chainlesschain 0.162.198 → 0.162.200

package/src/commands/mcp.js

@@ -44,8 +44,14 @@ import {
   MCP_STDIO_LOCAL_CODE_TRUST_REQUIRED_CODE,
   issueMcpStdioExecutionAuthority,
   materializeApprovedMcpStdioInvocation,
+  resolveMcpStdioExecutionApproval,
 } from "../lib/mcp-stdio-execution-authority.js";
 import { prepareMcpStdioExecutableIdentity } from "../lib/mcp-stdio-executable-identity.js";
+import {
+  materializeMcpStdioNpmPackage,
+  parseExactNpmPackageSpec,
+} from "../lib/mcp-stdio-package-materialization.js";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
 import {
   CATALOG as REGISTRY_CATALOG,
   CATEGORIES as REGISTRY_CATEGORIES,
@@ -807,6 +813,119 @@ export function registerMcpCommand(program) {
       }
     });
 
+  mcp
+    .command("materialize-package <name>")
+    .description(
+      "Replace one exact JavaScript package launcher with a content-addressed, guarded dependency capsule",
+    )
+    .requiredOption(
+      "--package <name@version>",
+      "Exact npm registry package version to install (ranges and tags are rejected)",
+    )
+    .option(
+      "--bin <name>",
+      "Select one exported bin when the package has several",
+    )
+    .option(
+      "--scope <scope>",
+      `Configuration scope: ${MCP_CONFIG_SCOPES.join(" | ")}`,
+    )
+    .option(
+      "--json",
+      "Output the materialized generation and closure identity as JSON",
+    )
+    .action(async (name, options) => {
+      try {
+        const exact = parseExactNpmPackageSpec(options.package);
+        const ctx = await bootstrap({ verbose: program.opts().verbose });
+        if (!ctx.db) throw new Error("Database not available");
+        const configStore = new MCPServerConfig(ctx.db.getDatabase());
+        const scope = options.scope
+          ? normalizeMcpConfigScope(options.scope)
+          : undefined;
+        const rows = await effectiveMcpRows(configStore, { scope });
+        const row = rows.find((entry) => entry.name === name);
+        if (!row) {
+          throw new Error(
+            `${notFoundWithSuggestion(
+              name,
+              rows.map((entry) => entry.name),
+              { noun: "Server" },
+            )}. Use 'mcp add' first.`,
+          );
+        }
+        if (inferTransport(row) !== "stdio") {
+          throw new Error(
+            `MCP server "${name}" does not use the stdio transport`,
+          );
+        }
+
+        const authorized = authorizeMcpRowForConnect(row);
+        const approval = consumeMcpStdioExecutionAuthority(
+          authorized.mcpStdioExecutionAuthority,
+          { serverName: name, config: authorized },
+        );
+        const invocation = materializeApprovedMcpStdioInvocation(approval);
+        const approvalRecord = resolveMcpStdioExecutionApproval(approval);
+        const materialized = materializeMcpStdioNpmPackage({
+          approvalRecord,
+          config: invocation,
+          packageSpec: exact.spec,
+          ...(options.bin ? { binName: options.bin } : {}),
+          env: process.env,
+          processBrokerRunSync: (command, args, spawnOptions) =>
+            executionBroker.spawnSync(command, args, {
+              ...spawnOptions,
+              origin: `mcp:package-materialization:${name}`,
+              policy: "allow",
+              scope: "mcp",
+              shell: false,
+            }),
+        });
+        const prepared = prepareMcpStdioExecutableIdentity({
+          serverName: name,
+          config: invocation,
+          approval,
+          cwd: process.cwd(),
+          env: process.env,
+          retrust: true,
+        });
+        const result = {
+          name,
+          package: exact.spec,
+          generation: materialized.generation,
+          manifestDigest: materialized.manifestDigest,
+          identityDigest: prepared.identityDigest,
+          closure: materialized.identity,
+          command: prepared.identity.command,
+          entrypoints: prepared.identity.entrypoints,
+        };
+        if (options.json) {
+          console.log(JSON.stringify(result, null, 2));
+        } else {
+          logger.log(
+            chalk.green(
+              `Materialized and trusted ${exact.spec} for MCP server "${name}".`,
+            ),
+          );
+          logger.log(
+            `  ${chalk.gray("Generation:")} ${materialized.generation}`,
+          );
+          logger.log(
+            `  ${chalk.gray("Dependency closure:")} sha256:${materialized.identity.closureDigest} (${materialized.identity.fileCount} files, ${materialized.identity.totalBytes} bytes)`,
+          );
+          logger.log(
+            `  ${chalk.gray("Execution capsule:")} sha256:${materialized.identity.capsule.sha256} (${materialized.identity.capsule.bytes} bytes, ${materialized.identity.capsule.inputCount} bundled inputs)`,
+          );
+        }
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exitCode = 1;
+        await shutdown();
+      }
+    });
+
   mcp
     .command("trust-executable <name>")
     .description(

package/src/commands/session-show.js

@@ -1,13 +1,11 @@
 import chalk from "chalk";
 import { numericOption } from "../lib/cli-numeric.js";
-import { feature } from "../lib/feature-flags.js";
 import { logger } from "../lib/logger.js";
 import { getPrLinks } from "../lib/pr-link-store.js";
 import {
   getJsonlSessionMetadata,
   rebuildMessages,
-  resolveSessionId,
-  sessionHasPersistedEvidence,
+  resolveSessionAuthority,
 } from "../harness/jsonl-session-store.js";
 
 export function registerSessionShowSubcommand(session, program) {
@@ -23,14 +21,14 @@ export function registerSessionShowSubcommand(session, program) {
       try {
         let sess = null;
 
-        const jsonlId = feature("JSONL_SESSION") ? resolveSessionId(id) : null;
-        if (
-          !jsonlId &&
-          feature("JSONL_SESSION") &&
-          sessionHasPersistedEvidence(id)
-        ) {
+        // The feature flag controls creation/migration, not authority. Once a
+        // canonical namespace witness exists it must fence the legacy DB even
+        // if JSONL_SESSION is later disabled.
+        const authority = resolveSessionAuthority(id);
+        const jsonlId = authority?.readable ? authority.id : null;
+        if (authority && !authority.readable) {
           logger.error(
-            `Session ${id} has canonical persistence evidence but no readable transcript.`,
+            `Session ${authority.id} has canonical persistence evidence but no readable transcript (${authority.presence}).`,
           );
           process.exitCode = 1;
           return;

package/src/commands/session.js

@@ -47,18 +47,17 @@ import {
   getSessionManagerStatsV2,
 } from "../lib/session-manager.js";
 import {
-  listJsonlSessions,
+  listSessionAuthoritySummaries,
+  listSessionEvidenceIds,
   rebuildMessages,
   getJsonlSessionMetadata,
-  resolveSessionId,
-  sessionHasPersistedEvidence,
+  resolveSessionAuthority,
   deleteJsonlSession,
   migrateLegacySessions,
   migrateLegacySessionsBatch,
   validateJsonlSession,
   validateAllJsonlSessions,
 } from "../harness/jsonl-session-store.js";
-import { feature } from "../lib/feature-flags.js";
 import {
   listWorkflowSessions,
   readWorkflowSession,
@@ -234,26 +233,24 @@ export function registerSessionCommand(program) {
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         const limit = Math.max(1, parseInt(options.limit) || 20);
         let sessions = [];
+        const canonicalIds = new Set(listSessionEvidenceIds());
 
         // Merge DB sessions + JSONL sessions
         if (ctx.db) {
           const db = ctx.db.getDatabase();
           sessions.push(
-            ...listSessions(db, { limit }).map((s) => ({
-              ...s,
-              _store: "db",
-            })),
+            ...listSessions(db, { limit })
+              .filter((s) => !canonicalIds.has(s?.id))
+              .map((s) => ({
+                ...s,
+                _store: "db",
+              })),
           );
         }
 
-        if (feature("JSONL_SESSION")) {
-          sessions.push(
-            ...listJsonlSessions({ limit }).map((s) => ({
-              ...s,
-              _store: "jsonl",
-            })),
-          );
-        }
+        // Existing canonical sessions remain authoritative even if the
+        // creation/migration feature flag is later disabled.
+        sessions.push(...listSessionAuthoritySummaries({ limit }));
 
         // Deduplicate by id (JSONL takes precedence) and rank by real time.
         sessions = rankSessions(sessions, limit);
@@ -324,11 +321,14 @@ export function registerSessionCommand(program) {
         try {
           ctx = await bootstrap({ verbose: program.opts().verbose });
           if (ctx.db) {
+            const canonicalIds = new Set(listSessionEvidenceIds());
             local.push(
-              ...listSessions(ctx.db.getDatabase(), { limit }).map((item) => ({
-                ...item,
-                _store: "db",
-              })),
+              ...listSessions(ctx.db.getDatabase(), { limit })
+                .filter((item) => !canonicalIds.has(item?.id))
+                .map((item) => ({
+                  ...item,
+                  _store: "db",
+                })),
             );
           }
         } catch (error) {
@@ -338,12 +338,7 @@ export function registerSessionCommand(program) {
           // JSONL is the canonical transcript store and can be read without
           // bootstrapping legacy native DB/config packages (some of which
           // write banners directly to stdout and would corrupt --json).
-          local.push(
-            ...listJsonlSessions({ limit }).map((item) => ({
-              ...item,
-              _store: "jsonl",
-            })),
-          );
+          local.push(...listSessionAuthoritySummaries({ limit }));
           local = rankSessions(local, limit);
         } catch (error) {
           sourceErrors.local = error?.message || String(error);
@@ -613,15 +608,14 @@ export function registerSessionCommand(program) {
           id = picked.id;
         }
 
-        // Try JSONL first
-        const jsonlId = feature("JSONL_SESSION") ? resolveSessionId(id) : null;
-        if (
-          !jsonlId &&
-          feature("JSONL_SESSION") &&
-          sessionHasPersistedEvidence(id)
-        ) {
+        // Try the complete canonical namespace first. The feature flag cannot
+        // make an existing/damaged canonical generation disappear and thereby
+        // authorize a legacy fallback.
+        const authority = resolveSessionAuthority(id);
+        const jsonlId = authority?.readable ? authority.id : null;
+        if (authority && !authority.readable) {
           logger.error(
-            `Session ${id} has canonical persistence evidence but no readable transcript.`,
+            `Session ${authority.id} has canonical persistence evidence but no readable transcript (${authority.presence}).`,
           );
           logger.error(
             "Refusing legacy fallback. Inspect or explicitly delete the damaged JSONL session before reusing its id.",
@@ -735,11 +729,14 @@ export function registerSessionCommand(program) {
         // Canonical content source: append-only JSONL event log. The legacy DB
         // is consulted only when no matching transcript exists.
         const store = await import("../harness/jsonl-session-store.js");
-        const sid =
-          id === "last" ? store.getLastSessionId() : store.resolveSessionId(id);
-        if (!sid && id !== "last" && store.sessionHasPersistedEvidence(id)) {
+        const requestedId = id === "last" ? store.getLastSessionId() : id;
+        const authority = requestedId
+          ? store.resolveSessionAuthority(requestedId)
+          : null;
+        const sid = authority?.readable ? authority.id : null;
+        if (authority && !authority.readable) {
           throw new Error(
-            `Session ${id} has canonical persistence evidence but no readable transcript`,
+            `Session ${authority.id} has canonical persistence evidence but no readable transcript (${authority.presence})`,
           );
         }
         if (sid) {
@@ -820,7 +817,10 @@ export function registerSessionCommand(program) {
         try {
           const sessionIndex = await import("../harness/session-index.js");
           indexDb = sessionIndex.openIndex();
-          sessionIndex.syncIndex(indexDb);
+          const sync = sessionIndex.syncIndex(indexDb);
+          if (sync.rejected > 0) {
+            indexDiagnostic = `${sync.rejected} canonical session(s) were excluded because verification failed`;
+          }
           matches = sessionIndex
             .searchSessions(indexDb, query, { limit })
             .map((hit) => ({
@@ -841,7 +841,7 @@ export function registerSessionCommand(program) {
           });
           for (const s of sessions) {
             if (matches.length >= limit) break;
-            for (const ev of store.readEvents(s.id)) {
+            for (const ev of store.readVerifiedEvents(s.id)) {
               if (matches.length >= limit) break;
               if (
                 ev.type !== "user_message" &&
@@ -921,8 +921,8 @@ export function registerSessionCommand(program) {
     .action(async (id, options) => {
       let ctx = null;
       try {
-        const jsonlId =
-          resolveSessionId(id) || (sessionHasPersistedEvidence(id) ? id : null);
+        const authority = resolveSessionAuthority(id);
+        const jsonlId = authority?.id || null;
         let db = null;
         try {
           ctx = await bootstrap({ verbose: program.opts().verbose });
@@ -985,10 +985,11 @@ export function registerSessionCommand(program) {
           Array.isArray(title) ? title.join(" ") : title,
         ).trim();
         if (!normalized) throw new Error("A non-empty title is required");
-        const jsonlId = resolveSessionId(id);
-        if (!jsonlId && sessionHasPersistedEvidence(id)) {
+        const authority = resolveSessionAuthority(id);
+        const jsonlId = authority?.readable ? authority.id : null;
+        if (authority && !authority.readable) {
           throw new Error(
-            `Session ${id} has canonical persistence evidence but no readable transcript`,
+            `Session ${authority.id} has canonical persistence evidence but no readable transcript (${authority.presence})`,
           );
         }
         let result;
@@ -2175,14 +2176,17 @@ async function mirrorSessions(ids) {
 
   const pushed = [];
   const errors = [];
-  const { readFileSync, existsSync } = await import("node:fs");
   for (const id of ids) {
     try {
-      if (store.isUnsafeSessionId(id)) throw new Error("unsafe session id");
-      const file = store.sessionPath(id);
-      if (!existsSync(file)) throw new Error("session not found");
-      const bytes = readFileSync(file, "utf-8");
-      pushed.push(await mirror.push(id, bytes));
+      const authority = store.resolveSessionAuthority(id);
+      if (!authority) throw new Error("session not found");
+      if (!authority.readable) {
+        throw new Error(
+          `canonical session is not readable (${authority.presence})`,
+        );
+      }
+      const bytes = store.readVerifiedTranscriptBytes(authority.id);
+      pushed.push(await mirror.push(authority.id, bytes));
     } catch (err) {
       errors.push({ id, error: err.message });
     }
@@ -2232,7 +2236,11 @@ async function mirrorPruneSessions() {
   const { pruneMirror } = await import("../harness/session-mirror.js");
   const { mirror } = await loadConfiguredMirror();
   if (!mirror) return { target: null, deleted: [], kept: [] };
-  const keep = store.listSessionIds();
+  // A damaged local generation must not cause automatic deletion of its last
+  // off-box recovery copy. Only an explicit canonical tombstone is prunable.
+  const keep = store
+    .listSessionEvidenceIds()
+    .filter((id) => store.getSessionPresence(id) !== "tombstoned");
   const res = await pruneMirror(mirror, { keep });
   return { target: mirror.target, ...res };
 }

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.162.200",
+      "cliVersions": ["0.162.198", "0.162.200"],
+      "date": "2026-08-07",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed — cc CLI 0.162.200: release-gate isolation and carried reliability fixes",
+          "body": "> `chainlesschain` **0.162.198 → 0.162.200** (release candidate,\n> 2026-08-07; `0.162.199` failed before npm upload and its tag remains\n> immutable). CLI-only release metadata; `@chainlesschain/personal-data-hub`\n> remains **0.4.57** and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Carries the complete 0.162.199 candidate**: command lifecycle telemetry and\n  alias observation policy, canonical session authority, fixed MCP package\n  capsules, native update recovery, and portable reliability gates are all\n  included because `0.162.199` never reached npm.\n- **Release-gate isolation**: the Agent SDK real-CLI E2E now places its\n  rollback-resistant security anchor beside, rather than inside,\n  `CHAINLESSCHAIN_HOME`. The fixture therefore matches the production\n  fail-closed layout after redirecting `HOME` and no longer hides the `agent`\n  command behind compatibility registration.\n- **Pre-release evidence**: implementation SHA `bf6924013d1c` passed the full\n  [npm release dry-run](https://github.com/chainlesschain/chainlesschain/actions/runs/31189959290),\n  including core packages, Agent SDK real-CLI E2E, Personal Data Hub, Web Panel,\n  the complete CLI suite, and credential-free npm package validation. The final\n  `0.162.200` version commit must pass the exact-SHA CLI CI and CLI Strict\n  Sandbox matrices before tag `v-npm-0-162-200` is created."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.162.199",
+      "cliVersions": ["0.162.198", "0.162.199"],
+      "date": "2026-08-07",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed — cc CLI 0.162.199: session authority, MCP capsules, and recovery reliability",
+          "body": "> `chainlesschain` **0.162.198 → 0.162.199** (not published, 2026-08-07;\n> the release workflow failed before package creation or npm upload and tag\n> `v-npm-0-162-199` remains immutable). CLI-only release metadata;\n> `@chainlesschain/personal-data-hub` remains **0.4.57** and\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Command lifecycle telemetry**: manifest-driven lifecycle metadata now\n  records legacy and replacement routes, aggregates usage without changing\n  aliases automatically, and keeps compatibility entries until their stated\n  observation window and release-cycle requirements are satisfied.\n- **Canonical session authority**: host leases, transcript witnesses,\n  anti-rollback anchors, compare-and-swap persistence, bounded cleanup, and\n  descendant retirement harden concurrent resume and long-running session\n  behavior across the covered CLI, background, and remote-host paths.\n- **Fixed MCP package execution**: approved JavaScript launchers are resolved\n  to exact npm versions and complete transitive closures, then bundled into a\n  guarded, content-addressed Node capsule. Runtime execution no longer depends\n  on a live dynamic package launcher or mutable `node_modules` entrypoint.\n- **Native update recovery**: Windows and POSIX installer/OTA generations can\n  recover interrupted activation, rollback, and rescue state while preserving\n  exact lineage, owner-private locks, and Windows path/handle identity under\n  Node 22.12 device projection.\n- **Portable reliability gates**: disk/pipe failure injection, process-tree\n  cleanup, resource accounting, session stress, and platform path aliases are\n  covered by the release matrices. Real hardware, terminal, SSH, and extended\n  soak observations remain ongoing evidence rather than compatibility claims.\n- **Candidate evidence**: implementation SHA `7e7ce9182746` passed\n  [CLI CI](https://github.com/chainlesschain/chainlesschain/actions/runs/31181229942),\n  [CLI Strict Sandbox](https://github.com/chainlesschain/chainlesschain/actions/runs/31181328955),\n  [CLI Background Interaction E2E](https://github.com/chainlesschain/chainlesschain/actions/runs/31181258842),\n  and [CLI Session Host Consistency](https://github.com/chainlesschain/chainlesschain/actions/runs/31181258424)\n  on Ubuntu, Windows, and macOS. Final SHA `23bd2e6e5758` also passed the\n  exact-SHA release gates, but the\n  [dedicated npm release](https://github.com/chainlesschain/chainlesschain/actions/runs/31187599603)\n  stopped before package creation because its Agent SDK fixture placed the\n  security anchor inside the redirected CLI home."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.162.198",
@@ -10,7 +36,7 @@
       "sections": [
         {
           "heading": "Fixed — cc CLI 0.162.198: interactive streaming and release portability",
-          "body": "> `chainlesschain` **0.162.197 → 0.162.198** (release candidate, 2026-08-06).\n> CLI-only release metadata; `@chainlesschain/personal-data-hub` remains\n> **0.4.57** and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Interactive output backpressure**: REPL, headless streaming, provider\n  pacing, and TTY writers now wait for saturated output streams to drain and\n  clean up pending listeners across completion, interruption, and session\n  transitions instead of allowing unbounded interactive writes.\n- **Canonical session controls**: the CLI-owned session projection and bounded\n  reply routes now support the completed VS Code and JetBrains workbench and\n  rewind journeys while preserving CLI authority over persisted mutations.\n- **Portable release gates**: Windows path-alias fixtures, state-path mocks,\n  Skill metadata fixtures, POSIX executable-bit setup, and the deprecated\n  agent-core shim are aligned with the three-platform CLI CI and Strict\n  Sandbox contracts.\n- **Release readback hardening**: public npm verification remains independent\n  of undeclared runtime dependencies, retries bounded registry propagation,\n  and binds provenance and registry bytes to the immutable publish artifact.\n- **Candidate evidence**: merged implementation SHA `0b7a5471e7a9` passed\n  [CLI CI](https://github.com/chainlesschain/chainlesschain/actions/runs/31071519048)\n  and [CLI Strict Sandbox](https://github.com/chainlesschain/chainlesschain/actions/runs/31071522429)\n  on Ubuntu, Windows, and macOS. The final `0.162.198` version commit must pass\n  both gates again on its own exact SHA before tag `v-npm-0-162-198` is\n  created; local, older-SHA, and partial results remain supplementary only."
+          "body": "> `chainlesschain` **0.162.197 → 0.162.198** (published, 2026-08-06).\n> CLI-only release metadata; `@chainlesschain/personal-data-hub` remains\n> **0.4.57** and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Interactive output backpressure**: REPL, headless streaming, provider\n  pacing, and TTY writers now wait for saturated output streams to drain and\n  clean up pending listeners across completion, interruption, and session\n  transitions instead of allowing unbounded interactive writes.\n- **Canonical session controls**: the CLI-owned session projection and bounded\n  reply routes now support the completed VS Code and JetBrains workbench and\n  rewind journeys while preserving CLI authority over persisted mutations.\n- **Portable release gates**: Windows path-alias fixtures, state-path mocks,\n  Skill metadata fixtures, POSIX executable-bit setup, and the deprecated\n  agent-core shim are aligned with the three-platform CLI CI and Strict\n  Sandbox contracts.\n- **Release readback hardening**: public npm verification remains independent\n  of undeclared runtime dependencies, retries bounded registry propagation,\n  and binds provenance and registry bytes to the immutable publish artifact.\n- **Exact release evidence**: tag `v-npm-0-162-198` points to final release SHA\n  [`3c0f62fa17242cfa3123ab502a9bf5d1cbed8481`](https://github.com/chainlesschain/chainlesschain/commit/3c0f62fa17242cfa3123ab502a9bf5d1cbed8481).\n  The same SHA passed [CLI CI](https://github.com/chainlesschain/chainlesschain/actions/runs/31078499968)\n  and [CLI Strict Sandbox](https://github.com/chainlesschain/chainlesschain/actions/runs/31078499270)\n  on Ubuntu, Windows, and macOS. The\n  [dedicated npm release](https://github.com/chainlesschain/chainlesschain/actions/runs/31081337370)\n  completed the exact-SHA gate, immutable tarball, CycloneDX SBOM, Trusted\n  Publishing, signed provenance, registry readback, and npmmirror sync; the\n  [independent public readback](https://github.com/chainlesschain/chainlesschain/actions/runs/31082366544)\n  re-downloaded the package and matched registry bytes and publishing identity."
         }
       ]
     },

package/src/gateways/ws/session-protocol.js

@@ -6,6 +6,7 @@ import {
 } from "../../runtime/runtime-events.js";
 import { createSessionRecord } from "../../runtime/contracts/session-record.js";
 import { loadSideEffectLedger } from "../../lib/side-effect-ledger-store.js";
+import { acquireSessionHostLease } from "../../lib/session-host-lease.js";
 import { reconcileSideEffects } from "../../lib/side-effect-ledger.js";
 import {
   formatMcpLedgerRecoveryNotice,
@@ -532,11 +533,20 @@ async function ensureSessionHandler(server, ws, session) {
     });
   } else {
     const { WSAgentHandler } = await import("./ws-agent-handler.js");
-    handler = new WSAgentHandler({
-      session,
-      interaction: session.interaction,
-      db: server.sessionManager.db,
+    const sessionHostLease = acquireSessionHostLease(session.id, {
+      hostKind: "ws",
     });
+    try {
+      handler = new WSAgentHandler({
+        session,
+        interaction: session.interaction,
+        db: server.sessionManager.db,
+        sessionHostLease,
+      });
+    } catch (error) {
+      sessionHostLease.release();
+      throw error;
+    }
   }
 
   server.sessionHandlers.set(session.id, handler);

package/src/gateways/ws/ws-agent-handler.js

@@ -79,6 +79,7 @@ export class WSAgentHandler {
     approvalGate,
     agentLoop: runAgentLoop,
     canonicalSessionStore,
+    sessionHostLease = null,
   }) {
     this.session = session;
     this.interaction = interaction;
@@ -86,6 +87,25 @@ export class WSAgentHandler {
     this._processing = false;
     this._abortController = null;
     this._activeRequestId = null;
+    this._sessionHostLease = sessionHostLease;
+    this._onSessionHostLeaseAbort = null;
+    if (sessionHostLease?.signal) {
+      this._onSessionHostLeaseAbort = () => {
+        const reason =
+          sessionHostLease.signal.reason ||
+          createAbortError("Session host lease was lost");
+        if (this._abortController && !this._abortController.signal.aborted) {
+          this._abortController.abort(reason);
+        }
+        this.interaction?.rejectAllPending?.(reason);
+      };
+      sessionHostLease.signal.addEventListener(
+        "abort",
+        this._onSessionHostLeaseAbort,
+        { once: true },
+      );
+      if (sessionHostLease.signal.aborted) this._onSessionHostLeaseAbort();
+    }
     // P0-2: monotonic sequence for crash-safe side-effect ledger op ids. The
     // session id + a per-op nonce keep ids unique across turns and processes.
     this._sideEffectSeq = 0;
@@ -486,6 +506,7 @@ export class WSAgentHandler {
 
     try {
       const { session } = this;
+      this._sessionHostLease?.assert?.();
 
       if (session.canonicalJsonlSession === true) {
         canonicalTurn = this._claimCanonicalTurn(userMessage, requestId);
@@ -648,6 +669,7 @@ export class WSAgentHandler {
                     })
                     .start(opId);
                   persistSideEffectLedger(session.id, sideEffectLedger);
+                  this._sessionHostLease?.assert?.();
                 }
               }
               break;
@@ -884,6 +906,15 @@ export class WSAgentHandler {
         reason: "session_closed",
       });
     }
+    if (this._sessionHostLease?.signal && this._onSessionHostLeaseAbort) {
+      this._sessionHostLease.signal.removeEventListener(
+        "abort",
+        this._onSessionHostLeaseAbort,
+      );
+    }
+    this._onSessionHostLeaseAbort = null;
+    this._sessionHostLease?.release?.();
+    this._sessionHostLease = null;
   }
 
   /**