chainlesschain 0.162.193 → 0.162.198

package/src/harness/session-list-index.js

@@ -11,6 +11,7 @@ import {
   appendFileSync,
   existsSync,
   readFileSync,
+  rmSync,
   writeFileSync,
 } from "node:fs";
 import { join } from "node:path";
@@ -19,6 +20,7 @@ import { ensurePrivateFile } from "../lib/secure-fs.js";
 
 export const SESSION_INDEX_SCHEMA = 2;
 export const SESSION_INDEX_FILE = ".sessions-index-v2.ndjson";
+export const SESSION_TOMBSTONE_MARKER_SUFFIX = ".tombstone";
 
 // Used only by an opted-in child in the independent session-scale crash gate.
 // Keeping the injection immediately around the production sidecar/journal
@@ -41,6 +43,10 @@ export function sessionIndexPath(dir) {
   return join(dir, SESSION_INDEX_FILE);
 }
 
+export function sessionTombstoneMarkerPath(dir, sessionId) {
+  return join(dir, `${sessionId}${SESSION_TOMBSTONE_MARKER_SUFFIX}`);
+}
+
 export function emptySessionMeta(sessionId) {
   return {
     schema: SESSION_INDEX_SCHEMA,
@@ -108,6 +114,18 @@ export function applyEventToSessionMeta(meta, event, lastHash) {
 
 function writeMetaSnapshot(dir, meta) {
   const filePath = sessionMetaPath(dir, meta.id);
+  const tombstoneMarker = sessionTombstoneMarkerPath(dir, meta.id);
+  // The marker is the durable per-session namespace witness that makes a
+  // tombstoned identity discoverable without reading every live sidecar on
+  // `--continue`; the meta snapshot remains the content/status authority.
+  // Publish the marker before the tombstone snapshot, and fail the delete if
+  // that publication fails. Remove it only after a live generation snapshot
+  // commits, so crashes can cause an extra candidate read but never hide a
+  // successfully committed tombstone.
+  if (meta.deleted === true) {
+    writeFileSync(tombstoneMarker, "", { encoding: "utf8", mode: 0o600 });
+    ensurePrivateFile(tombstoneMarker);
+  }
   // The owning transcript lock serializes this derived snapshot. It need not
   // use a second temp+rename protocol: interruption can only corrupt a cache,
   // which readSessionMeta rejects and rebuildSessionMeta regenerates.
@@ -116,6 +134,7 @@ function writeMetaSnapshot(dir, meta) {
     mode: 0o600,
   });
   ensurePrivateFile(filePath);
+  if (meta.deleted !== true) rmSync(tombstoneMarker, { force: true });
 }
 
 function appendActivity(dir, meta) {
@@ -135,9 +154,20 @@ function appendActivity(dir, meta) {
 }
 
 /** Called while the owning transcript lock is held. */
-export function recordSessionEvent(dir, sessionId, event, lastHash) {
-  const current =
-    readSessionMeta(dir, sessionId) || emptySessionMeta(sessionId);
+export function recordSessionEvent(
+  dir,
+  sessionId,
+  event,
+  lastHash,
+  { resetGeneration = false } = {},
+) {
+  const existing = readSessionMeta(dir, sessionId);
+  // Only the transcript writer may authorize a new generation after checking
+  // the tombstone and physical file under its lock. The index cannot infer
+  // that authority from an attacker-controlled genesis-shaped event alone.
+  const current = resetGeneration
+    ? emptySessionMeta(sessionId)
+    : existing || emptySessionMeta(sessionId);
   current.id = sessionId;
   const next = applyEventToSessionMeta(current, event, lastHash);
   writeMetaSnapshot(dir, next);
@@ -224,13 +254,29 @@ export function publicSessionMeta(meta) {
  */
 export function listIndexedSessions(
   dir,
-  { limit = 20, hasSession = () => true } = {},
+  {
+    limit = 20,
+    hasSession = () => true,
+    includeDeleted = () => false,
+    onScanComplete = null,
+  } = {},
 ) {
   const filePath = sessionIndexPath(dir);
-  if (!existsSync(filePath)) return [];
+  if (!existsSync(filePath)) {
+    if (typeof onScanComplete === "function") {
+      onScanComplete({
+        exhausted: true,
+        seenSessionIds: new Set(),
+        latestBySessionId: new Map(),
+      });
+    }
+    return [];
+  }
   const wanted = Math.max(0, Number(limit) || 0);
   const seen = new Set();
+  const latestBySessionId = new Map();
   const result = [];
+  let exhausted = true;
   for (const { line } of iterateFileLinesReverseSync(filePath)) {
     let meta;
     try {
@@ -246,9 +292,21 @@ export function listIndexedSessions(
       continue;
     }
     seen.add(meta.id);
-    if (meta.deleted || !hasSession(meta.id)) continue;
+    latestBySessionId.set(meta.id, meta);
+    if (
+      (meta.deleted && !includeDeleted(meta.id, meta)) ||
+      !hasSession(meta.id)
+    ) {
+      continue;
+    }
     result.push(publicSessionMeta(meta));
-    if (wanted > 0 && result.length >= wanted) break;
+    if (wanted > 0 && result.length >= wanted) {
+      exhausted = false;
+      break;
+    }
+  }
+  if (typeof onScanComplete === "function") {
+    onScanComplete({ exhausted, seenSessionIds: seen, latestBySessionId });
   }
   return result;
 }

package/src/lazy-dispatch.js

@@ -337,6 +337,43 @@ export function resolveCommandLifecycleInvocation(
   };
 }
 
+/**
+ * Build the bounded, content-free lifecycle usage dimensions for a migrated
+ * command. The original argv is inspected only to distinguish the retained
+ * top-level spelling from its virtual namespace replacement; arguments and
+ * nested command names are never copied into telemetry.
+ */
+export function resolveCommandLifecycleTelemetry(
+  argv,
+  manifestData = manifest,
+) {
+  const invocation = resolveCommandLifecycleInvocation(argv, manifestData);
+  let entry = null;
+  let route = null;
+  if (invocation.kind === "namespace-rewrite") {
+    entry = invocation.entry;
+    route = "replacement";
+  } else if (invocation.kind === "passthrough") {
+    const commandName = resolveCommandToken(argv);
+    entry = findManifestEntry(commandName, manifestData);
+    route = "legacy";
+  }
+  if (
+    entry?.lifecycle?.state !== "deprecated" ||
+    typeof entry.name !== "string" ||
+    !entry.replacement
+  ) {
+    return null;
+  }
+  return Object.freeze({
+    command: entry.name,
+    route,
+    version: packageMetadata.version,
+    deprecatedSince: entry.lifecycle.deprecatedSince,
+    removalNotBefore: entry.lifecycle.removalNotBefore,
+  });
+}
+
 export function formatCommandDeprecationWarning(entry, invokedName) {
   const lifecycle = entry?.lifecycle;
   if (lifecycle?.state !== "deprecated" || !entry.replacement) return null;
@@ -691,7 +728,7 @@ export async function dispatchCli(
   { manifestData = manifest, ...dispatchOptions } = {},
 ) {
   const commandName = resolveCommandToken(argv);
-  const entry = findManifestEntry(commandName, manifestData);
+  let entry = findManifestEntry(commandName, manifestData);
   if (!entry) {
     const program = await (
       dispatchOptions.loadFullProgram || defaultLoadFullProgram
@@ -699,20 +736,35 @@ export async function dispatchCli(
     await program.parseAsync(argv);
     return;
   }
+  const commandLocation = findCommandTokenLocation(argv);
+  if (entry.name === "session" && argv[commandLocation?.index + 1] === "show") {
+    entry = {
+      ...entry,
+      module: "./commands/session-show.js",
+      register: "registerSessionShowCommand",
+    };
+  }
   await dispatchManifestEntry(argv, entry, dispatchOptions);
 }
 
 export function isFastReadOnlyInvocation(argv, env = process.env) {
   const args = argv.slice(2);
-  return (
+  const explicitOtlp =
+    args.includes("--otlp-endpoint") ||
+    args.some((token) => token.startsWith("--otlp-endpoint=")) ||
+    env.OTEL_EXPORTER_OTLP_ENDPOINT ||
+    env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ||
+    env.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT;
+  const quickStatus =
     resolveCommandToken(argv) === "status" &&
     !args.includes("--deep") &&
-    !args.includes("--otlp-endpoint") &&
-    !args.some((token) => token.startsWith("--otlp-endpoint=")) &&
-    !env.OTEL_EXPORTER_OTLP_ENDPOINT &&
-    !env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT &&
-    !env.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT
-  );
+    !explicitOtlp;
+  const commandLocation = findCommandTokenLocation(argv);
+  const sessionShow =
+    commandLocation?.token === "session" &&
+    argv[commandLocation.index + 1] === "show" &&
+    !explicitOtlp;
+  return quickStatus || sessionShow;
 }
 
 let processHandlersInstalled = false;
@@ -767,6 +819,10 @@ async function withInvocationOutputContext(argv, task) {
 }
 
 export async function runCli(argv, options = {}) {
+  const lifecycleTelemetry = resolveCommandLifecycleTelemetry(
+    argv,
+    options.manifestData || manifest,
+  );
   const prepared = await prepareInvocation(argv, options);
   if (prepared.handled) {
     if (prepared.exitCode) {
@@ -799,12 +855,24 @@ export async function runCli(argv, options = {}) {
     }
 
     const observability = await initializeCommandRuntime(dispatchArgv);
+    const lifecycleStartedAt = performance.now();
+    let lifecycleOutcome = "completed";
     try {
       return await withDefaultEventRuntimeLifecycle(
         () => dispatchCli(dispatchArgv, options),
         options,
       );
+    } catch (error) {
+      lifecycleOutcome = "error";
+      throw error;
     } finally {
+      if (lifecycleTelemetry) {
+        observability.exportCommandLifecycleInvocation({
+          ...lifecycleTelemetry,
+          outcome: lifecycleOutcome,
+          durationMs: performance.now() - lifecycleStartedAt,
+        });
+      }
       await observability.shutdown().catch(() => {});
     }
   });

package/src/lib/abort-utils.js

@@ -18,3 +18,71 @@ export function throwIfAborted(signal, message = "Agent loop interrupted") {
     throw signal.reason || createAbortError(message);
   }
 }
+
+/**
+ * Await a value while making a host AbortSignal authoritative over settlement.
+ * The source promise is always observed after cancellation, so a late rejection
+ * cannot become unhandled and a late success cannot revive the cancelled path.
+ */
+export function raceWithAbort(
+  value,
+  signal,
+  message = "Agent loop interrupted",
+) {
+  if (!signal) return Promise.resolve(value);
+  try {
+    throwIfAborted(signal, message);
+  } catch (error) {
+    return Promise.reject(error);
+  }
+  if (typeof signal.addEventListener !== "function") {
+    return Promise.resolve(value);
+  }
+
+  const source = Promise.resolve(value);
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const cleanup = () => {
+      try {
+        signal.removeEventListener?.("abort", onAbort);
+      } catch {
+        // Listener cleanup cannot change the already-authoritative settlement.
+      }
+    };
+    const onAbort = () => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(signal.reason || createAbortError(message));
+    };
+    try {
+      signal.addEventListener("abort", onAbort, { once: true });
+    } catch (error) {
+      settled = true;
+      // Observe a later source rejection even though the signal contract was
+      // malformed and this wrapper must fail immediately.
+      source.catch(() => {});
+      reject(error);
+      return;
+    }
+    source.then(
+      (result) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        resolve(result);
+      },
+      (error) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        reject(error);
+      },
+    );
+    // AbortSignal does not replay an event that fired immediately before the
+    // listener was attached. Re-check after both observers are installed so
+    // that narrow registration race still settles as cancellation, while the
+    // source remains observed if it finishes later.
+    if (signal.aborted) onAbort();
+  });
+}

package/src/lib/agent-core.js

@@ -1,60 +1,2 @@
 /** @deprecated Thin re-export shim; canonical impl is `../runtime/agent-core.js` (CLI Runtime Convergence, Phase 6b) — import from there in new code. */
-export {
-  AGENT_TOOLS,
-  AGENT_TOOL_REGISTRY,
-  MAX_SUB_AGENT_DEPTH,
-  MAX_SUB_AGENTS_PER_RUN,
-  MAX_TOOL_RESULT_CHARS,
-  capToolResultString,
-  safeStringifyToolResult,
-  tokenizeShellWords,
-  reloadSkills,
-  getAgentToolDefinitions,
-  getAgentToolDescriptors,
-  getCachedPython,
-  _resetCachedPythonForTests,
-  getEnvironmentInfo,
-  _environmentProcessDeps,
-  _agentToolProcessDeps,
-  getBaseSystemPrompt,
-  buildSystemPrompt,
-  executeTool,
-  computeProposedEdit,
-  editNotebookCell,
-  renderNotebook,
-  classifyError,
-  isValidPackageName,
-  chatWithTools,
-  agentLoop,
-  formatToolArgs,
-  getActiveMcpServers,
-  listBackgroundShellTasks,
-  killBackgroundShellTask,
-  killAllBackgroundShellTasks,
-  killAllBackgroundShellTasksSync,
-  _backgroundProcessDeps,
-  _runBackgroundTaskkill,
-  _gitProcessDeps,
-  reapIdleBackgroundShellTasks,
-  _ingestSearchOutput,
-  writeFileVerified,
-  formatProviderHttpError,
-  _accumulateOllamaStream,
-  _accumulateOpenAIStream,
-  _accumulateAnthropicStream,
-  _streamErrorDisposition,
-  _isRetryableStreamError,
-  _retryStreamingChat,
-  _iterateStreamWithStall,
-  _toAnthropicMessages,
-  _anthropicThinkingParams,
-  _normalizeAnthropicResponse,
-  _resetFileFreshness,
-  _withPostEditDiagnostics,
-  _getSharedCodeIntel,
-  disposeSharedCodeIntel,
-  emitToolHookLifecycle,
-  emitToolBatchHookLifecycle,
-  buildSubAgentHandoffContext,
-  _resetSubtreeInstructionLoaders,
-} from "../runtime/agent-core.js";
+export * from "../runtime/agent-core.js";

package/src/lib/chat-core.js

@@ -90,6 +90,21 @@ function _cachedPromptTokens(usage) {
   return 0;
 }
 
+async function _deliverToken(onToken, token, guard) {
+  if (typeof onToken !== "function") return;
+  // Terminal backpressure is not provider silence. Suspend the network stall
+  // timer while the UI sink drains, then re-arm it before reading more bytes.
+  guard.stop();
+  try {
+    await onToken(token);
+  } catch (error) {
+    if (error?.isOutputBackpressureFailure === true) throw error;
+    // Generic UI callbacks retain their historical best-effort semantics.
+  } finally {
+    guard.bump();
+  }
+}
+
 /**
  * Stream a response from Ollama.
  * If `onUsage` is provided, it's called with `{inputTokens, outputTokens}`
@@ -156,7 +171,7 @@ export async function streamOllama(
           const json = JSON.parse(line);
           if (json.message?.content) {
             fullResponse += json.message.content;
-            onToken(json.message.content);
+            await _deliverToken(onToken, json.message.content, guard);
           }
           if (json.done && onUsage) {
             const inputTokens = Number(json.prompt_eval_count) || 0;
@@ -165,7 +180,8 @@ export async function streamOllama(
               onUsage({ inputTokens, outputTokens });
             }
           }
-        } catch {
+        } catch (error) {
+          if (error?.isOutputBackpressureFailure === true) throw error;
           // Partial JSON, skip
         }
       }
@@ -257,7 +273,7 @@ export async function streamOpenAI(
             const content = json.choices?.[0]?.delta?.content;
             if (content) {
               fullResponse += content;
-              onToken(content);
+              await _deliverToken(onToken, content, guard);
             }
             if (json.usage && onUsage) {
               // Split cached prompt tokens out of prompt_tokens so cc cost
@@ -270,7 +286,8 @@ export async function streamOpenAI(
                 onUsage({ inputTokens, outputTokens, cacheReadTokens });
               }
             }
-          } catch {
+          } catch (error) {
+            if (error?.isOutputBackpressureFailure === true) throw error;
             // Partial data
           }
         }
@@ -377,7 +394,7 @@ export async function streamAnthropic(
             const delta = obj.delta?.text;
             if (delta) {
               fullResponse += delta;
-              onToken(delta);
+              await _deliverToken(onToken, delta, guard);
             }
           } else if (obj.type === "message_start") {
             const u = obj.message?.usage || {};
@@ -390,7 +407,8 @@ export async function streamAnthropic(
           } else if (obj.type === "message_delta") {
             outputTokens = Number(obj.usage?.output_tokens) || outputTokens;
           }
-        } catch {
+        } catch (error) {
+          if (error?.isOutputBackpressureFailure === true) throw error;
           /* skip malformed */
         }
       }

package/src/lib/cowork-mcp-tools.js

@@ -21,6 +21,10 @@
  */
 import { validateMcpServerConfig } from "./skill-mcp.js";
 import { mcpEffectDescriptorFields } from "./mcp-effect-contract.js";
+import {
+  MCP_STDIO_LOCAL_CODE_TRUST_REQUIRED_CODE,
+  issueMcpStdioExecutionAuthority,
+} from "./mcp-stdio-execution-authority.js";
 
 export const _deps = {
   importMcpClient: async () => {
@@ -90,6 +94,7 @@ export function toAgentTool(serverName, tool) {
  * @param {{ mcpServers?: Array<object> }} template
  * @param {object} [opts]
  * @param {(msg: string, err?: Error) => void} [opts.onWarn]
+ * @param {(request: object) => boolean|Promise<boolean>} [opts.approveLocalCodeExecution]
  * @returns {Promise<{
  *   mcpClient: object|null,
  *   mounted: string[],
@@ -121,15 +126,55 @@ export async function mountTemplateMcpTools(template, opts = {}) {
     .filter(Boolean);
   if (validated.length === 0) return empty;
 
+  const skipped = [];
+  const authorized = [];
+  for (const server of validated) {
+    let approved = false;
+    try {
+      approved =
+        typeof opts.approveLocalCodeExecution === "function" &&
+        (await opts.approveLocalCodeExecution({
+          templateId: template?.id || null,
+          serverName: server.name,
+          command: server.command,
+          args: [...server.args],
+          cwd: server.cwd || null,
+          envKeys: Object.keys(server.env || {}).sort(),
+        })) === true;
+    } catch (error) {
+      const message = error?.message || String(error);
+      skipped.push({ name: server.name, error: message });
+      opts.onWarn?.(
+        `[cowork-mcp] Local-code approval failed for "${server.name}": ${message}`,
+        error,
+      );
+      continue;
+    }
+    if (!approved) {
+      const message = `${MCP_STDIO_LOCAL_CODE_TRUST_REQUIRED_CODE}: template MCP server requires explicit local-code approval`;
+      skipped.push({ name: server.name, error: message });
+      opts.onWarn?.(`[cowork-mcp] Skipped "${server.name}": ${message}`);
+      continue;
+    }
+    const config = { ...server };
+    config.mcpStdioExecutionAuthority = issueMcpStdioExecutionAuthority({
+      serverName: server.name,
+      config,
+      approvalKind: "explicit-config",
+      approvalSource: `cowork-template:${template?.id || "unknown"}:${server.name}`,
+    });
+    authorized.push(config);
+  }
+  if (authorized.length === 0) return { ...empty, skipped };
+
   const MCPClient = await _deps.importMcpClient();
   const mcpClient = new MCPClient();
   const mounted = [];
-  const skipped = [];
   const extraToolDefinitions = [];
   const externalToolDescriptors = {};
   const externalToolExecutors = {};
 
-  for (const server of validated) {
+  for (const server of authorized) {
     try {
       await mcpClient.connect(server.name, server);
       mounted.push(server.name);

package/src/lib/cowork-task-runner.js

@@ -313,6 +313,7 @@ export function prepareCoworkMcpRuntime(mcp, options = {}) {
   }
   let recoveryNotice = null;
   let recoveryState = null;
+  let recoveryAuthority = null;
   let bindingAllowed = false;
   let expectedHeadHash = null;
   try {
@@ -321,6 +322,7 @@ export function prepareCoworkMcpRuntime(mcp, options = {}) {
       String(options.templateId || "free"),
     );
     const recovery = projected.recovery;
+    recoveryAuthority = recovery;
     expectedHeadHash = projected.expectedHeadHash;
     bindingAllowed = projected.bindingAllowed;
     recoveryNotice = formatMcpLedgerRecoveryNotice(recovery);
@@ -361,9 +363,12 @@ export function prepareCoworkMcpRuntime(mcp, options = {}) {
     }
   }
 
-  const sink = createSessionMcpLedgerSink(sessionId, {
-    appendEvent: _deps.appendSessionEvent,
-  });
+  const sink = createSessionMcpLedgerSink(
+    sessionId,
+    _deps.appendSessionEvent === appendSessionEvent
+      ? { recovery: recoveryAuthority }
+      : { appendEvent: _deps.appendSessionEvent },
+  );
   const recoveryController =
     createMcpRecoveryAdmissionController(recoveryState);
   return {
@@ -395,6 +400,7 @@ export function prepareCoworkMcpRuntime(mcp, options = {}) {
  * @param {number} [options.maxIterations] - Override iteration limit
  * @param {number} [options.tokenBudget] - Override token budget
  * @param {string} [options.mcpSessionId] - Stable MCP ledger session for resume
+ * @param {(request: object) => boolean|Promise<boolean>} [options.approveMcpLocalCodeExecution]
  * @returns {Promise<{ taskId: string, status: string, result: object }>}
  */
 export async function runCoworkTask(options = {}) {
@@ -410,6 +416,7 @@ export async function runCoworkTask(options = {}) {
     onProgress = null,
     signal = null,
     mcpSessionId = null,
+    approveMcpLocalCodeExecution = null,
   } = options;
 
   if (!userMessage || typeof userMessage !== "string") {
@@ -458,6 +465,7 @@ export async function runCoworkTask(options = {}) {
 
   // Mount template-declared MCP servers (best-effort, failures are tolerated)
   const mcp = await mountTemplateMcpTools(template, {
+    approveLocalCodeExecution: approveMcpLocalCodeExecution,
     onWarn: (msg) => {
       if (onProgress) onProgress({ type: "mcp-warning", message: msg });
     },

package/src/lib/doctor-checkup.js

@@ -604,22 +604,24 @@ async function transcriptSection(_opts, _deps2) {
     const { verifyAllSessions } =
       await import("../harness/jsonl-session-store.js");
     const results = verifyAllSessions({ limit: 200 });
-    const tampered = results.filter((r) => r.status === "tampered");
-    if (tampered.length > 0) {
+    const integrityFailures = results.filter((result) =>
+      ["tampered", "missing", "conflict"].includes(result.status),
+    );
+    if (integrityFailures.length > 0) {
       checks.push(
         check(
           "transcript-tamper",
           "Transcript integrity",
           CHECK_LEVELS.ERR,
-          `${tampered.length} tampered transcript(s): ${tampered
+          `${integrityFailures.length} transcript integrity failure(s): ${integrityFailures
             .slice(0, 5)
-            .map((t) => t.sessionId)
-            .join(", ")}${tampered.length > 5 ? ", …" : ""}`,
+            .map((result) => `${result.sessionId} [${result.status}]`)
+            .join(", ")}${integrityFailures.length > 5 ? ", …" : ""}`,
           {
             id: "transcript-tamper",
             safe: false,
             description: "Inspect the flagged transcripts",
-            command: `cc session verify ${tampered[0].sessionId}`,
+            command: `cc session verify ${integrityFailures[0].sessionId}`,
           },
         ),
       );
@@ -629,7 +631,7 @@ async function transcriptSection(_opts, _deps2) {
           "transcript-tamper",
           "Transcript integrity",
           CHECK_LEVELS.OK,
-          `${results.length} session(s) checked, no tamper`,
+          `${results.length} session(s) checked, no integrity failures`,
         ),
       );
     }