),
-  );
-  if (result?.error || nestedFailure) {
-    return {
-      ...result,
-      success: false,
-      code: result?.code || "CC_SKILL_CONTROLLED_RUN_FAILED",
-      error: result?.error || result.summary,
+  const executionLease = loader.acquireSkillExecution?.(skill, { signal });
+  const executionSignal = executionLease?.signal || signal;
+  try {
+    const executionContext = {
+      loadedBecause: "run_skill",
+      bodyIncluded: false,
+      signal: executionSignal,
     };
+    if (typeof loader.materializeSkillForExecution === "function") {
+      skill = await raceWithAbort(
+        loader.materializeSkillForExecution(skill, executionContext),
+        executionSignal,
+        "Skill command interrupted during authorization",
+      );
+    } else if (typeof loader.materializeSkill === "function") {
+      skill = loader.materializeSkill(skill, executionContext);
+    }
+    executionLease?.assertActive?.();
+    if (skill.isolation !== true) {
+      return {
+        error:
+          `Skill "${skill.id}" is not configured for controlled execution. ` +
+          "Add isolation: true before running it.",
+        code: "CC_SKILL_DIRECT_HANDLER_BLOCKED",
+      };
+    }
+    if (!canRunOnPlatform(skill)) {
+      return {
+        error: `Skill "${skill.id}" is not supported on ${process.platform}`,
+        code: "CC_SKILL_PLATFORM_UNSUPPORTED",
+      };
+    }
+    const dispatch =
+      executeTool || (await import("../runtime/agent-core.js")).executeTool;
+    executionLease?.assertActive?.();
+    throwIfAborted(
+      executionSignal,
+      "Skill command interrupted before execution",
+    );
+    const result = await raceWithAbort(
+      dispatch(
+        "run_skill",
+        { skill_name: skill.id, input: String(input) },
+        {
+          cwd,
+          skillLoader: loader,
+          ...(executionSignal ? { signal: executionSignal } : {}),
+          ...(llmOptions ? { llmOptions: { ...llmOptions } } : {}),
+        },
+      ),
+      executionSignal,
+      "Skill command interrupted during execution",
+    );
+    executionLease?.assertActive?.();
+    const nestedFailure = /^\s*Sub-agent failed:/i.test(
+      String(result?.summary || ""),
+    );
+    if (result?.error || nestedFailure) {
+      return {
+        ...result,
+        success: false,
+        code: result?.code || "CC_SKILL_CONTROLLED_RUN_FAILED",
+        error: result?.error || result.summary,
+      };
+    }
+    return result;
+  } finally {
+    executionLease?.release?.();
   }
-  return result;
 }
 
 export function registerSkillCommand(program) {

package/src/data/changelog.json

@@ -3,14 +3,27 @@
   "releases": [
     {
       "productVersion": null,
-      "cliVersion": "0.162.193",
-      "cliVersions": ["0.162.189", "0.162.193"],
-      "date": "2026-08-03",
+      "cliVersion": "0.162.198",
+      "cliVersions": ["0.162.197", "0.162.198"],
+      "date": "2026-08-06",
       "title": "",
       "sections": [
         {
-          "heading": "Added — cc CLI 0.162.193: durable sessions, MCP recovery, and checkpoint safety",
-          "body": "> `chainlesschain` **0.162.189 → 0.162.193** (release candidate,\n> 2026-08-03; `0.162.190`, `0.162.191`, and `0.162.192` were never published). CLI-only release metadata;\n> `@chainlesschain/personal-data-hub`\n> remains **0.4.57** and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Safer configuration defaults**: for CLI config writes, schema-declared\n  secrets are refused by `config set` and must use `config set-secret` through\n  hidden TTY/stdin and OS-store or owner-only fallback paths. Explicit\n  `workspace-write` / `strict` isolation and managed-required sandbox policies\n  fail closed when unavailable. `mcp add` now defaults to local scope; both\n  human and JSON `status` use bounded quick probes, while full Docker Compose\n  detail requires `--deep`.\n- **MCP transports and uncertain-outcome recovery**: scoped WebSocket MCP,\n  trusted dynamic headers, timeout notifications, and durable recovery records\n  cover REPL, stream, Cowork/host, and WebSocket paths through shared verified\n  recovery authority. Ambiguous MCP outcomes require verification or\n  adjudication instead of blind replay.\n- **Canonical sessions and resource budgets**: covered REPL, stream,\n  WebSocket, and headless paths use verified transcript projections,\n  transactional summary/compaction state, and reject stale or corrupt resume\n  authority. A persistent session-budget foundation plus background/Team\n  adapters adds fenced token/USD/wall-clock accounting and cleanup; it is not\n  yet a universal cross-host budget authority.\n- **Agent workflow controls**: durable plan/todo state with revision and\n  authority ceilings, controlled skill subagents, background launch profiles,\n  semantic handoff, ephemeral side questions, manifest-driven help, and\n  deterministic shell completions improve Claude Code-style daily workflows.\n  CLI-owned canonical session/checkpoint/delivery projections are consumed by\n  VS Code and JetBrains while mutations stay CLI-authoritative; this CLI-only\n  metadata bump does not bump either IDE package.\n- **Signed native update recovery**: immutable release identity, signed updater\n  rollback chains, atomic download replacement, and portable recovery/cleanup\n  paths add fail-closed activation, rollback, and recovery fences for stale,\n  replaced, or partial payloads.\n- **Checkpoint restore durability**: canonical workspace prestate binding,\n  lifetime locks, immutable Git/copy target identity, copy tombstones and\n  owner-private safety arms feed a hash-chained CAS restore saga shared by\n  direct and timeline restores. A real Git/copy kill/restart matrix covers\n  both the post-completion, pre-lock-release window and mutation-phase partial\n  rollback recovery.\n- **Conservative recovery CLI**: `cc checkpoint recovery`\n  `list/show/abort/resume/rollback/release` derives mutation authority from the\n  current live owner digest or verified owner absence plus exact seq/head\n  fences. `resume` remains limited to a verified already-completed settlement;\n  `rollback --yes` only accepts a verified partial-mutation rollback cycle and\n  dispatches the persisted Git/copy engine rather than re-detecting it.\n- **Verified partial restore rollback**: production Git and copy adapters,\n  crash-safe rollback v2 phase boundaries, and the transaction-fenced\n  `checkpoint_restore_recovery_resolution` event bind workspace and session\n  settlement in both directions. Checkpoint delete, clear, and prune now retain\n  active original/safety authority with expected-identity transactions,\n  no-replace copy publication, and root-bound maintenance locks. This is a\n  narrow partial-restore recovery path, not general multi-resource atomicity,\n  power-loss proof, or checkpoint recovery GA.\n- **Release retry identity**: tags `v-npm-0-162-190`,\n  `v-npm-0-162-191`, and `v-npm-0-162-192` remain immutable records of\n  pre-publication failures.\n  Run `30790359741` exposed an Agent SDK E2E fixture that used its owner-private\n  `CHAINLESSCHAIN_HOME` as the active workspace; the fixture now uses sibling\n  control-state and workspace roots while production path safety remains fail\n  closed. Run `30793513643` passed all tests but exposed root-monorepo\n  `npm sbom` contamination from unrelated desktop/mobile peer graphs; SBOM\n  generation now resolves an ignore-scripts lock from the immutable CLI\n  tarball and validates its CycloneDX package/version identity. Run\n  `30799974832` exposed that the exact-SHA gate queried jobs with\n  `filter=all`, so an earlier failed CLI CI attempt overrode the successful\n  rerun; it now verifies only GitHub's latest attempt. The first `0.162.193`\n  candidate then exposed a recurring macOS two-process CAS race in run\n  `30800530258`: a cooperating owner could remove its lock between the\n  unlocked safety inspection steps, and the loser reported `LOCK_FAILED`\n  instead of reaching the serialized stale-head `CONFLICT`. Unlocked\n  pre/postflight inspection now retries that exact disappearance, while\n  owner-required critical-section checks still fail closed. Deterministic\n  directory/owner disappearance regressions, the full 105-test checkpoint\n  saga suite, and five repeated real-process CAS runs pass locally. None of\n  these runs reached npm publication.\n- **Release status**: `0.162.193` is not published. The exact\n  version/changelog/fix commit must pass `CLI CI` and `CLI Strict Sandbox` on\n  Ubuntu, Windows, and macOS, plus affected `Session Host Consistency`,\n  `CLI Background Interaction E2E`, and immutable npm tarball verification,\n  before tag `v-npm-0-162-193` or npm publication is allowed. Local,\n  older-SHA, and partial results are supplementary only."
+          "heading": "Fixed — cc CLI 0.162.198: interactive streaming and release portability",
+          "body": "> `chainlesschain` **0.162.197 → 0.162.198** (release candidate, 2026-08-06).\n> CLI-only release metadata; `@chainlesschain/personal-data-hub` remains\n> **0.4.57** and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Interactive output backpressure**: REPL, headless streaming, provider\n  pacing, and TTY writers now wait for saturated output streams to drain and\n  clean up pending listeners across completion, interruption, and session\n  transitions instead of allowing unbounded interactive writes.\n- **Canonical session controls**: the CLI-owned session projection and bounded\n  reply routes now support the completed VS Code and JetBrains workbench and\n  rewind journeys while preserving CLI authority over persisted mutations.\n- **Portable release gates**: Windows path-alias fixtures, state-path mocks,\n  Skill metadata fixtures, POSIX executable-bit setup, and the deprecated\n  agent-core shim are aligned with the three-platform CLI CI and Strict\n  Sandbox contracts.\n- **Release readback hardening**: public npm verification remains independent\n  of undeclared runtime dependencies, retries bounded registry propagation,\n  and binds provenance and registry bytes to the immutable publish artifact.\n- **Candidate evidence**: merged implementation SHA `0b7a5471e7a9` passed\n  [CLI CI](https://github.com/chainlesschain/chainlesschain/actions/runs/31071519048)\n  and [CLI Strict Sandbox](https://github.com/chainlesschain/chainlesschain/actions/runs/31071522429)\n  on Ubuntu, Windows, and macOS. The final `0.162.198` version commit must pass\n  both gates again on its own exact SHA before tag `v-npm-0-162-198` is\n  created; local, older-SHA, and partial results remain supplementary only."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.162.197",
+      "cliVersions": ["0.162.189", "0.162.197"],
+      "date": "2026-08-05",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.162.197: durable sessions, MCP recovery, and checkpoint safety",
+          "body": "> `chainlesschain` **0.162.189 → 0.162.197** (published,\n> 2026-08-05; `0.162.190`, `0.162.191`, and `0.162.192` were never published;\n> `0.162.193` was published outside the authoritative CLI release workflow;\n> `0.162.194`, `0.162.195`, and `0.162.196` failed before npm upload and their\n> tags remain immutable).\n> CLI-only release metadata;\n> `@chainlesschain/personal-data-hub`\n> remains **0.4.57** and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Safer configuration defaults**: for CLI config writes, schema-declared\n  secrets are refused by `config set` and must use `config set-secret` through\n  hidden TTY/stdin and OS-store or owner-only fallback paths. Explicit\n  `workspace-write` / `strict` isolation and managed-required sandbox policies\n  fail closed when unavailable. `mcp add` now defaults to local scope; both\n  human and JSON `status` use bounded quick probes, while full Docker Compose\n  detail requires `--deep`.\n- **MCP transports and uncertain-outcome recovery**: scoped WebSocket MCP,\n  trusted dynamic headers, timeout notifications, and durable recovery records\n  cover REPL, stream, Cowork/host, and WebSocket paths through shared verified\n  recovery authority. Ambiguous MCP outcomes require verification or\n  adjudication instead of blind replay.\n- **Canonical sessions and resource budgets**: covered REPL, stream,\n  WebSocket, and headless paths use verified transcript projections,\n  transactional summary/compaction state, and reject stale or corrupt resume\n  authority. A persistent session-budget foundation plus background/Team\n  adapters adds fenced token/USD/wall-clock accounting and cleanup; it is not\n  yet a universal cross-host budget authority.\n- **Agent workflow controls**: durable plan/todo state with revision and\n  authority ceilings, controlled skill subagents, background launch profiles,\n  semantic handoff, ephemeral side questions, manifest-driven help, and\n  deterministic shell completions improve Claude Code-style daily workflows.\n  CLI-owned canonical session/checkpoint/delivery projections are consumed by\n  VS Code and JetBrains while mutations stay CLI-authoritative; this CLI-only\n  metadata bump does not bump either IDE package.\n- **Signed native update recovery**: immutable release identity, signed updater\n  rollback chains, atomic download replacement, and portable recovery/cleanup\n  paths add fail-closed activation, rollback, and recovery fences for stale,\n  replaced, or partial payloads.\n- **Checkpoint restore durability**: canonical workspace prestate binding,\n  lifetime locks, immutable Git/copy target identity, copy tombstones and\n  owner-private safety arms feed a hash-chained CAS restore saga shared by\n  direct and timeline restores. A real Git/copy kill/restart matrix covers\n  both the post-completion, pre-lock-release window and mutation-phase partial\n  rollback recovery.\n- **Conservative recovery CLI**: `cc checkpoint recovery`\n  `list/show/abort/resume/rollback/release` derives mutation authority from the\n  current live owner digest or verified owner absence plus exact seq/head\n  fences. `resume` remains limited to a verified already-completed settlement;\n  `rollback --yes` only accepts a verified partial-mutation rollback cycle and\n  dispatches the persisted Git/copy engine rather than re-detecting it.\n- **Verified partial restore rollback**: production Git and copy adapters,\n  crash-safe rollback v2 phase boundaries, and the transaction-fenced\n  `checkpoint_restore_recovery_resolution` event bind workspace and session\n  settlement in both directions. Checkpoint delete, clear, and prune now retain\n  active original/safety authority with expected-identity transactions,\n  no-replace copy publication, and root-bound maintenance locks. This is a\n  narrow partial-restore recovery path, not general multi-resource atomicity,\n  power-loss proof, or checkpoint recovery GA.\n- **Release retry identity**: tags `v-npm-0-162-190`,\n  `v-npm-0-162-191`, `v-npm-0-162-192`, `v-npm-0-162-194`, and\n  `v-npm-0-162-195` / `v-npm-0-162-196` remain immutable records of\n  pre-publication failures.\n  Run `30790359741` exposed an Agent SDK E2E fixture that used its owner-private\n  `CHAINLESSCHAIN_HOME` as the active workspace; the fixture now uses sibling\n  control-state and workspace roots while production path safety remains fail\n  closed. Run `30793513643` passed all tests but exposed root-monorepo\n  `npm sbom` contamination from unrelated desktop/mobile peer graphs; SBOM\n  generation now resolves an ignore-scripts lock from the immutable CLI\n  tarball and validates its CycloneDX package/version identity. Run\n  `30799974832` exposed that the exact-SHA gate queried jobs with\n  `filter=all`, so an earlier failed CLI CI attempt overrode the successful\n  rerun; it now verifies only GitHub's latest attempt. The first `0.162.193`\n  candidate then exposed a recurring macOS two-process CAS race in run\n  `30800530258`: a cooperating owner could remove its lock between the\n  unlocked safety inspection steps, and the loser reported `LOCK_FAILED`\n  instead of reaching the serialized stale-head `CONFLICT`. Unlocked\n  pre/postflight inspection now retries that exact disappearance, while\n  owner-required critical-section checks still fail closed. Deterministic\n  directory/owner disappearance regressions, the full 105-test checkpoint\n  saga suite, and five repeated real-process CAS runs pass locally.\n  Run `30966796114` passed its exact-SHA gate but failed before package creation\n  when the Agent SDK build assumed a package-local `node_modules/.bin/tsc`.\n  The build now resolves the TypeScript compiler module through Node, supporting\n  both independent installs and npm workspace hoisting; the consumed\n  `v-npm-0-162-194` identity is not moved or reused.\n  Run `30973665834` then passed the exact-SHA gate and all tests, but its\n  immutable package job passed the complete `npm pack --json` result as one\n  command-line argument; the 959-file metadata exceeded Linux `ARG_MAX` before\n  release-manifest creation. Pack metadata now flows through a temporary file,\n  and the consumed `v-npm-0-162-195` identity is also not moved or reused.\n  Run `30976924860` passed all tests, immutable tarball creation, SBOM validation,\n  and artifact upload, but `npm publish` interpreted the bare relative\n  `release-artifacts/...tgz` argument as a GitHub `owner/repo` package spec and\n  failed before upload. The publish step now discovers the tarball through the\n  absolute `$GITHUB_WORKSPACE` path; `v-npm-0-162-196` is not moved or reused.\n- **Release authority containment**: a later generic workspace publisher\n  replaced the dedicated CLI workflow at the same `npm-publish.yml` path.\n  Manually dispatched run `30820089779` therefore auto-selected and published\n  `chainlesschain@0.162.193` from `e8e7ba274b487ed491c04ec3359841a0e545debb`\n  while that SHA's `CLI CI` was still running and eventually failed. The\n  package has npm provenance but no `v-npm-0-162-193` tag, exact-SHA gate\n  attestation, verified immutable tarball/SBOM handoff, or successful complete\n  CLI matrix. The authoritative workflow is restored; the generic publisher\n  is moved to a distinct workflow/tag namespace, while the live CLI path now\n  requires the event ref to exactly match `v-npm-<package-version>` and its\n  checked-out `GITHUB_SHA`. The generic publisher excludes `packages/cli`\n  and package name `chainlesschain` both during detection and immediately\n  before publish. Numeric product releases no longer contain a CLI publisher:\n  they require an already-published `v-npm-*` tag, matching registry `gitHead`,\n  and successful exact-SHA gates before finalizing. The two local generic\n  publisher scripts also exclude and reject the CLI.\n- **Inline-chat release blocker**: the `0.162.193` source registered the six\n  VS Code inline-chat commands twice, invoked non-existent methods in the\n  second registration, and referenced an undefined `outputLog` during\n  activation. The extension now constructs one decorator with the existing\n  chat provider and module logger, registers each contributed command exactly\n  once, and publishes the same six commands through the canonical IDE\n  capability manifest. The activation fake now exercises the decorator path,\n  so constructor or registration regressions fail the CLI matrix.\n- **Production REPL prompt interactions**: each real REPL session now owns a\n  prompt interaction controller and slash-command registry for `/paste-image`,\n  `/editor`, `/stash`, `/suggestions`, and `/recap`. Guarded keypress dispatch\n  consumes configured interaction keys before readline, live assistant/session\n  context feeds manual and automatic suggestions, and local clipboard data\n  images join the existing multimodal vision-provider path while remote image\n  chips fail closed. The focused REPL, prompt, keybinding, image, and provider\n  matrix passes 200/200 locally; the exact-SHA three-platform release gates\n  listed below also passed.\n- **Second command-surface migration batch**: eight explicitly legacy or\n  in-memory governance commands (`bm25`, `ccron`, `compt`, `consol`, `fflag`,\n  `pdfp`, `sganal`, and `vcheck`) now have canonical `cc lab ...` spellings.\n  Their original top-level forms remain compatible through at least `0.164.0`\n  and warn only on stderr. The registered graph remains 175 commands with zero\n  net growth, while the recommended surface drops from 174 to 166; manifest,\n  README, namespace help, and four shell completions share the same lifecycle\n  source. Native manifest generation also now uses the real pure `/doctor`\n  status exports instead of a nonexistent registry import.\n- **Third command-surface migration batch**: fifteen explicitly in-memory V2\n  governance overlays (`execbe`, `itbudget`, `mcpscaf`, `meminj`, `orchgov`,\n  `promcomp`, `seshhook`, `seshsearch`, `seshtail`, `seshu`, `slotfill`,\n  `svccont`, `tms`, `topiccls`, and `uprof`) now use canonical `cc lab ...`\n  spellings. Product-facing `todo`, `subagent`, `webfetch`, and `planmode`\n  remain active top-level commands instead of being migrated by keyword alone.\n  Legacy spellings remain compatible through at least `0.164.0` and warn only\n  on stderr. The registered graph remains 175 commands with zero net growth;\n  the recommended surface drops from 166 to 151, with manifest, README,\n  namespace help, and four shell completions generated from one lifecycle\n  policy.\n- **Published release evidence**: `0.162.193` remains an unauthorized historical\n  registry record and is superseded by `0.162.197`; `0.162.194`, `0.162.195`,\n  and `0.162.196` are not published and their failed tags remain immutable.\n  Tag `v-npm-0-162-197` points to exact commit\n  `a03ad1b548cc6f15c9bef8f82d519e9c625eef8d`. Its\n  [CLI CI](https://github.com/chainlesschain/chainlesschain/actions/runs/30979565407),\n  [CLI Strict Sandbox](https://github.com/chainlesschain/chainlesschain/actions/runs/30979565251),\n  and [dedicated npm release](https://github.com/chainlesschain/chainlesschain/actions/runs/30979565206)\n  passed across Ubuntu, Windows, and macOS, including exact-SHA, immutable\n  tarball/SBOM, and provenance checks. A subsequent\n  [registry readback](https://github.com/chainlesschain/chainlesschain/actions/runs/30983536627)\n  verified package bytes, signed provenance, and workflow identity. Local,\n  older-SHA, and partial results remain supplementary only."
         }
       ]
     },

package/src/gateways/ws/ws-agent-handler.js

@@ -98,6 +98,7 @@ export class WSAgentHandler {
     this._approvalGate = approvalGate || null;
     this._approvalGateInit = Boolean(approvalGate);
     this._mcpRecoveryRuntime = null;
+    this._mcpRecoverySink = null;
     this._mcpRecoveryRevision = null;
     this._mcpRecoveryClient = null;
     this._agentLoop = runAgentLoop || agentLoop;
@@ -361,6 +362,9 @@ export class WSAgentHandler {
           },
         );
       }
+      this._mcpRecoverySink = createSessionMcpLedgerSink(session.id, {
+        recovery: session.mcpLedgerRecovery || null,
+      });
       this._mcpRecoveryRuntime = createMcpHostRecoveryRuntime({
         bundle: {
           mcpClient: rawClient,
@@ -369,7 +373,7 @@ export class WSAgentHandler {
         },
         rawClient,
         sessionId: session.id,
-        sink: createSessionMcpLedgerSink(session.id),
+        sink: this._mcpRecoverySink,
         recovery: session.mcpLedgerRecovery || null,
         controller,
       });
@@ -383,6 +387,9 @@ export class WSAgentHandler {
           replayDenied: [],
         },
       );
+      this._mcpRecoverySink?.replaceRecoveryFence?.(
+        session.mcpLedgerRecovery || null,
+      );
       this._mcpRecoveryRevision = revision;
     }
     return this._mcpRecoveryRuntime;