chainlesschain 0.162.197 → 0.162.200

package/src/commands/session.js

@@ -4,7 +4,6 @@
  */
 
 import fs from "fs";
-import { numericOption } from "../lib/cli-numeric.js";
 import path from "path";
 import chalk from "chalk";
 import { logger } from "../lib/logger.js";
@@ -48,24 +47,24 @@ import {
   getSessionManagerStatsV2,
 } from "../lib/session-manager.js";
 import {
-  listJsonlSessions,
+  listSessionAuthoritySummaries,
+  listSessionEvidenceIds,
   rebuildMessages,
   getJsonlSessionMetadata,
-  resolveSessionId,
+  resolveSessionAuthority,
   deleteJsonlSession,
-  readEvents,
   migrateLegacySessions,
   migrateLegacySessionsBatch,
   validateJsonlSession,
   validateAllJsonlSessions,
 } from "../harness/jsonl-session-store.js";
-import { feature } from "../lib/feature-flags.js";
 import {
   listWorkflowSessions,
   readWorkflowSession,
 } from "../lib/workflow-state-reader.js";
 import { executionBroker } from "../lib/process-execution-broker/index.js";
 import { registerSessionMcpRecoveryCommands } from "./session-mcp-recovery.js";
+import { registerSessionShowSubcommand } from "./session-show.js";
 
 export const _deps = {
   execFileSync: (...args) => executionBroker.execFileSync(...args),
@@ -234,26 +233,24 @@ export function registerSessionCommand(program) {
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         const limit = Math.max(1, parseInt(options.limit) || 20);
         let sessions = [];
+        const canonicalIds = new Set(listSessionEvidenceIds());
 
         // Merge DB sessions + JSONL sessions
         if (ctx.db) {
           const db = ctx.db.getDatabase();
           sessions.push(
-            ...listSessions(db, { limit }).map((s) => ({
-              ...s,
-              _store: "db",
-            })),
+            ...listSessions(db, { limit })
+              .filter((s) => !canonicalIds.has(s?.id))
+              .map((s) => ({
+                ...s,
+                _store: "db",
+              })),
           );
         }
 
-        if (feature("JSONL_SESSION")) {
-          sessions.push(
-            ...listJsonlSessions({ limit }).map((s) => ({
-              ...s,
-              _store: "jsonl",
-            })),
-          );
-        }
+        // Existing canonical sessions remain authoritative even if the
+        // creation/migration feature flag is later disabled.
+        sessions.push(...listSessionAuthoritySummaries({ limit }));
 
         // Deduplicate by id (JSONL takes precedence) and rank by real time.
         sessions = rankSessions(sessions, limit);
@@ -324,11 +321,14 @@ export function registerSessionCommand(program) {
         try {
           ctx = await bootstrap({ verbose: program.opts().verbose });
           if (ctx.db) {
+            const canonicalIds = new Set(listSessionEvidenceIds());
             local.push(
-              ...listSessions(ctx.db.getDatabase(), { limit }).map((item) => ({
-                ...item,
-                _store: "db",
-              })),
+              ...listSessions(ctx.db.getDatabase(), { limit })
+                .filter((item) => !canonicalIds.has(item?.id))
+                .map((item) => ({
+                  ...item,
+                  _store: "db",
+                })),
             );
           }
         } catch (error) {
@@ -338,12 +338,7 @@ export function registerSessionCommand(program) {
           // JSONL is the canonical transcript store and can be read without
           // bootstrapping legacy native DB/config packages (some of which
           // write banners directly to stdout and would corrupt --json).
-          local.push(
-            ...listJsonlSessions({ limit }).map((item) => ({
-              ...item,
-              _store: "jsonl",
-            })),
-          );
+          local.push(...listSessionAuthoritySummaries({ limit }));
           local = rankSessions(local, limit);
         } catch (error) {
           sourceErrors.local = error?.message || String(error);
@@ -492,106 +487,7 @@ export function registerSessionCommand(program) {
       }
     });
 
-  // session show
-  session
-    .command("show")
-    .description("Show a session's messages")
-    .argument("<id>", "Session ID (or prefix)")
-    .option("-n, --limit <n>", "Max messages to show")
-    .option("--json", "Output as JSON")
-    .action(async (id, options) => {
-      let ctx = null;
-      try {
-        let sess = null;
-
-        // Try JSONL first if enabled
-        const jsonlId = feature("JSONL_SESSION") ? resolveSessionId(id) : null;
-        if (jsonlId) {
-          const metadata = getJsonlSessionMetadata(jsonlId);
-          const msgs = rebuildMessages(jsonlId);
-          sess = {
-            id: jsonlId,
-            title: metadata?.title || "Untitled",
-            provider: metadata?.provider || "",
-            model: metadata?.model || "",
-            message_count: msgs.length,
-            messages: msgs,
-            _store: "jsonl",
-          };
-        }
-
-        // Version-0 DB adapter is loaded only when the canonical transcript is
-        // absent, keeping the JSONL hot path independent from native SQLite.
-        if (!sess) {
-          ctx = await bootstrap({ verbose: program.opts().verbose });
-        }
-        if (!sess && ctx?.db) {
-          const db = ctx.db.getDatabase();
-          sess = getSession(db, id);
-        }
-
-        if (!sess) {
-          logger.error(`Session not found: ${id}`);
-          process.exitCode = 1;
-          return;
-        }
-
-        // PR/session linking: surface PRs this session created/touched.
-        try {
-          const { getPrLinks } = await import("../lib/pr-link-ledger.js");
-          const prLinks = getPrLinks(sess.id);
-          if (prLinks.length > 0) sess.prLinks = prLinks;
-        } catch {
-          // PR decoration is cosmetic
-        }
-
-        if (options.json) {
-          console.log(JSON.stringify(sess, null, 2));
-        } else {
-          logger.log(chalk.bold(sess.title));
-          logger.log(
-            chalk.gray(
-              `ID: ${sess.id}  Provider: ${sess.provider}  Model: ${sess.model}  Messages: ${sess.message_count}`,
-            ),
-          );
-          if (sess.prLinks) {
-            for (const pr of sess.prLinks) {
-              logger.log(
-                chalk.magenta(
-                  `PR: #${pr.number}${pr.state ? ` ${pr.state}` : ""}${pr.url ? `  ${pr.url}` : ""}`,
-                ),
-              );
-            }
-          }
-          logger.log("");
-
-          let messages = sess.messages;
-          if (options.limit) {
-            messages = messages.slice(
-              -numericOption(options.limit, {
-                name: "--limit",
-                integer: true,
-                min: 1,
-              }),
-            );
-          }
-
-          for (const msg of messages) {
-            if (msg.role === "system") continue;
-            const label =
-              msg.role === "user" ? chalk.green("you> ") : chalk.blue("ai> ");
-            const content = (msg.content || "").substring(0, 500);
-            logger.log(`${label}${content}`);
-            logger.log("");
-          }
-        }
-      } catch (err) {
-        logger.error(`Failed: ${err.message}`);
-        process.exitCode = 1;
-      } finally {
-        if (ctx) await shutdown();
-      }
-    });
+  registerSessionShowSubcommand(session, program);
 
   // session pr-status — PR/CI monitor + controlled auto-merge decision (P1-4)
   // for a session's linked PR. Offline-testable via --checks-file; otherwise a
@@ -712,14 +608,37 @@ export function registerSessionCommand(program) {
           id = picked.id;
         }
 
-        // Try JSONL first
-        const jsonlId = feature("JSONL_SESSION") ? resolveSessionId(id) : null;
+        // Try the complete canonical namespace first. The feature flag cannot
+        // make an existing/damaged canonical generation disappear and thereby
+        // authorize a legacy fallback.
+        const authority = resolveSessionAuthority(id);
+        const jsonlId = authority?.readable ? authority.id : null;
+        if (authority && !authority.readable) {
+          logger.error(
+            `Session ${authority.id} has canonical persistence evidence but no readable transcript (${authority.presence}).`,
+          );
+          logger.error(
+            "Refusing legacy fallback. Inspect or explicitly delete the damaged JSONL session before reusing its id.",
+          );
+          process.exitCode = 1;
+          return;
+        }
         if (jsonlId) {
           // Tamper gate: a broken hash chain means the transcript was edited
           // outside the store — never silently rebuild it as trusted context.
           const { verifySession } =
             await import("../harness/jsonl-session-store.js");
           const trust = verifySession(jsonlId);
+          if (["missing", "conflict"].includes(trust.status)) {
+            logger.error(
+              `Session ${jsonlId} transcript is unavailable: ${trust.reason}`,
+            );
+            logger.error(
+              "Refusing to resume without canonical history. Inspect or explicitly delete the damaged session before reusing its id.",
+            );
+            process.exitCode = 1;
+            return;
+          }
           if (trust.status === "tampered") {
             if (!options.allowTampered) {
               logger.error(
@@ -810,8 +729,16 @@ export function registerSessionCommand(program) {
         // Canonical content source: append-only JSONL event log. The legacy DB
         // is consulted only when no matching transcript exists.
         const store = await import("../harness/jsonl-session-store.js");
-        const sid =
-          id === "last" ? store.getLastSessionId() : store.resolveSessionId(id);
+        const requestedId = id === "last" ? store.getLastSessionId() : id;
+        const authority = requestedId
+          ? store.resolveSessionAuthority(requestedId)
+          : null;
+        const sid = authority?.readable ? authority.id : null;
+        if (authority && !authority.readable) {
+          throw new Error(
+            `Session ${authority.id} has canonical persistence evidence but no readable transcript (${authority.presence})`,
+          );
+        }
         if (sid) {
           const { renderAgentSessionMarkdown } =
             await import("../lib/agent-session-export.js");
@@ -890,7 +817,10 @@ export function registerSessionCommand(program) {
         try {
           const sessionIndex = await import("../harness/session-index.js");
           indexDb = sessionIndex.openIndex();
-          sessionIndex.syncIndex(indexDb);
+          const sync = sessionIndex.syncIndex(indexDb);
+          if (sync.rejected > 0) {
+            indexDiagnostic = `${sync.rejected} canonical session(s) were excluded because verification failed`;
+          }
           matches = sessionIndex
             .searchSessions(indexDb, query, { limit })
             .map((hit) => ({
@@ -911,7 +841,7 @@ export function registerSessionCommand(program) {
           });
           for (const s of sessions) {
             if (matches.length >= limit) break;
-            for (const ev of store.readEvents(s.id)) {
+            for (const ev of store.readVerifiedEvents(s.id)) {
               if (matches.length >= limit) break;
               if (
                 ev.type !== "user_message" &&
@@ -991,7 +921,8 @@ export function registerSessionCommand(program) {
     .action(async (id, options) => {
       let ctx = null;
       try {
-        const jsonlId = resolveSessionId(id);
+        const authority = resolveSessionAuthority(id);
+        const jsonlId = authority?.id || null;
         let db = null;
         try {
           ctx = await bootstrap({ verbose: program.opts().verbose });
@@ -1054,7 +985,13 @@ export function registerSessionCommand(program) {
           Array.isArray(title) ? title.join(" ") : title,
         ).trim();
         if (!normalized) throw new Error("A non-empty title is required");
-        const jsonlId = resolveSessionId(id);
+        const authority = resolveSessionAuthority(id);
+        const jsonlId = authority?.readable ? authority.id : null;
+        if (authority && !authority.readable) {
+          throw new Error(
+            `Session ${authority.id} has canonical persistence evidence but no readable transcript (${authority.presence})`,
+          );
+        }
         let result;
         if (jsonlId) {
           const { renameSession } =
@@ -1273,10 +1210,18 @@ export function registerSessionCommand(program) {
           }
         }
 
-        const anyTampered = (Array.isArray(result) ? result : [result]).some(
-          (item) => item.status === "tampered",
+        const hasVerificationFailure = (
+          Array.isArray(result) ? result : [result]
+        ).some((item) =>
+          [
+            "tampered",
+            "missing",
+            "conflict",
+            "not-found",
+            "invalid-id",
+          ].includes(item.status),
         );
-        if (anyTampered) process.exit(1);
+        if (hasVerificationFailure) process.exit(1);
       } catch (err) {
         logger.error(`Failed: ${err.message}`);
         process.exit(1);
@@ -2231,14 +2176,17 @@ async function mirrorSessions(ids) {
 
   const pushed = [];
   const errors = [];
-  const { readFileSync, existsSync } = await import("node:fs");
   for (const id of ids) {
     try {
-      if (store.isUnsafeSessionId(id)) throw new Error("unsafe session id");
-      const file = store.sessionPath(id);
-      if (!existsSync(file)) throw new Error("session not found");
-      const bytes = readFileSync(file, "utf-8");
-      pushed.push(await mirror.push(id, bytes));
+      const authority = store.resolveSessionAuthority(id);
+      if (!authority) throw new Error("session not found");
+      if (!authority.readable) {
+        throw new Error(
+          `canonical session is not readable (${authority.presence})`,
+        );
+      }
+      const bytes = store.readVerifiedTranscriptBytes(authority.id);
+      pushed.push(await mirror.push(authority.id, bytes));
     } catch (err) {
       errors.push({ id, error: err.message });
     }
@@ -2288,7 +2236,11 @@ async function mirrorPruneSessions() {
   const { pruneMirror } = await import("../harness/session-mirror.js");
   const { mirror } = await loadConfiguredMirror();
   if (!mirror) return { target: null, deleted: [], kept: [] };
-  const keep = store.listSessionIds();
+  // A damaged local generation must not cause automatic deletion of its last
+  // off-box recovery copy. Only an explicit canonical tombstone is prunable.
+  const keep = store
+    .listSessionEvidenceIds()
+    .filter((id) => store.getSessionPresence(id) !== "tombstoned");
   const res = await pruneMirror(mirror, { keep });
   return { target: mirror.target, ...res };
 }

package/src/commands/skill.js

@@ -46,6 +46,7 @@ import {
   autoFailStuckExecutionsV2,
   getSkillLoaderStatsV2,
 } from "../lib/skill-loader.js";
+import { raceWithAbort, throwIfAborted } from "../lib/abort-utils.js";
 import { getElectronUserDataDir } from "../lib/paths.js";
 import { findProjectRoot } from "../lib/project-detector.js";
 import { loadConfig } from "../lib/config-manager.js";
@@ -130,6 +131,10 @@ export function createControlledSkillScaffold(name, targetDir, io = fs) {
 
 export function createCliSkillReauthorizer(options = {}) {
   return async (request) => {
+    throwIfAborted(
+      request?.signal,
+      "Skill authorization prompt was interrupted",
+    );
     if (options.assumeYes === true) return { authorized: true };
     const stdin = options.stdin || process.stdin;
     const stdout = options.stdout || process.stdout;
@@ -140,12 +145,19 @@ export function createCliSkillReauthorizer(options = {}) {
     const skillId = request?.skill?.id || "unknown";
     const source = request?.skill?.source || "unknown";
     const digest = String(request?.currentDigest || "").slice(0, 24);
-    const authorized = await confirm({
-      message:
-        `Authorize isolated skill "${skillId}" from ${source} ` +
-        `for this process (${digest || "digest unavailable"})?`,
-      default: false,
-    });
+    const authorized = await raceWithAbort(
+      confirm(
+        {
+          message:
+            `Authorize isolated skill "${skillId}" from ${source} ` +
+            `for this process (${digest || "digest unavailable"})?`,
+          default: false,
+        },
+        request?.signal ? { signal: request.signal } : undefined,
+      ),
+      request?.signal,
+      "Skill authorization prompt was interrupted",
+    );
     return { authorized: authorized === true };
   };
 }
@@ -179,7 +191,9 @@ export async function runControlledSkill(options = {}) {
     loader,
     executeTool = null,
     llmOptions = null,
+    signal = null,
   } = options;
+  throwIfAborted(signal, "Skill command interrupted before discovery");
   if (
     !loader ||
     (typeof loader.getResolvedSkills !== "function" &&
@@ -197,52 +211,75 @@ export async function runControlledSkill(options = {}) {
   if (!skill) {
     return { error: `Skill not found: ${name}`, code: "CC_SKILL_NOT_FOUND" };
   }
-  const executionContext = {
-    loadedBecause: "run_skill",
-    bodyIncluded: false,
-  };
-  if (typeof loader.materializeSkillForExecution === "function") {
-    skill = await loader.materializeSkillForExecution(skill, executionContext);
-  } else if (typeof loader.materializeSkill === "function") {
-    skill = loader.materializeSkill(skill, executionContext);
-  }
-  if (skill.isolation !== true) {
-    return {
-      error:
-        `Skill "${skill.id}" is not configured for controlled execution. ` +
-        "Add isolation: true before running it.",
-      code: "CC_SKILL_DIRECT_HANDLER_BLOCKED",
-    };
-  }
-  if (!canRunOnPlatform(skill)) {
-    return {
-      error: `Skill "${skill.id}" is not supported on ${process.platform}`,
-      code: "CC_SKILL_PLATFORM_UNSUPPORTED",
-    };
-  }
-  const dispatch =
-    executeTool || (await import("../runtime/agent-core.js")).executeTool;
-  const result = await dispatch(
-    "run_skill",
-    { skill_name: skill.id, input: String(input) },
-    {
-      cwd,
-      skillLoader: loader,
-      ...(llmOptions ? { llmOptions: { ...llmOptions } } : {}),
-    },
-  );
-  const nestedFailure = /^\s*Sub-agent failed:/i.test(
-    String(result?.summary || ""),
-  );
-  if (result?.error || nestedFailure) {
-    return {
-      ...result,
-      success: false,
-      code: result?.code || "CC_SKILL_CONTROLLED_RUN_FAILED",
-      error: result?.error || result.summary,
+  const executionLease = loader.acquireSkillExecution?.(skill, { signal });
+  const executionSignal = executionLease?.signal || signal;
+  try {
+    const executionContext = {
+      loadedBecause: "run_skill",
+      bodyIncluded: false,
+      signal: executionSignal,
     };
+    if (typeof loader.materializeSkillForExecution === "function") {
+      skill = await raceWithAbort(
+        loader.materializeSkillForExecution(skill, executionContext),
+        executionSignal,
+        "Skill command interrupted during authorization",
+      );
+    } else if (typeof loader.materializeSkill === "function") {
+      skill = loader.materializeSkill(skill, executionContext);
+    }
+    executionLease?.assertActive?.();
+    if (skill.isolation !== true) {
+      return {
+        error:
+          `Skill "${skill.id}" is not configured for controlled execution. ` +
+          "Add isolation: true before running it.",
+        code: "CC_SKILL_DIRECT_HANDLER_BLOCKED",
+      };
+    }
+    if (!canRunOnPlatform(skill)) {
+      return {
+        error: `Skill "${skill.id}" is not supported on ${process.platform}`,
+        code: "CC_SKILL_PLATFORM_UNSUPPORTED",
+      };
+    }
+    const dispatch =
+      executeTool || (await import("../runtime/agent-core.js")).executeTool;
+    executionLease?.assertActive?.();
+    throwIfAborted(
+      executionSignal,
+      "Skill command interrupted before execution",
+    );
+    const result = await raceWithAbort(
+      dispatch(
+        "run_skill",
+        { skill_name: skill.id, input: String(input) },
+        {
+          cwd,
+          skillLoader: loader,
+          ...(executionSignal ? { signal: executionSignal } : {}),
+          ...(llmOptions ? { llmOptions: { ...llmOptions } } : {}),
+        },
+      ),
+      executionSignal,
+      "Skill command interrupted during execution",
+    );
+    executionLease?.assertActive?.();
+    const nestedFailure = /^\s*Sub-agent failed:/i.test(
+      String(result?.summary || ""),
+    );
+    if (result?.error || nestedFailure) {
+      return {
+        ...result,
+        success: false,
+        code: result?.code || "CC_SKILL_CONTROLLED_RUN_FAILED",
+        error: result?.error || result.summary,
+      };
+    }
+    return result;
+  } finally {
+    executionLease?.release?.();
   }
-  return result;
 }
 
 export function registerSkillCommand(program) {

package/src/data/changelog.json

@@ -1,6 +1,45 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.162.200",
+      "cliVersions": ["0.162.198", "0.162.200"],
+      "date": "2026-08-07",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed — cc CLI 0.162.200: release-gate isolation and carried reliability fixes",
+          "body": "> `chainlesschain` **0.162.198 → 0.162.200** (release candidate,\n> 2026-08-07; `0.162.199` failed before npm upload and its tag remains\n> immutable). CLI-only release metadata; `@chainlesschain/personal-data-hub`\n> remains **0.4.57** and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Carries the complete 0.162.199 candidate**: command lifecycle telemetry and\n  alias observation policy, canonical session authority, fixed MCP package\n  capsules, native update recovery, and portable reliability gates are all\n  included because `0.162.199` never reached npm.\n- **Release-gate isolation**: the Agent SDK real-CLI E2E now places its\n  rollback-resistant security anchor beside, rather than inside,\n  `CHAINLESSCHAIN_HOME`. The fixture therefore matches the production\n  fail-closed layout after redirecting `HOME` and no longer hides the `agent`\n  command behind compatibility registration.\n- **Pre-release evidence**: implementation SHA `bf6924013d1c` passed the full\n  [npm release dry-run](https://github.com/chainlesschain/chainlesschain/actions/runs/31189959290),\n  including core packages, Agent SDK real-CLI E2E, Personal Data Hub, Web Panel,\n  the complete CLI suite, and credential-free npm package validation. The final\n  `0.162.200` version commit must pass the exact-SHA CLI CI and CLI Strict\n  Sandbox matrices before tag `v-npm-0-162-200` is created."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.162.199",
+      "cliVersions": ["0.162.198", "0.162.199"],
+      "date": "2026-08-07",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed — cc CLI 0.162.199: session authority, MCP capsules, and recovery reliability",
+          "body": "> `chainlesschain` **0.162.198 → 0.162.199** (not published, 2026-08-07;\n> the release workflow failed before package creation or npm upload and tag\n> `v-npm-0-162-199` remains immutable). CLI-only release metadata;\n> `@chainlesschain/personal-data-hub` remains **0.4.57** and\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Command lifecycle telemetry**: manifest-driven lifecycle metadata now\n  records legacy and replacement routes, aggregates usage without changing\n  aliases automatically, and keeps compatibility entries until their stated\n  observation window and release-cycle requirements are satisfied.\n- **Canonical session authority**: host leases, transcript witnesses,\n  anti-rollback anchors, compare-and-swap persistence, bounded cleanup, and\n  descendant retirement harden concurrent resume and long-running session\n  behavior across the covered CLI, background, and remote-host paths.\n- **Fixed MCP package execution**: approved JavaScript launchers are resolved\n  to exact npm versions and complete transitive closures, then bundled into a\n  guarded, content-addressed Node capsule. Runtime execution no longer depends\n  on a live dynamic package launcher or mutable `node_modules` entrypoint.\n- **Native update recovery**: Windows and POSIX installer/OTA generations can\n  recover interrupted activation, rollback, and rescue state while preserving\n  exact lineage, owner-private locks, and Windows path/handle identity under\n  Node 22.12 device projection.\n- **Portable reliability gates**: disk/pipe failure injection, process-tree\n  cleanup, resource accounting, session stress, and platform path aliases are\n  covered by the release matrices. Real hardware, terminal, SSH, and extended\n  soak observations remain ongoing evidence rather than compatibility claims.\n- **Candidate evidence**: implementation SHA `7e7ce9182746` passed\n  [CLI CI](https://github.com/chainlesschain/chainlesschain/actions/runs/31181229942),\n  [CLI Strict Sandbox](https://github.com/chainlesschain/chainlesschain/actions/runs/31181328955),\n  [CLI Background Interaction E2E](https://github.com/chainlesschain/chainlesschain/actions/runs/31181258842),\n  and [CLI Session Host Consistency](https://github.com/chainlesschain/chainlesschain/actions/runs/31181258424)\n  on Ubuntu, Windows, and macOS. Final SHA `23bd2e6e5758` also passed the\n  exact-SHA release gates, but the\n  [dedicated npm release](https://github.com/chainlesschain/chainlesschain/actions/runs/31187599603)\n  stopped before package creation because its Agent SDK fixture placed the\n  security anchor inside the redirected CLI home."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.162.198",
+      "cliVersions": ["0.162.197", "0.162.198"],
+      "date": "2026-08-06",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed — cc CLI 0.162.198: interactive streaming and release portability",
+          "body": "> `chainlesschain` **0.162.197 → 0.162.198** (published, 2026-08-06).\n> CLI-only release metadata; `@chainlesschain/personal-data-hub` remains\n> **0.4.57** and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Interactive output backpressure**: REPL, headless streaming, provider\n  pacing, and TTY writers now wait for saturated output streams to drain and\n  clean up pending listeners across completion, interruption, and session\n  transitions instead of allowing unbounded interactive writes.\n- **Canonical session controls**: the CLI-owned session projection and bounded\n  reply routes now support the completed VS Code and JetBrains workbench and\n  rewind journeys while preserving CLI authority over persisted mutations.\n- **Portable release gates**: Windows path-alias fixtures, state-path mocks,\n  Skill metadata fixtures, POSIX executable-bit setup, and the deprecated\n  agent-core shim are aligned with the three-platform CLI CI and Strict\n  Sandbox contracts.\n- **Release readback hardening**: public npm verification remains independent\n  of undeclared runtime dependencies, retries bounded registry propagation,\n  and binds provenance and registry bytes to the immutable publish artifact.\n- **Exact release evidence**: tag `v-npm-0-162-198` points to final release SHA\n  [`3c0f62fa17242cfa3123ab502a9bf5d1cbed8481`](https://github.com/chainlesschain/chainlesschain/commit/3c0f62fa17242cfa3123ab502a9bf5d1cbed8481).\n  The same SHA passed [CLI CI](https://github.com/chainlesschain/chainlesschain/actions/runs/31078499968)\n  and [CLI Strict Sandbox](https://github.com/chainlesschain/chainlesschain/actions/runs/31078499270)\n  on Ubuntu, Windows, and macOS. The\n  [dedicated npm release](https://github.com/chainlesschain/chainlesschain/actions/runs/31081337370)\n  completed the exact-SHA gate, immutable tarball, CycloneDX SBOM, Trusted\n  Publishing, signed provenance, registry readback, and npmmirror sync; the\n  [independent public readback](https://github.com/chainlesschain/chainlesschain/actions/runs/31082366544)\n  re-downloaded the package and matched registry bytes and publishing identity."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.162.197",
@@ -10,7 +49,7 @@
       "sections": [
         {
           "heading": "Added — cc CLI 0.162.197: durable sessions, MCP recovery, and checkpoint safety",
-          "body": "> `chainlesschain` **0.162.189 → 0.162.197** (release candidate,\n> 2026-08-05; `0.162.190`, `0.162.191`, and `0.162.192` were never published;\n> `0.162.193` was published outside the authoritative CLI release workflow;\n> `0.162.194`, `0.162.195`, and `0.162.196` failed before npm upload and their\n> tags remain immutable).\n> CLI-only release metadata;\n> `@chainlesschain/personal-data-hub`\n> remains **0.4.57** and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Safer configuration defaults**: for CLI config writes, schema-declared\n  secrets are refused by `config set` and must use `config set-secret` through\n  hidden TTY/stdin and OS-store or owner-only fallback paths. Explicit\n  `workspace-write` / `strict` isolation and managed-required sandbox policies\n  fail closed when unavailable. `mcp add` now defaults to local scope; both\n  human and JSON `status` use bounded quick probes, while full Docker Compose\n  detail requires `--deep`.\n- **MCP transports and uncertain-outcome recovery**: scoped WebSocket MCP,\n  trusted dynamic headers, timeout notifications, and durable recovery records\n  cover REPL, stream, Cowork/host, and WebSocket paths through shared verified\n  recovery authority. Ambiguous MCP outcomes require verification or\n  adjudication instead of blind replay.\n- **Canonical sessions and resource budgets**: covered REPL, stream,\n  WebSocket, and headless paths use verified transcript projections,\n  transactional summary/compaction state, and reject stale or corrupt resume\n  authority. A persistent session-budget foundation plus background/Team\n  adapters adds fenced token/USD/wall-clock accounting and cleanup; it is not\n  yet a universal cross-host budget authority.\n- **Agent workflow controls**: durable plan/todo state with revision and\n  authority ceilings, controlled skill subagents, background launch profiles,\n  semantic handoff, ephemeral side questions, manifest-driven help, and\n  deterministic shell completions improve Claude Code-style daily workflows.\n  CLI-owned canonical session/checkpoint/delivery projections are consumed by\n  VS Code and JetBrains while mutations stay CLI-authoritative; this CLI-only\n  metadata bump does not bump either IDE package.\n- **Signed native update recovery**: immutable release identity, signed updater\n  rollback chains, atomic download replacement, and portable recovery/cleanup\n  paths add fail-closed activation, rollback, and recovery fences for stale,\n  replaced, or partial payloads.\n- **Checkpoint restore durability**: canonical workspace prestate binding,\n  lifetime locks, immutable Git/copy target identity, copy tombstones and\n  owner-private safety arms feed a hash-chained CAS restore saga shared by\n  direct and timeline restores. A real Git/copy kill/restart matrix covers\n  both the post-completion, pre-lock-release window and mutation-phase partial\n  rollback recovery.\n- **Conservative recovery CLI**: `cc checkpoint recovery`\n  `list/show/abort/resume/rollback/release` derives mutation authority from the\n  current live owner digest or verified owner absence plus exact seq/head\n  fences. `resume` remains limited to a verified already-completed settlement;\n  `rollback --yes` only accepts a verified partial-mutation rollback cycle and\n  dispatches the persisted Git/copy engine rather than re-detecting it.\n- **Verified partial restore rollback**: production Git and copy adapters,\n  crash-safe rollback v2 phase boundaries, and the transaction-fenced\n  `checkpoint_restore_recovery_resolution` event bind workspace and session\n  settlement in both directions. Checkpoint delete, clear, and prune now retain\n  active original/safety authority with expected-identity transactions,\n  no-replace copy publication, and root-bound maintenance locks. This is a\n  narrow partial-restore recovery path, not general multi-resource atomicity,\n  power-loss proof, or checkpoint recovery GA.\n- **Release retry identity**: tags `v-npm-0-162-190`,\n  `v-npm-0-162-191`, `v-npm-0-162-192`, `v-npm-0-162-194`, and\n  `v-npm-0-162-195` / `v-npm-0-162-196` remain immutable records of\n  pre-publication failures.\n  Run `30790359741` exposed an Agent SDK E2E fixture that used its owner-private\n  `CHAINLESSCHAIN_HOME` as the active workspace; the fixture now uses sibling\n  control-state and workspace roots while production path safety remains fail\n  closed. Run `30793513643` passed all tests but exposed root-monorepo\n  `npm sbom` contamination from unrelated desktop/mobile peer graphs; SBOM\n  generation now resolves an ignore-scripts lock from the immutable CLI\n  tarball and validates its CycloneDX package/version identity. Run\n  `30799974832` exposed that the exact-SHA gate queried jobs with\n  `filter=all`, so an earlier failed CLI CI attempt overrode the successful\n  rerun; it now verifies only GitHub's latest attempt. The first `0.162.193`\n  candidate then exposed a recurring macOS two-process CAS race in run\n  `30800530258`: a cooperating owner could remove its lock between the\n  unlocked safety inspection steps, and the loser reported `LOCK_FAILED`\n  instead of reaching the serialized stale-head `CONFLICT`. Unlocked\n  pre/postflight inspection now retries that exact disappearance, while\n  owner-required critical-section checks still fail closed. Deterministic\n  directory/owner disappearance regressions, the full 105-test checkpoint\n  saga suite, and five repeated real-process CAS runs pass locally.\n  Run `30966796114` passed its exact-SHA gate but failed before package creation\n  when the Agent SDK build assumed a package-local `node_modules/.bin/tsc`.\n  The build now resolves the TypeScript compiler module through Node, supporting\n  both independent installs and npm workspace hoisting; the consumed\n  `v-npm-0-162-194` identity is not moved or reused.\n  Run `30973665834` then passed the exact-SHA gate and all tests, but its\n  immutable package job passed the complete `npm pack --json` result as one\n  command-line argument; the 959-file metadata exceeded Linux `ARG_MAX` before\n  release-manifest creation. Pack metadata now flows through a temporary file,\n  and the consumed `v-npm-0-162-195` identity is also not moved or reused.\n  Run `30976924860` passed all tests, immutable tarball creation, SBOM validation,\n  and artifact upload, but `npm publish` interpreted the bare relative\n  `release-artifacts/...tgz` argument as a GitHub `owner/repo` package spec and\n  failed before upload. The publish step now discovers the tarball through the\n  absolute `$GITHUB_WORKSPACE` path; `v-npm-0-162-196` is not moved or reused.\n- **Release authority containment**: a later generic workspace publisher\n  replaced the dedicated CLI workflow at the same `npm-publish.yml` path.\n  Manually dispatched run `30820089779` therefore auto-selected and published\n  `chainlesschain@0.162.193` from `e8e7ba274b487ed491c04ec3359841a0e545debb`\n  while that SHA's `CLI CI` was still running and eventually failed. The\n  package has npm provenance but no `v-npm-0-162-193` tag, exact-SHA gate\n  attestation, verified immutable tarball/SBOM handoff, or successful complete\n  CLI matrix. The authoritative workflow is restored; the generic publisher\n  is moved to a distinct workflow/tag namespace, while the live CLI path now\n  requires the event ref to exactly match `v-npm-<package-version>` and its\n  checked-out `GITHUB_SHA`. The generic publisher excludes `packages/cli`\n  and package name `chainlesschain` both during detection and immediately\n  before publish. Numeric product releases no longer contain a CLI publisher:\n  they require an already-published `v-npm-*` tag, matching registry `gitHead`,\n  and successful exact-SHA gates before finalizing. The two local generic\n  publisher scripts also exclude and reject the CLI.\n- **Inline-chat release blocker**: the `0.162.193` source registered the six\n  VS Code inline-chat commands twice, invoked non-existent methods in the\n  second registration, and referenced an undefined `outputLog` during\n  activation. The extension now constructs one decorator with the existing\n  chat provider and module logger, registers each contributed command exactly\n  once, and publishes the same six commands through the canonical IDE\n  capability manifest. The activation fake now exercises the decorator path,\n  so constructor or registration regressions fail the CLI matrix.\n- **Production REPL prompt interactions**: each real REPL session now owns a\n  prompt interaction controller and slash-command registry for `/paste-image`,\n  `/editor`, `/stash`, `/suggestions`, and `/recap`. Guarded keypress dispatch\n  consumes configured interaction keys before readline, live assistant/session\n  context feeds manual and automatic suggestions, and local clipboard data\n  images join the existing multimodal vision-provider path while remote image\n  chips fail closed. The focused REPL, prompt, keybinding, image, and provider\n  matrix passes 200/200 locally; real terminal/clipboard host coverage and the\n  exact-SHA release gates remain required.\n- **Second command-surface migration batch**: eight explicitly legacy or\n  in-memory governance commands (`bm25`, `ccron`, `compt`, `consol`, `fflag`,\n  `pdfp`, `sganal`, and `vcheck`) now have canonical `cc lab ...` spellings.\n  Their original top-level forms remain compatible through at least `0.164.0`\n  and warn only on stderr. The registered graph remains 175 commands with zero\n  net growth, while the recommended surface drops from 174 to 166; manifest,\n  README, namespace help, and four shell completions share the same lifecycle\n  source. Native manifest generation also now uses the real pure `/doctor`\n  status exports instead of a nonexistent registry import.\n- **Third command-surface migration batch**: fifteen explicitly in-memory V2\n  governance overlays (`execbe`, `itbudget`, `mcpscaf`, `meminj`, `orchgov`,\n  `promcomp`, `seshhook`, `seshsearch`, `seshtail`, `seshu`, `slotfill`,\n  `svccont`, `tms`, `topiccls`, and `uprof`) now use canonical `cc lab ...`\n  spellings. Product-facing `todo`, `subagent`, `webfetch`, and `planmode`\n  remain active top-level commands instead of being migrated by keyword alone.\n  Legacy spellings remain compatible through at least `0.164.0` and warn only\n  on stderr. The registered graph remains 175 commands with zero net growth;\n  the recommended surface drops from 166 to 151, with manifest, README,\n  namespace help, and four shell completions generated from one lifecycle\n  policy.\n- **Release status**: `0.162.193` exists on npm but is not an authorized CLI\n  release and must not be overwritten or represented as gate-complete.\n  `0.162.194`, `0.162.195`, and `0.162.196` are not published and their failed\n  tags remain immutable. The `0.162.197` exact\n  version/changelog/fix commit must pass `CLI CI` and `CLI Strict Sandbox` on\n  Ubuntu, Windows, and macOS, plus affected `Session Host Consistency`,\n  `CLI Background Interaction E2E`, and immutable npm tarball verification,\n  before tag `v-npm-0-162-197` or npm publication is allowed. Local,\n  older-SHA, and partial results are supplementary only."
+          "body": "> `chainlesschain` **0.162.189 → 0.162.197** (published,\n> 2026-08-05; `0.162.190`, `0.162.191`, and `0.162.192` were never published;\n> `0.162.193` was published outside the authoritative CLI release workflow;\n> `0.162.194`, `0.162.195`, and `0.162.196` failed before npm upload and their\n> tags remain immutable).\n> CLI-only release metadata;\n> `@chainlesschain/personal-data-hub`\n> remains **0.4.57** and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Safer configuration defaults**: for CLI config writes, schema-declared\n  secrets are refused by `config set` and must use `config set-secret` through\n  hidden TTY/stdin and OS-store or owner-only fallback paths. Explicit\n  `workspace-write` / `strict` isolation and managed-required sandbox policies\n  fail closed when unavailable. `mcp add` now defaults to local scope; both\n  human and JSON `status` use bounded quick probes, while full Docker Compose\n  detail requires `--deep`.\n- **MCP transports and uncertain-outcome recovery**: scoped WebSocket MCP,\n  trusted dynamic headers, timeout notifications, and durable recovery records\n  cover REPL, stream, Cowork/host, and WebSocket paths through shared verified\n  recovery authority. Ambiguous MCP outcomes require verification or\n  adjudication instead of blind replay.\n- **Canonical sessions and resource budgets**: covered REPL, stream,\n  WebSocket, and headless paths use verified transcript projections,\n  transactional summary/compaction state, and reject stale or corrupt resume\n  authority. A persistent session-budget foundation plus background/Team\n  adapters adds fenced token/USD/wall-clock accounting and cleanup; it is not\n  yet a universal cross-host budget authority.\n- **Agent workflow controls**: durable plan/todo state with revision and\n  authority ceilings, controlled skill subagents, background launch profiles,\n  semantic handoff, ephemeral side questions, manifest-driven help, and\n  deterministic shell completions improve Claude Code-style daily workflows.\n  CLI-owned canonical session/checkpoint/delivery projections are consumed by\n  VS Code and JetBrains while mutations stay CLI-authoritative; this CLI-only\n  metadata bump does not bump either IDE package.\n- **Signed native update recovery**: immutable release identity, signed updater\n  rollback chains, atomic download replacement, and portable recovery/cleanup\n  paths add fail-closed activation, rollback, and recovery fences for stale,\n  replaced, or partial payloads.\n- **Checkpoint restore durability**: canonical workspace prestate binding,\n  lifetime locks, immutable Git/copy target identity, copy tombstones and\n  owner-private safety arms feed a hash-chained CAS restore saga shared by\n  direct and timeline restores. A real Git/copy kill/restart matrix covers\n  both the post-completion, pre-lock-release window and mutation-phase partial\n  rollback recovery.\n- **Conservative recovery CLI**: `cc checkpoint recovery`\n  `list/show/abort/resume/rollback/release` derives mutation authority from the\n  current live owner digest or verified owner absence plus exact seq/head\n  fences. `resume` remains limited to a verified already-completed settlement;\n  `rollback --yes` only accepts a verified partial-mutation rollback cycle and\n  dispatches the persisted Git/copy engine rather than re-detecting it.\n- **Verified partial restore rollback**: production Git and copy adapters,\n  crash-safe rollback v2 phase boundaries, and the transaction-fenced\n  `checkpoint_restore_recovery_resolution` event bind workspace and session\n  settlement in both directions. Checkpoint delete, clear, and prune now retain\n  active original/safety authority with expected-identity transactions,\n  no-replace copy publication, and root-bound maintenance locks. This is a\n  narrow partial-restore recovery path, not general multi-resource atomicity,\n  power-loss proof, or checkpoint recovery GA.\n- **Release retry identity**: tags `v-npm-0-162-190`,\n  `v-npm-0-162-191`, `v-npm-0-162-192`, `v-npm-0-162-194`, and\n  `v-npm-0-162-195` / `v-npm-0-162-196` remain immutable records of\n  pre-publication failures.\n  Run `30790359741` exposed an Agent SDK E2E fixture that used its owner-private\n  `CHAINLESSCHAIN_HOME` as the active workspace; the fixture now uses sibling\n  control-state and workspace roots while production path safety remains fail\n  closed. Run `30793513643` passed all tests but exposed root-monorepo\n  `npm sbom` contamination from unrelated desktop/mobile peer graphs; SBOM\n  generation now resolves an ignore-scripts lock from the immutable CLI\n  tarball and validates its CycloneDX package/version identity. Run\n  `30799974832` exposed that the exact-SHA gate queried jobs with\n  `filter=all`, so an earlier failed CLI CI attempt overrode the successful\n  rerun; it now verifies only GitHub's latest attempt. The first `0.162.193`\n  candidate then exposed a recurring macOS two-process CAS race in run\n  `30800530258`: a cooperating owner could remove its lock between the\n  unlocked safety inspection steps, and the loser reported `LOCK_FAILED`\n  instead of reaching the serialized stale-head `CONFLICT`. Unlocked\n  pre/postflight inspection now retries that exact disappearance, while\n  owner-required critical-section checks still fail closed. Deterministic\n  directory/owner disappearance regressions, the full 105-test checkpoint\n  saga suite, and five repeated real-process CAS runs pass locally.\n  Run `30966796114` passed its exact-SHA gate but failed before package creation\n  when the Agent SDK build assumed a package-local `node_modules/.bin/tsc`.\n  The build now resolves the TypeScript compiler module through Node, supporting\n  both independent installs and npm workspace hoisting; the consumed\n  `v-npm-0-162-194` identity is not moved or reused.\n  Run `30973665834` then passed the exact-SHA gate and all tests, but its\n  immutable package job passed the complete `npm pack --json` result as one\n  command-line argument; the 959-file metadata exceeded Linux `ARG_MAX` before\n  release-manifest creation. Pack metadata now flows through a temporary file,\n  and the consumed `v-npm-0-162-195` identity is also not moved or reused.\n  Run `30976924860` passed all tests, immutable tarball creation, SBOM validation,\n  and artifact upload, but `npm publish` interpreted the bare relative\n  `release-artifacts/...tgz` argument as a GitHub `owner/repo` package spec and\n  failed before upload. The publish step now discovers the tarball through the\n  absolute `$GITHUB_WORKSPACE` path; `v-npm-0-162-196` is not moved or reused.\n- **Release authority containment**: a later generic workspace publisher\n  replaced the dedicated CLI workflow at the same `npm-publish.yml` path.\n  Manually dispatched run `30820089779` therefore auto-selected and published\n  `chainlesschain@0.162.193` from `e8e7ba274b487ed491c04ec3359841a0e545debb`\n  while that SHA's `CLI CI` was still running and eventually failed. The\n  package has npm provenance but no `v-npm-0-162-193` tag, exact-SHA gate\n  attestation, verified immutable tarball/SBOM handoff, or successful complete\n  CLI matrix. The authoritative workflow is restored; the generic publisher\n  is moved to a distinct workflow/tag namespace, while the live CLI path now\n  requires the event ref to exactly match `v-npm-<package-version>` and its\n  checked-out `GITHUB_SHA`. The generic publisher excludes `packages/cli`\n  and package name `chainlesschain` both during detection and immediately\n  before publish. Numeric product releases no longer contain a CLI publisher:\n  they require an already-published `v-npm-*` tag, matching registry `gitHead`,\n  and successful exact-SHA gates before finalizing. The two local generic\n  publisher scripts also exclude and reject the CLI.\n- **Inline-chat release blocker**: the `0.162.193` source registered the six\n  VS Code inline-chat commands twice, invoked non-existent methods in the\n  second registration, and referenced an undefined `outputLog` during\n  activation. The extension now constructs one decorator with the existing\n  chat provider and module logger, registers each contributed command exactly\n  once, and publishes the same six commands through the canonical IDE\n  capability manifest. The activation fake now exercises the decorator path,\n  so constructor or registration regressions fail the CLI matrix.\n- **Production REPL prompt interactions**: each real REPL session now owns a\n  prompt interaction controller and slash-command registry for `/paste-image`,\n  `/editor`, `/stash`, `/suggestions`, and `/recap`. Guarded keypress dispatch\n  consumes configured interaction keys before readline, live assistant/session\n  context feeds manual and automatic suggestions, and local clipboard data\n  images join the existing multimodal vision-provider path while remote image\n  chips fail closed. The focused REPL, prompt, keybinding, image, and provider\n  matrix passes 200/200 locally; the exact-SHA three-platform release gates\n  listed below also passed.\n- **Second command-surface migration batch**: eight explicitly legacy or\n  in-memory governance commands (`bm25`, `ccron`, `compt`, `consol`, `fflag`,\n  `pdfp`, `sganal`, and `vcheck`) now have canonical `cc lab ...` spellings.\n  Their original top-level forms remain compatible through at least `0.164.0`\n  and warn only on stderr. The registered graph remains 175 commands with zero\n  net growth, while the recommended surface drops from 174 to 166; manifest,\n  README, namespace help, and four shell completions share the same lifecycle\n  source. Native manifest generation also now uses the real pure `/doctor`\n  status exports instead of a nonexistent registry import.\n- **Third command-surface migration batch**: fifteen explicitly in-memory V2\n  governance overlays (`execbe`, `itbudget`, `mcpscaf`, `meminj`, `orchgov`,\n  `promcomp`, `seshhook`, `seshsearch`, `seshtail`, `seshu`, `slotfill`,\n  `svccont`, `tms`, `topiccls`, and `uprof`) now use canonical `cc lab ...`\n  spellings. Product-facing `todo`, `subagent`, `webfetch`, and `planmode`\n  remain active top-level commands instead of being migrated by keyword alone.\n  Legacy spellings remain compatible through at least `0.164.0` and warn only\n  on stderr. The registered graph remains 175 commands with zero net growth;\n  the recommended surface drops from 166 to 151, with manifest, README,\n  namespace help, and four shell completions generated from one lifecycle\n  policy.\n- **Published release evidence**: `0.162.193` remains an unauthorized historical\n  registry record and is superseded by `0.162.197`; `0.162.194`, `0.162.195`,\n  and `0.162.196` are not published and their failed tags remain immutable.\n  Tag `v-npm-0-162-197` points to exact commit\n  `a03ad1b548cc6f15c9bef8f82d519e9c625eef8d`. Its\n  [CLI CI](https://github.com/chainlesschain/chainlesschain/actions/runs/30979565407),\n  [CLI Strict Sandbox](https://github.com/chainlesschain/chainlesschain/actions/runs/30979565251),\n  and [dedicated npm release](https://github.com/chainlesschain/chainlesschain/actions/runs/30979565206)\n  passed across Ubuntu, Windows, and macOS, including exact-SHA, immutable\n  tarball/SBOM, and provenance checks. A subsequent\n  [registry readback](https://github.com/chainlesschain/chainlesschain/actions/runs/30983536627)\n  verified package bytes, signed provenance, and workflow identity. Local,\n  older-SHA, and partial results remain supplementary only."
         }
       ]
     },