chainlesschain 0.162.197 → 0.162.200

package/src/repl/agent-repl.js

@@ -25,6 +25,7 @@ import path from "path";
 import { randomUUID } from "node:crypto";
 import { isPromise, isProxy } from "node:util/types";
 import { logger } from "../lib/logger.js";
+import { issueMcpStdioExecutionAuthority } from "../lib/mcp-stdio-execution-authority.js";
 import { getPlanModeManager, PlanState } from "../lib/plan-mode.js";
 import { createVimState, feedNormalKey } from "../lib/repl-vim.js";
 import {
@@ -68,6 +69,17 @@ import {
   isVerifiedSessionHostSnapshot,
   readSessionHostResumeState,
 } from "../lib/session-host-snapshot.js";
+import { acquireSessionHostLease } from "../lib/session-host-lease.js";
+import {
+  SideEffectLedger,
+  classifyToolSideEffect,
+  reconcileSideEffects,
+} from "../lib/side-effect-ledger.js";
+import {
+  loadSideEffectLedger,
+  persistSideEffectLedger,
+} from "../lib/side-effect-ledger-store.js";
+import { operationIdempotencyKey } from "../lib/idempotency.js";
 import {
   preserveDurableSystemMessageProvenance,
   projectCanonicalResumeMessages,
@@ -126,6 +138,7 @@ import { expandFileRefsAsync } from "../runtime/file-ref-expander.js";
 import { prepareVisionTurn, resolveVisionLlm } from "../lib/image-input.js";
 import { composeSystemPrompt } from "../runtime/system-prompt.js";
 import { installPipeSafety } from "../runtime/pipe-safety.js";
+import { installOutputBackpressure } from "../runtime/output-backpressure.js";
 import {
   makeFallbackChatFn,
   normalizeFallbackModels,
@@ -323,6 +336,9 @@ async function executeTool(name, args) {
  * unit-testable via the `options._coreLoop` injection seam.
  */
 export async function agentLoop(messages, options) {
+  const writeOut =
+    options.writeOut || ((text) => process.stdout.write(String(text)));
+  const waitForOutput = options.waitForOutput;
   // Resume-degenerate role merge (Claude Code 2.1.187 parity), gated by the
   // one-shot `mergeRoles` flag so it fires only on the first model call after
   // resuming a session whose prior run produced no assistant response. Collapse
@@ -343,7 +359,7 @@ export async function agentLoop(messages, options) {
   const onProviderFallback =
     options.onProviderFallback ||
     ((info) =>
-      process.stdout.write(
+      writeOut(
         chalk.yellow(
           `\n  ⚠️  ${info.message || `已从 "${info.from}" 切换到 "${info.to}"`}\n`,
         ),
@@ -354,6 +370,9 @@ export async function agentLoop(messages, options) {
   // The tool-result event carries no args; remember the last tool-executing
   // pair so a recorded denial can show what was attempted (/permissions denials).
   let _lastExec = null;
+  // The core loop runs tools serially. A classified non-MCP side effect stays
+  // live from its yielded `tool-executing` boundary until the matching result.
+  let _currentSideEffectOpId = null;
   for await (const event of runCoreLoop(messages, {
     ...options,
     // FORCE in-loop compaction off — the REPL runs its OWN post-turn compaction
@@ -380,7 +399,7 @@ export async function agentLoop(messages, options) {
         event.type === "managed-checkpoint-error" || event.coverage === "none"
           ? chalk.yellow
           : chalk.gray;
-      process.stdout.write(render(`${managedCheckpointLine}\n`));
+      writeOut(render(`${managedCheckpointLine}\n`));
     } else if (event.type === "checkpoint") {
       // Remember which file snapshot lines up with the live conversation so
       // `/rewind <n>` can restore code + conversation together (Claude-Code
@@ -393,7 +412,7 @@ export async function agentLoop(messages, options) {
           tool: event.tool,
         });
       }
-      process.stdout.write(
+      writeOut(
         chalk.gray(`  ⎌ checkpoint ${event.id} (before ${event.tool})\n`),
       );
     } else if (event.type === "tool-executing") {
@@ -402,12 +421,55 @@ export async function agentLoop(messages, options) {
         args: event.args,
         startedAt: options.now ? options.now() : Date.now(),
       };
-      process.stdout.write(
+      _currentSideEffectOpId = null;
+      if (options.sideEffects) {
+        const sideEffect = classifyToolSideEffect(event.tool, event.args);
+        if (sideEffect) {
+          const opId = options.sideEffects.nextOpId();
+          _currentSideEffectOpId = opId;
+          options.sideEffects.ledger
+            .prepare(opId, {
+              kind: sideEffect.kind,
+              key: sideEffect.key,
+              meta: {
+                tool: event.tool,
+                idempotencyKey: operationIdempotencyKey({
+                  tool: event.tool,
+                  args: event.args,
+                }),
+              },
+            })
+            .start(opId);
+          // The generator has yielded before executing the tool. Persist the
+          // started marker and recheck the host lease before resuming it.
+          options.sideEffects.persist();
+          options.sideEffects.assert?.();
+        }
+      }
+      writeOut(
         chalk.gray(
           `  [${event.tool}] ${formatToolArgs(event.tool, event.args)}\n`,
         ),
       );
     } else if (event.type === "tool-result") {
+      if (options.sideEffects && _currentSideEffectOpId) {
+        const sideEffectError = event.error || event.result?.error || null;
+        if (event.permission_decision) {
+          options.sideEffects.ledger.annotate(_currentSideEffectOpId, {
+            permissionDecision: event.permission_decision,
+          });
+        }
+        if (sideEffectError) {
+          options.sideEffects.ledger.fail(
+            _currentSideEffectOpId,
+            String(sideEffectError).slice(0, 200),
+          );
+        } else {
+          options.sideEffects.ledger.commit(_currentSideEffectOpId);
+        }
+        options.sideEffects.persist();
+        _currentSideEffectOpId = null;
+      }
       const durationMs =
         event.result?.toolTelemetryRecord?.durationMs ??
         (_lastExec?.tool === event.tool
@@ -438,9 +500,7 @@ export async function agentLoop(messages, options) {
         }
       }
       if (event.error || event.result?.error) {
-        process.stdout.write(
-          chalk.red(`  Error: ${event.error || event.result?.error}\n`),
-        );
+        writeOut(chalk.red(`  Error: ${event.error || event.result?.error}\n`));
         // Record policy denials (not plain tool failures) into the caller's
         // denial log for review via `/permissions denials` (Claude-Code 2.1.193
         // recent denials). Caller passes the session log (mirrors checkpointMarks)
@@ -477,13 +537,13 @@ export async function agentLoop(messages, options) {
           const sid = options?.sessionId;
           const policy = approval.policy || "strict";
           if (sid && policy === "strict") {
-            process.stdout.write(
+            writeOut(
               chalk.yellow(
                 `  Hint: relax policy with  cc session policy ${sid} --set trusted\n`,
               ),
             );
           } else if (sid) {
-            process.stdout.write(
+            writeOut(
               chalk.yellow(
                 `  Hint: per-session policy is "${policy}" — see  cc session policy ${sid}\n`,
               ),
@@ -491,26 +551,26 @@ export async function agentLoop(messages, options) {
           }
         }
       } else if (event.result?.success) {
-        process.stdout.write(chalk.green(`  Done\n`));
+        writeOut(chalk.green(`  Done\n`));
       }
     } else if (event.type === "thinking") {
       // Intermediate-step reasoning (before a tool call) — dimmed, inline.
       if (process.env.CC_REPL_THINKING !== "0" && event.text) {
-        process.stdout.write(
+        writeOut(
           "\n" + chalk.dim("💭 " + event.text.replace(/\n/g, "\n   ")) + "\n",
         );
       }
     } else if (event.type === "token-usage") {
       usageEvents.push(event);
     } else if (event.type === "iteration-warning") {
-      process.stdout.write(chalk.yellow(`\n  ${event.message}\n`));
+      writeOut(chalk.yellow(`\n  ${event.message}\n`));
     } else if (event.type === "iteration-budget-exhausted") {
-      process.stdout.write(
-        chalk.red(`\n  [Budget Exhausted] ${event.budget}\n`),
-      );
+      writeOut(chalk.red(`\n  [Budget Exhausted] ${event.budget}\n`));
     } else if (event.type === "response-complete") {
+      await waitForOutput?.();
       return { content: event.content, usageEvents, thinking: event.thinking };
     }
+    await waitForOutput?.();
   }
   return { content: "", usageEvents };
 }
@@ -1934,7 +1994,12 @@ export function createReplMcpHostRuntimeManager(dependencies = {}) {
     }
 
     const sink = persistLedger
-      ? createLedgerSink(sessionId, { appendEvent: appendLedgerEvent })
+      ? createLedgerSink(
+          sessionId,
+          appendLedgerEvent === appendAuthorityEvent
+            ? { recovery }
+            : { appendEvent: appendLedgerEvent },
+        )
       : null;
     const sharedController =
       !verifiedRecovery && current?.sessionId === sessionId
@@ -2050,6 +2115,21 @@ export async function runReplStartupBoundary(options, startupDependencies) {
       "CC_REPL_STARTUP_DEPENDENCY_INVALID",
     );
   }
+  const acquireHostLease = dependencyDataFunction(
+    startupDependencies,
+    "acquireSessionHostLease",
+    null,
+  );
+  const leaseScope = options._sessionHostLeaseScope || null;
+  const leaseSessionId = startupCandidate?.sessionId || options.sessionId;
+  if (
+    leaseScope &&
+    !leaseScope.lease &&
+    leaseSessionId &&
+    typeof acquireHostLease === "function"
+  ) {
+    leaseScope.lease = acquireHostLease(leaseSessionId, { hostKind: "repl" });
+  }
   const trustedWorkspaceRoot = readCwd();
   return enterWorkspace(trustedWorkspaceRoot, () =>
     startWorkspace(options, startupAdmission),
@@ -2058,37 +2138,155 @@ export async function runReplStartupBoundary(options, startupDependencies) {
 
 /** Start the agentic REPL with non-overridable production bindings. */
 export async function startAgentRepl(options = {}) {
-  return runReplStartupBoundary(options, {
-    prepareReplStartupResume,
-    refuseReplStartupResume,
-    cwd: () => process.cwd(),
-    runWithHostHooksV2Workspace,
-    startAgentReplInWorkspace,
-  });
+  const sessionHostLeaseScope = { lease: null };
+  const runtimeOptions = {
+    ...options,
+    _sessionHostLeaseScope: sessionHostLeaseScope,
+  };
+  try {
+    const result = await runReplStartupBoundary(runtimeOptions, {
+      prepareReplStartupResume,
+      refuseReplStartupResume,
+      acquireSessionHostLease,
+      cwd: () => process.cwd(),
+      runWithHostHooksV2Workspace,
+      startAgentReplInWorkspace,
+    });
+    if (result?.started === false) sessionHostLeaseScope.lease?.release?.();
+    return result;
+  } catch (error) {
+    sessionHostLeaseScope.lease?.release?.();
+    throw error;
+  }
 }
 
 async function startAgentReplInWorkspace(options = {}, startupAdmission) {
+  let failureHandler = null;
+  let disposePipeSafety = null;
+  const flow = installOutputBackpressure({
+    stdout: process.stdout,
+    stderr: process.stderr,
+    maxQueuedBytes: options.outputBackpressureMaxBytes,
+    onFailure: (error) => failureHandler?.(error),
+  });
+  let restored = false;
+  const outputScope = {
+    flow,
+    setFailureHandler(handler) {
+      failureHandler = handler;
+    },
+    setPipeDisposer(disposer) {
+      disposePipeSafety = disposer;
+    },
+    restore() {
+      if (restored) return;
+      restored = true;
+      disposePipeSafety?.();
+      flow.restore();
+    },
+  };
+  try {
+    return await startAgentReplInWorkspaceOwned(
+      options,
+      startupAdmission,
+      outputScope,
+    );
+  } catch (error) {
+    outputScope.restore();
+    throw error;
+  }
+}
+
+async function startAgentReplInWorkspaceOwned(
+  options = {},
+  startupAdmission,
+  outputScope,
+) {
   // EPIPE guard: if the REPL's stdout is piped and the consumer closes (e.g.
   // `cc agent | head`), the async stream `error` would otherwise crash the
   // process. Route a broken pipe into the REPL's own graceful shutdown (the
   // rl "close" handler — MCP disconnect, kill background tasks) when the
-  // interface exists, else exit cleanly. `_replClosing` makes it fire once so a
-  // cleanup write that also EPIPEs can't loop. `_replRl` is set when rl is built.
+  // interface and its close handler exist. `_replClosing` makes it fire once so
+  // a cleanup write that also EPIPEs can't loop. An early EPIPE remains pending
+  // until the close handler is attached; it never skips directly to exit.
   let _replRl = null;
   let _replClosing = false;
-  installPipeSafety(undefined, () => {
+  let _replCloseReady = false;
+  let _replCleanupStarted = false;
+  let _turnAbort = null;
+  let _replOutputFailure = null;
+  const _requestReplOutputClose = (error) => {
+    if (error && !_replOutputFailure) _replOutputFailure = error;
+    if (error) {
+      process.exitCode = error.code === "EPIPE" ? 0 : 1;
+      _turnAbort?.abort(error);
+    }
     if (_replClosing) return;
     _replClosing = true;
-    if (_replRl) {
+    if (_replRl && _replCloseReady) {
       try {
-        _replRl.close(); // triggers the graceful "close" cleanup → process.exit
-        return;
+        _replRl.close(); // triggers the graceful "close" cleanup
       } catch {
-        /* fall through to a bare exit */
+        // The close handler owns shutdown. Leaving exitCode set allows the
+        // event loop to drain without bypassing the teardown lifecycle.
       }
     }
-    process.exit(0);
-  });
+  };
+  const _sessionHostLeaseScope = options._sessionHostLeaseScope || null;
+  let _sessionHostLeaseAbortListener = null;
+  let _sessionHostLeaseAbortSignal = null;
+  const _detachSessionHostLease = () => {
+    if (_sessionHostLeaseAbortListener && _sessionHostLeaseAbortSignal) {
+      _sessionHostLeaseAbortSignal.removeEventListener(
+        "abort",
+        _sessionHostLeaseAbortListener,
+      );
+    }
+    _sessionHostLeaseAbortListener = null;
+    _sessionHostLeaseAbortSignal = null;
+  };
+  const _attachSessionHostLease = () => {
+    const signal = _sessionHostLeaseScope?.lease?.signal;
+    if (!signal || _sessionHostLeaseAbortListener) return;
+    _sessionHostLeaseAbortListener = () =>
+      _requestReplOutputClose(
+        signal.reason ||
+          Object.assign(new Error("Session host lease was lost"), {
+            code: "CC_SESSION_HOST_LEASE_FENCED",
+          }),
+      );
+    _sessionHostLeaseAbortSignal = signal;
+    signal.addEventListener("abort", _sessionHostLeaseAbortListener, {
+      once: true,
+    });
+    if (signal.aborted) _sessionHostLeaseAbortListener();
+  };
+  const _replaceSessionHostLease = (lease) => {
+    if (!_sessionHostLeaseScope) return null;
+    const previous = _sessionHostLeaseScope.lease;
+    if (previous === lease) return previous;
+    _detachSessionHostLease();
+    _sessionHostLeaseScope.lease = lease;
+    _attachSessionHostLease();
+    return previous;
+  };
+  _attachSessionHostLease();
+  const _replOutputFlow = outputScope.flow;
+  outputScope.setFailureHandler(_requestReplOutputClose);
+  const _disposeReplPipeSafety = installPipeSafety(undefined, () =>
+    _requestReplOutputClose(
+      Object.assign(new Error("REPL output pipe closed"), { code: "EPIPE" }),
+    ),
+  );
+  outputScope.setPipeDisposer(_disposeReplPipeSafety);
+  const _waitForReplOutput = async () => {
+    try {
+      await _replOutputFlow.wait();
+      return true;
+    } catch {
+      return false;
+    }
+  };
   const { useJsonl, candidate: _startupJsonlResume } = startupAdmission;
   let model = options.model || "qwen2.5:7b";
   let provider = options.provider || "ollama";
@@ -2630,10 +2828,20 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
     };
     if (useJsonl) {
       try {
-        sessionId = jsonlStartSession(null, meta);
+        sessionId = jsonlStartSession(options.sessionId || null, meta);
       } catch (_err) {
         // Non-critical
       }
+      if (
+        sessionId &&
+        _sessionHostLeaseScope &&
+        !_sessionHostLeaseScope.lease
+      ) {
+        _sessionHostLeaseScope.lease = acquireSessionHostLease(sessionId, {
+          hostKind: "repl",
+        });
+        _attachSessionHostLease();
+      }
     } else if (db) {
       try {
         const session = createSession(db, meta);
@@ -2771,6 +2979,79 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
   let _replBaseSystem = _buildReplBaseSystem();
   let _activeOutputStyle = null; // { name, body }
   const messages = [{ role: "system", content: _replBaseSystem }];
+  let _replSideEffects = null;
+  const _prepareReplSideEffects = (
+    targetSessionId,
+    { recover = false } = {},
+  ) => {
+    if (!useJsonl || !targetSessionId) {
+      return Object.freeze({
+        sideEffects: null,
+        noticeMessage: null,
+        warning: null,
+      });
+    }
+    let ledger;
+    let loadError = null;
+    try {
+      ledger = loadSideEffectLedger(targetSessionId);
+    } catch (error) {
+      ledger = new SideEffectLedger();
+      loadError = error;
+    }
+    const runNonce = `${Date.now()}:${randomUUID()}`;
+    let sequence = 0;
+    let noticeMessage = null;
+    let warning = null;
+    if (recover && !loadError) {
+      const plan = reconcileSideEffects(ledger);
+      if (plan.inspect.length > 0) {
+        const lines = plan.plans
+          .filter((entry) => entry.action === "inspect")
+          .map((entry) => {
+            const operation = ledger.get(entry.opId);
+            const key = operation?.key ? ` (${operation.key})` : "";
+            return `  - [${operation?.kind || "unknown"}]${key} - ${entry.reason}`;
+          });
+        noticeMessage = Object.freeze({
+          role: "system",
+          content:
+            "Recovery notice: the previous REPL host stopped while irreversible operations were in flight. Their outcome is UNKNOWN. Do not blindly repeat them; verify whether each operation already took effect and ask the user when uncertain:\n" +
+            lines.join("\n"),
+        });
+        warning = `Recovery: ${plan.inspect.length} interrupted non-MCP side effect(s) require verification before replay.`;
+      }
+    } else if (recover && loadError) {
+      noticeMessage = Object.freeze({
+        role: "system",
+        content:
+          "Recovery notice: the durable non-MCP side-effect ledger is unavailable. Read-only work may continue, but irreversible tools are blocked until recovery authority is restored.",
+      });
+      warning = `Recovery: non-MCP side-effect ledger is unavailable for ${targetSessionId}; irreversible tools are fail-closed.`;
+    }
+    const sideEffects = Object.freeze({
+      ledger,
+      nextOpId: () => `${runNonce}:${sequence++}`,
+      persist: () => {
+        if (loadError) throw loadError;
+        const persisted = persistSideEffectLedger(targetSessionId, ledger);
+        if (persisted === false) {
+          const error = new Error(
+            `Side-effect ledger persistence was rejected for ${targetSessionId}`,
+          );
+          error.code = "SIDE_EFFECT_LEDGER_PERSIST_FAILED";
+          throw error;
+        }
+        return persisted;
+      },
+      assert: () => _sessionHostLeaseScope?.lease?.assert?.(),
+    });
+    return Object.freeze({ sideEffects, noticeMessage, warning });
+  };
+  const _startupReplSideEffects = _prepareReplSideEffects(sessionId, {
+    recover: Boolean(options.sessionId && _startupJsonlResume?.ok),
+  });
+  _replSideEffects = _startupReplSideEffects.sideEffects;
   let _mcpLedgerRecovery = null;
   let _mcpLedgerRecoveryError = null;
   const _prepareJsonlResumeCandidate = (targetSessionId) =>
@@ -2988,7 +3269,15 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
             let connected = 0;
             for (const [name, cfg] of serverEntries) {
               try {
-                await _bundleMcpClient.connect(name, cfg);
+                const authorizedConfig = { ...cfg };
+                authorizedConfig.mcpStdioExecutionAuthority =
+                  issueMcpStdioExecutionAuthority({
+                    serverName: name,
+                    config: authorizedConfig,
+                    approvalKind: "explicit-config",
+                    approvalSource: `agent-bundle:${path.resolve(options.bundlePath)}`,
+                  });
+                await _bundleMcpClient.connect(name, authorizedConfig);
                 connected += 1;
               } catch (mcpErr) {
                 logger.log(
@@ -3280,6 +3569,12 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
           throw error;
         }
         messages.push(...prepared.canonicalSystemMessages);
+        if (_startupReplSideEffects.noticeMessage) {
+          messages.push(_startupReplSideEffects.noticeMessage);
+        }
+        if (_startupReplSideEffects.warning) {
+          logger.warn(_startupReplSideEffects.warning);
+        }
         _commitMcpRecoveryCandidate(messages, prepared.mcp);
         if (prepared.replayMessages.length > 0) {
           messages.push(...prepared.conversationMessages);
@@ -3868,7 +4163,7 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
   // seam (throwIfAborted at each iteration); partial conversation is kept.
   // Idle Esc presses (no active turn) are ignored, and escape-prefixed key
   // sequences (arrows etc.) never reach here as bare "escape".
-  let _turnAbort = null;
+  _turnAbort = null;
   let _lastIdleEscAt = 0;
   let _replKeypressHandler = null;
   if (process.stdin.isTTY) {
@@ -4089,7 +4384,9 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
         });
         // Custom command wins; otherwise the built-in context-usage render.
         if (_slCfg) {
-          return _sl.renderStatusLine(_slCfg, context, { cwd: process.cwd() });
+          return _sl.renderStatusLine(_slCfg, context, {
+            cwd: process.cwd(),
+          });
         }
         const line = _sl.renderDefaultStatusLine(context);
         return line && line.trim() ? line : null;
@@ -4423,7 +4720,7 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
         `  ${chalk.cyan("/add-dir")}    Add an extra working root (/add-dir <dir>; no arg lists roots)`,
       );
       logger.log(
-        `  ${chalk.cyan("/reload-skills")} Re-scan skill layers without restarting`,
+        `  ${chalk.cyan("/reload-skills")} Revoke process Skill grants and re-scan layers`,
       );
       logger.log(
         `  ${chalk.cyan("/reload-plugins")} Re-scan installed plugins after add/trust/upgrade`,
@@ -5283,7 +5580,11 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
               dispatchAsyncHooks(
                 _settingsHooks,
                 "CwdChanged",
-                { old_cwd: oldCwd, cwd: newCwd, session_id: sessionId || null },
+                {
+                  old_cwd: oldCwd,
+                  cwd: newCwd,
+                  session_id: sessionId || null,
+                },
                 { cwd: newCwd, supervisor: _asyncHookSupervisor },
               );
             } catch {
@@ -5747,39 +6048,87 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
         const resumeId = sessionArg.slice(7).trim();
         try {
           if (useJsonl) {
-            const prepared = _prepareJsonlResumeCandidate(resumeId);
-            if (!prepared.ok) throw prepared.error;
-            const preparedMcpRuntime = _prepareMcpHostRuntime(
-              prepared.sessionId,
-              prepared.mcp,
-            );
-            const preparedMcpCommit = _prepareMcpRecoveryCommit(prepared.mcp);
-            const hostSystemMessages = _refreshHostSystemMessages();
-            const previousState = _captureResumeState();
-            const preparedState = Object.freeze({
-              sessionId: prepared.sessionId,
-              hostSystemMessages,
-              canonicalSystemMessages: prepared.canonicalSystemMessages,
-              conversationMessages: prepared.conversationMessages,
-              mcpCommit: preparedMcpCommit,
-              mcpRuntime: preparedMcpRuntime,
-              sanitizeRolesNextTurn:
-                prepared.conversationMessages.at(-1)?.role === "user",
-              logMessage: `Resumed JSONL session ${prepared.sessionId} (${prepared.rebuiltMessages.length} messages)`,
-            });
-            const committed = commitPreparedReplJsonlResume(
-              prepared,
-              () => _applyPreparedResumeState(preparedState),
-              () => _restoreResumeState(previousState),
-            );
-            if (!committed) {
-              const error = new Error(
-                "Prepared JSONL session resume was not committed",
+            const initialCandidate = _prepareJsonlResumeCandidate(resumeId);
+            if (!initialCandidate.ok) throw initialCandidate.error;
+            const currentLease = _sessionHostLeaseScope?.lease || null;
+            const reuseCurrentLease = initialCandidate.sessionId === sessionId;
+            let targetLease = reuseCurrentLease ? currentLease : null;
+            let adoptedTargetLease = reuseCurrentLease && Boolean(currentLease);
+            if (!targetLease) {
+              targetLease = acquireSessionHostLease(
+                initialCandidate.sessionId,
+                {
+                  hostKind: "repl",
+                },
+              );
+            }
+            let prepared;
+            try {
+              // Re-sample after acquiring the target's write authority. The
+              // first sample resolves/refuses the request; this one is the
+              // exact snapshot committed into the live REPL.
+              prepared = _prepareJsonlResumeCandidate(
+                initialCandidate.sessionId,
+              );
+              if (!prepared.ok) throw prepared.error;
+              const preparedSideEffects = _prepareReplSideEffects(
+                prepared.sessionId,
+                { recover: true },
               );
-              error.code = "CC_REPL_SESSION_RESUME_NOT_COMMITTED";
-              throw error;
+              const preparedMcpRuntime = _prepareMcpHostRuntime(
+                prepared.sessionId,
+                prepared.mcp,
+              );
+              const preparedMcpCommit = _prepareMcpRecoveryCommit(prepared.mcp);
+              const hostSystemMessages = _refreshHostSystemMessages();
+              const previousState = _captureResumeState();
+              const preparedState = Object.freeze({
+                sessionId: prepared.sessionId,
+                hostSystemMessages,
+                canonicalSystemMessages: Object.freeze([
+                  ...prepared.canonicalSystemMessages,
+                  ...(preparedSideEffects.noticeMessage
+                    ? [preparedSideEffects.noticeMessage]
+                    : []),
+                ]),
+                conversationMessages: prepared.conversationMessages,
+                mcpCommit: preparedMcpCommit,
+                mcpRuntime: preparedMcpRuntime,
+                sanitizeRolesNextTurn:
+                  prepared.conversationMessages.at(-1)?.role === "user",
+                logMessage: `Resumed JSONL session ${prepared.sessionId} (${prepared.rebuiltMessages.length} messages)`,
+              });
+              const committed = commitPreparedReplJsonlResume(
+                prepared,
+                () => _applyPreparedResumeState(preparedState),
+                () => _restoreResumeState(previousState),
+              );
+              if (!committed) {
+                const error = new Error(
+                  "Prepared JSONL session resume was not committed",
+                );
+                error.code = "CC_REPL_SESSION_RESUME_NOT_COMMITTED";
+                throw error;
+              }
+              const previousLease = _replaceSessionHostLease(targetLease);
+              adoptedTargetLease = true;
+              _replSideEffects = preparedSideEffects.sideEffects;
+              if (preparedSideEffects.warning) {
+                logger.warn(preparedSideEffects.warning);
+              }
+              if (previousLease && previousLease !== targetLease) {
+                try {
+                  previousLease.release?.();
+                } catch (releaseError) {
+                  logger.warn(
+                    `Session switch committed, but the prior host lease could not be released: ${releaseError.message}`,
+                  );
+                }
+              }
+              _replCompactPersistence.replace(prepared.rebuiltMessages);
+            } finally {
+              if (!adoptedTargetLease) targetLease?.release?.();
             }
-            _replCompactPersistence.replace(prepared.rebuiltMessages);
           } else if (db) {
             const existing = getSession(db, resumeId);
             if (existing && existing.messages) {
@@ -5847,6 +6196,11 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
     // layers (incl. .claude/skills) without restarting the session.
     if (trimmed === "/reload-skills") {
       try {
+        _replSkillLoader.revokeExecutionAuthorizations?.({
+          message:
+            "Skill execution authorization was revoked by /reload-skills",
+          reasonCode: "reload-skills",
+        });
         _replSkillLoader.clearCache();
         const n = _replSkillLoader.loadAll().length;
         _replBaseSystem = _buildReplBaseSystem();
@@ -5856,7 +6210,7 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
         _persistReplContextSources();
         logger.log(
           chalk.green(
-            `✔ skills reloaded — ${n} available (${_replSkillLoader.getLayerPaths().length} layers re-scanned)`,
+            `✔ Skill grants revoked and skills reloaded — ${n} available (${_replSkillLoader.getLayerPaths().length} layers re-scanned)`,
           ),
         );
       } catch (err) {
@@ -6069,7 +6423,9 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
             logger.log(chalk.gray(l));
         } else {
           // set — createReplGoal throws on a malformed spec (caught below).
-          _sessionGoal = rg.createReplGoal(cmd.spec, { now: () => Date.now() });
+          _sessionGoal = rg.createReplGoal(cmd.spec, {
+            now: () => Date.now(),
+          });
           for (const l of rg.renderGoalStart(_sessionGoal))
             logger.log(chalk.cyan(l));
         }
@@ -7679,22 +8035,29 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
       // reasoning dimmed before it. Skipped (left undefined) in replay mode.
       let _liveStreamed = false;
       let _liveThinkStarted = false;
+      const _settleLiveWrite = (blocked) =>
+        blocked ? _replOutputFlow.wait() : undefined;
       const liveOpts = _streamLive
         ? {
             onToken: (t) => {
               // Separate the answer from the dimmed reasoning above it (once).
-              if (!_liveStreamed && _liveThinkStarted)
-                process.stdout.write("\n");
+              let blocked = false;
+              if (!_liveStreamed && _liveThinkStarted) {
+                blocked = process.stdout.write("\n") === false;
+              }
               _liveStreamed = true;
-              process.stdout.write(t);
+              blocked = process.stdout.write(t) === false || blocked;
+              return _settleLiveWrite(blocked);
             },
             onThinking: (t) => {
               if (process.env.CC_REPL_THINKING === "0") return;
+              let blocked = false;
               if (!_liveThinkStarted) {
                 process.stdout.write(chalk.dim("💭 "));
                 _liveThinkStarted = true;
               }
-              process.stdout.write(chalk.dim(t));
+              blocked = process.stdout.write(chalk.dim(t)) === false || blocked;
+              return _settleLiveWrite(blocked);
             },
           }
         : {};
@@ -7726,7 +8089,9 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
       if (_settingsHooks && !_asyncHookSupervisor) {
         const { AsyncHookSupervisor } =
           await import("../lib/async-hook-supervisor.js");
-        _asyncHookSupervisor = new AsyncHookSupervisor({ persistStats: true });
+        _asyncHookSupervisor = new AsyncHookSupervisor({
+          persistStats: true,
+        });
       }
       const activeMcpRuntime = _activateMcpHostRuntime();
       const activeRawMcpClient = activeMcpRuntime.rawClient || undefined;
@@ -7736,6 +8101,7 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
         thinking: reasoning,
       } = await agentLoop(messages, {
         ...liveOpts,
+        waitForOutput: _replOutputFlow.wait,
         mergeRoles: _mergeRolesThisTurn,
         // Visible auto-retry feedback (Claude-Code 2.1.181): when the model's
         // streaming call hits a transient connection drop and retries, tell the
@@ -7808,6 +8174,9 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
         // Explicit turn-binding producer (null unless a JSONL session): the
         // wrapper folds every loop event into the live table.
         turnBindingFeed: _turnBindingProducer,
+        // Non-MCP irreversible tools use the same prepare/start/settle ledger
+        // and final lease assertion as headless, stream, and WebSocket hosts.
+        sideEffects: _replSideEffects,
         denialLog: _recentDenials,
         persistRecentDenials: true,
         permissionMode: _sessionTier,
@@ -8170,6 +8539,7 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
   };
 
   rl.on("line", async (input) => {
+    if (!(await _waitForReplOutput())) return;
     if (_processingLine) {
       const concurrentBtw = _slashCommandsDisabled
         ? null
@@ -8193,10 +8563,12 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
     _processingLine = true;
     try {
       await handleLine(input);
+      if (!(await _waitForReplOutput())) return;
       while (_pendingLines.length) {
         const next = _pendingLines.shift();
         logger.log(chalk.cyan(`▶ running queued input: ${next}`));
         await handleLine(next);
+        if (!(await _waitForReplOutput())) return;
       }
     } finally {
       _processingLine = false;
@@ -8204,6 +8576,9 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
   });
 
   rl.on("close", async () => {
+    if (_replCleanupStarted) return;
+    _replCleanupStarted = true;
+    _replClosing = true;
     _promptInteractions.dispose();
     if (process.stdin.isTTY) {
       if (_replKeypressHandler) {
@@ -8386,11 +8761,42 @@ async function startAgentReplInWorkspace(options = {}, startupAdmission) {
     }
 
     // Shutdown runtime
+    _detachSessionHostLease();
+    try {
+      _sessionHostLeaseScope?.lease?.release?.();
+    } catch (error) {
+      _replOutputFailure ||= error;
+    }
     try {
       await shutdown();
     } catch (_e) {
       // Non-critical
     }
-    process.exit(0);
+    if (!_replOutputFailure) {
+      try {
+        await _replOutputFlow.wait();
+      } catch (error) {
+        _replOutputFailure ||= error;
+      }
+    }
+    const outputExitCode = _replOutputFailure
+      ? _replOutputFailure.code === "EPIPE"
+        ? 0
+        : 1
+      : 0;
+    outputScope.restore();
+    process.exit(outputExitCode);
   });
+  _replCloseReady = true;
+  if (_replClosing) {
+    // stdout may have broken before readline and its cleanup handler were fully
+    // initialized. Close only now so the complete async teardown runs.
+    queueMicrotask(() => {
+      try {
+        rl.close();
+      } catch {
+        process.exitCode = 0;
+      }
+    });
+  }
 }