chainlesschain 0.162.198 → 0.162.200

package/src/harness/mcp-client.js

@@ -34,7 +34,10 @@ import {
   materializeApprovedMcpStdioInvocation,
   renewMcpStdioExecutionAuthority,
 } from "../lib/mcp-stdio-execution-authority.js";
-import { prepareMcpStdioExecutableIdentity } from "../lib/mcp-stdio-executable-identity.js";
+import {
+  MCP_STDIO_CAPSULE_CODE_SNAPSHOT_BOUNDARY,
+  prepareMcpStdioExecutableIdentity,
+} from "../lib/mcp-stdio-executable-identity.js";
 
 /**
  * Injectable dependencies — overridable from tests.
@@ -1856,6 +1859,10 @@ export class MCPClient extends EventEmitter {
     let pluginWorkspaceRoot = null;
     let stdioExecutableIdentity = null;
     let stdioExecutableIdentityAuthority = null;
+    let stdioExecutableEnvironment = null;
+    let stdioExecutableWorkingDirectory = null;
+    let stdioExecutableIdentityDigest = null;
+    let stdioCapsuleSandboxExecutionContract = null;
     let runtimeConfig = sourceConfig;
     if (transportKind === "stdio") {
       const isPlugin = sourceConfig.origin === "plugin:mcp";
@@ -1884,7 +1891,7 @@ export class MCPClient extends EventEmitter {
         config: sourceConfig,
         approval: stdioExecutionApproval,
         cwd: pluginWorkspaceRoot || process.cwd(),
-        env: process.env,
+        env: { ...process.env, ...this._agentIdentityEnv() },
       });
       runtimeConfig = {
         ...sourceConfig,
@@ -1893,6 +1900,11 @@ export class MCPClient extends EventEmitter {
       };
       stdioExecutableIdentity = prepared.identity;
       stdioExecutableIdentityAuthority = prepared.authority;
+      stdioExecutableEnvironment = prepared.env;
+      stdioExecutableWorkingDirectory = prepared.workingDirectory;
+      stdioExecutableIdentityDigest = prepared.identityDigest;
+      stdioCapsuleSandboxExecutionContract =
+        prepared.sandboxExecutionContract || null;
     }
     const connectionHeaders = await this._connectionHeaders(
       name,
@@ -2292,11 +2304,14 @@ export class MCPClient extends EventEmitter {
         }
         const isPlugin = config.origin === "plugin:mcp";
         const spawnOptions = {
-          cwd: pluginWorkspaceRoot || process.cwd(),
+          cwd:
+            stdioExecutableWorkingDirectory ||
+            pluginWorkspaceRoot ||
+            process.cwd(),
           stdio: ["pipe", "pipe", "pipe"],
           // process.env < agent identity (CLAUDECODE / session id) < the
           // server's own config.env, so an explicit per-server override wins.
-          env: {
+          env: stdioExecutableEnvironment || {
             ...process.env,
             ...this._agentIdentityEnv(),
             ...(config.env || {}),
@@ -2310,8 +2325,16 @@ export class MCPClient extends EventEmitter {
           // Broker's Job Object boundary so an unexpectedly exiting MCP root
           // cannot orphan grandchildren before taskkill can enumerate them.
           detached: process.platform !== "win32",
-          ...(process.platform === "win32"
-            ? { requiredBoundaries: ["process-tree"] }
+          ...(process.platform === "win32" ||
+          stdioCapsuleSandboxExecutionContract
+            ? {
+                requiredBoundaries: [
+                  ...(process.platform === "win32" ? ["process-tree"] : []),
+                  ...(stdioCapsuleSandboxExecutionContract
+                    ? [MCP_STDIO_CAPSULE_CODE_SNAPSHOT_BOUNDARY]
+                    : []),
+                ],
+              }
             : {}),
           pluginId: config.pluginId,
           pluginVersion: config.pluginVersion,
@@ -2320,19 +2343,29 @@ export class MCPClient extends EventEmitter {
             ? { sandboxPolicy: config.sandboxPolicy }
             : {}),
           mcpStdioExecutableIdentityAuthority: stdioExecutableIdentityAuthority,
+          mcpStdioExecutableIdentityDigest: stdioExecutableIdentityDigest,
         };
         const sandboxExecutionContract =
-          !isPlugin || pluginWorkspaceRoot
+          stdioCapsuleSandboxExecutionContract ||
+          (!isPlugin || pluginWorkspaceRoot
             ? executionBroker.issueLinuxWorkspaceSandboxExecutionContract(
                 config.command,
                 config.args || [],
                 { ...spawnOptions, detached: false },
-                pluginWorkspaceRoot || process.cwd(),
+                stdioExecutableWorkingDirectory ||
+                  pluginWorkspaceRoot ||
+                  process.cwd(),
               )
-            : null;
+            : null);
+        const capsuleUsesPosixProcessGroup =
+          Boolean(stdioCapsuleSandboxExecutionContract) &&
+          process.platform !== "win32";
         const launchOptions = {
           ...spawnOptions,
-          detached: sandboxExecutionContract ? false : spawnOptions.detached,
+          detached:
+            sandboxExecutionContract && !capsuleUsesPosixProcessGroup
+              ? false
+              : spawnOptions.detached,
           ...(sandboxExecutionContract ? { sandboxExecutionContract } : {}),
         };
         const proc = _deps.spawn(config.command, config.args || [], {
@@ -2341,7 +2374,7 @@ export class MCPClient extends EventEmitter {
 
         entry.process = proc;
         entry._stdioTreeMode =
-          sandboxExecutionContract ||
+          (sandboxExecutionContract && !capsuleUsesPosixProcessGroup) ||
           (process.platform === "win32" && proc?.sandboxReady?.then)
             ? "sandbox"
             : process.platform === "win32"

package/src/harness/session-index.js

@@ -21,8 +21,8 @@ import { existsSync, readdirSync, statSync } from "node:fs";
 import { join, basename } from "node:path";
 import { createRequire } from "node:module";
 import { getHomeDir } from "../lib/paths.js";
-import { iterateFileLinesSync } from "../lib/file-lines.js";
 import { ensurePrivateDirectory, ensurePrivateFile } from "../lib/secure-fs.js";
+import { readVerifiedProjection } from "./jsonl-session-store.js";
 
 const requireCjs = createRequire(import.meta.url);
 
@@ -98,84 +98,74 @@ function toIsoSafe(value) {
   return Number.isNaN(date.getTime()) ? "" : date.toISOString();
 }
 
-function summarizeSessionFile(id, filePath) {
-  let startEvent = null;
-  let lastEvent = null;
-  let renamedTitle = null;
-  let messageCount = 0;
-  let eventCount = 0;
-  let chainHash = "";
-  const parts = [];
-  let used = 0;
-  for (const { line } of iterateFileLinesSync(filePath)) {
-    let event;
-    try {
-      event = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    eventCount += 1;
-    lastEvent = event;
-    if (!startEvent && event.type === "session_start") startEvent = event;
-    if (event.type === "session_rename" && event.data?.title) {
-      renamedTitle = String(event.data.title);
-    }
-    if (event.type === "user_message" || event.type === "assistant_message") {
-      messageCount += 1;
-      if (used < CONTENT_CAP) {
-        const content = event.data?.content;
-        const text =
-          typeof content === "string"
-            ? content
-            : content == null
-              ? ""
-              : JSON.stringify(content);
-        if (text) {
-          const bounded = text.slice(0, CONTENT_CAP - used);
-          parts.push(bounded);
-          used += bounded.length;
+function summarizeVerifiedSession(id) {
+  return readVerifiedProjection(id, () => {
+    let startEvent = null;
+    let lastEvent = null;
+    let renamedTitle = null;
+    let messageCount = 0;
+    let eventCount = 0;
+    let chainHash = "";
+    const parts = [];
+    let used = 0;
+    const acceptContent = (content) => {
+      if (used >= CONTENT_CAP) return;
+      const text =
+        typeof content === "string"
+          ? content
+          : content == null
+            ? ""
+            : JSON.stringify(content);
+      if (!text) return;
+      const bounded = text.slice(0, CONTENT_CAP - used);
+      parts.push(bounded);
+      used += bounded.length;
+    };
+    return {
+      accept(event) {
+        eventCount += 1;
+        lastEvent = event;
+        if (!startEvent && event.type === "session_start") startEvent = event;
+        if (event.type === "session_rename" && event.data?.title) {
+          renamedTitle = String(event.data.title);
         }
-      }
-    } else if (
-      event.type === "ws_turn" &&
-      event.data?.schemaVersion === 1 &&
-      event.data?.outcome === "completed" &&
-      event.data?.user?.role === "user" &&
-      event.data?.assistant?.role === "assistant"
-    ) {
-      messageCount += 2;
-      for (const message of [event.data?.user, event.data?.assistant]) {
-        if (used >= CONTENT_CAP) break;
-        const content = message?.content;
-        const text =
-          typeof content === "string"
-            ? content
-            : content == null
-              ? ""
-              : JSON.stringify(content);
-        if (text) {
-          const bounded = text.slice(0, CONTENT_CAP - used);
-          parts.push(bounded);
-          used += bounded.length;
+        if (
+          event.type === "user_message" ||
+          event.type === "assistant_message"
+        ) {
+          messageCount += 1;
+          acceptContent(event.data?.content);
+        } else if (
+          event.type === "ws_turn" &&
+          event.data?.schemaVersion === 1 &&
+          event.data?.outcome === "completed" &&
+          event.data?.user?.role === "user" &&
+          event.data?.assistant?.role === "assistant"
+        ) {
+          messageCount += 2;
+          acceptContent(event.data.user.content);
+          acceptContent(event.data.assistant.content);
         }
-      }
-    }
-    if (typeof event.hash === "string") chainHash = event.hash;
-  }
-  if (!lastEvent) return null;
-  return {
-    id,
-    title: renamedTitle || startEvent?.data?.title || "Untitled",
-    provider: startEvent?.data?.provider || "",
-    model: startEvent?.data?.model || "",
-    message_count: messageCount,
-    event_count: eventCount,
-    created_at: toIsoSafe(startEvent?.timestamp),
-    updated_at: toIsoSafe(lastEvent?.timestamp),
-    last_ts: lastEvent?.timestamp || 0,
-    content: parts.join("\n").slice(0, CONTENT_CAP),
-    chain_hash: chainHash,
-  };
+        if (typeof event.hash === "string") chainHash = event.hash;
+      },
+      finish() {
+        if (!lastEvent) return null;
+        return {
+          id,
+          title: renamedTitle || startEvent?.data?.title || "Untitled",
+          provider: startEvent?.data?.provider || "",
+          model: startEvent?.data?.model || "",
+          message_count: messageCount,
+          event_count: eventCount,
+          created_at: toIsoSafe(startEvent?.timestamp),
+          updated_at: toIsoSafe(lastEvent?.timestamp),
+          last_ts: lastEvent?.timestamp || 0,
+          content: parts.join("\n").slice(0, CONTENT_CAP),
+          chain_hash: chainHash,
+        };
+      },
+    };
+  });
 }
 
 const UPSERT_SESSION = `
@@ -195,7 +185,7 @@ ON CONFLICT(id) DO UPDATE SET
 export function indexOneSession(db, id, { mtimeMs = 0, sizeBytes = 0 } = {}) {
   const filePath = join(sessionsDir(), `${id}.jsonl`);
   if (!existsSync(filePath)) return false;
-  const s = summarizeSessionFile(id, filePath);
+  const s = summarizeVerifiedSession(id);
   if (!s) return false;
   db.prepare(UPSERT_SESSION).run({
     id: s.id,
@@ -228,6 +218,7 @@ export function syncIndex(db, { force = false } = {}) {
   let scanned = 0;
   let updated = 0;
   let removed = 0;
+  let rejected = 0;
   const seen = new Set();
 
   if (existsSync(dir)) {
@@ -251,7 +242,16 @@ export function syncIndex(db, { force = false } = {}) {
         ) {
           continue; // unchanged
         }
-        if (indexOneSession(db, id, { mtimeMs, sizeBytes: size })) updated++;
+        try {
+          if (indexOneSession(db, id, { mtimeMs, sizeBytes: size })) updated++;
+        } catch {
+          // The index is disposable. A damaged canonical source invalidates any
+          // older cached content immediately and is reported without exposing
+          // transcript text or local paths.
+          db.prepare("DELETE FROM sessions WHERE id=?").run(id);
+          db.prepare("DELETE FROM session_content WHERE id=?").run(id);
+          rejected++;
+        }
       }
     });
     const entries = [];
@@ -278,7 +278,7 @@ export function syncIndex(db, { force = false } = {}) {
   }
 
   const total = db.prepare("SELECT COUNT(*) c FROM sessions").get().c;
-  return { scanned, updated, removed, total };
+  return { scanned, updated, removed, rejected, total };
 }
 
 const LIST_COLUMNS =

package/src/harness/session-list-index.js

@@ -21,6 +21,11 @@ import { ensurePrivateFile } from "../lib/secure-fs.js";
 export const SESSION_INDEX_SCHEMA = 2;
 export const SESSION_INDEX_FILE = ".sessions-index-v2.ndjson";
 export const SESSION_TOMBSTONE_MARKER_SUFFIX = ".tombstone";
+export const SESSION_TOMBSTONE_MARKER_SCHEMA =
+  "chainlesschain.session-tombstone/v1";
+export const SESSION_GENERATION_AUTHORITY_FIELD = "_sessionGeneration";
+export const SESSION_GENERATION_AUTHORITY_SCHEMA =
+  "chainlesschain.session-generation-authority/v1";
 
 // Used only by an opted-in child in the independent session-scale crash gate.
 // Keeping the injection immediately around the production sidecar/journal
@@ -59,10 +64,67 @@ export function emptySessionMeta(sessionId) {
     created_at_ms: 0,
     updated_at_ms: 0,
     last_hash: null,
+    transcript: null,
+    generation: null,
+    deleted_at_ms: null,
     deleted: false,
   };
 }
 
+export function normalizeSessionGenerationAuthority(value) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    value.schema !== SESSION_GENERATION_AUTHORITY_SCHEMA ||
+    typeof value.sessionId !== "string" ||
+    value.sessionId.length === 0 ||
+    typeof value.generationId !== "string" ||
+    !/^generation-[0-9a-f-]{32,36}$/.test(value.generationId) ||
+    !Number.isSafeInteger(value.ordinal) ||
+    value.ordinal < 1
+  ) {
+    return null;
+  }
+  let predecessor = null;
+  if (value.predecessor !== null) {
+    const previous = value.predecessor;
+    if (
+      !previous ||
+      typeof previous !== "object" ||
+      Array.isArray(previous) ||
+      !["tombstone", "legacy-tombstone"].includes(previous.kind) ||
+      (previous.generationId !== null &&
+        (typeof previous.generationId !== "string" ||
+          !/^generation-[0-9a-f-]{32,36}$/.test(previous.generationId))) ||
+      (previous.headHash !== null &&
+        (typeof previous.headHash !== "string" ||
+          !/^[0-9a-f]{64}$/.test(previous.headHash))) ||
+      !Number.isSafeInteger(previous.eventCount) ||
+      previous.eventCount < 0 ||
+      (previous.tombstonedAtMs !== null &&
+        (!Number.isSafeInteger(previous.tombstonedAtMs) ||
+          previous.tombstonedAtMs < 0))
+    ) {
+      return null;
+    }
+    predecessor = {
+      kind: previous.kind,
+      generationId: previous.generationId,
+      headHash: previous.headHash,
+      eventCount: previous.eventCount,
+      tombstonedAtMs: previous.tombstonedAtMs,
+    };
+  }
+  return {
+    schema: SESSION_GENERATION_AUTHORITY_SCHEMA,
+    sessionId: value.sessionId,
+    generationId: value.generationId,
+    ordinal: value.ordinal,
+    predecessor,
+  };
+}
+
 export function readSessionMeta(dir, sessionId) {
   const filePath = sessionMetaPath(dir, sessionId);
   if (!existsSync(filePath)) return null;
@@ -108,6 +170,11 @@ export function applyEventToSessionMeta(meta, event, lastHash) {
   ) {
     next.message_count = Math.max(0, Number(next.message_count) || 0) + 2;
   }
+  const generation = normalizeSessionGenerationAuthority(
+    event?.data?.[SESSION_GENERATION_AUTHORITY_FIELD],
+  );
+  if (generation?.sessionId === next.id) next.generation = generation;
+  next.deleted_at_ms = null;
   next.last_hash = typeof lastHash === "string" ? lastHash : null;
   return next;
 }
@@ -123,7 +190,26 @@ function writeMetaSnapshot(dir, meta) {
   // commits, so crashes can cause an extra candidate read but never hide a
   // successfully committed tombstone.
   if (meta.deleted === true) {
-    writeFileSync(tombstoneMarker, "", { encoding: "utf8", mode: 0o600 });
+    const generation = normalizeSessionGenerationAuthority(meta.generation);
+    const marker = {
+      schema: SESSION_TOMBSTONE_MARKER_SCHEMA,
+      id: meta.id,
+      generation: generation?.sessionId === meta.id ? generation : null,
+      last_hash:
+        typeof meta.last_hash === "string" &&
+        /^[0-9a-f]{64}$/.test(meta.last_hash)
+          ? meta.last_hash
+          : null,
+      event_count: Math.max(0, Number(meta.event_count) || 0),
+      deleted_at_ms: Math.max(
+        0,
+        Number(meta.deleted_at_ms || meta.updated_at_ms) || 0,
+      ),
+    };
+    writeFileSync(tombstoneMarker, `${JSON.stringify(marker)}\n`, {
+      encoding: "utf8",
+      mode: 0o600,
+    });
     ensurePrivateFile(tombstoneMarker);
   }
   // The owning transcript lock serializes this derived snapshot. It need not
@@ -137,6 +223,39 @@ function writeMetaSnapshot(dir, meta) {
   if (meta.deleted !== true) rmSync(tombstoneMarker, { force: true });
 }
 
+/**
+ * Read the durable namespace marker. Legacy empty/invalid markers still count
+ * as deletion evidence, but deliberately expose no predecessor authority.
+ */
+export function readSessionTombstoneMarker(dir, sessionId) {
+  const filePath = sessionTombstoneMarkerPath(dir, sessionId);
+  if (!existsSync(filePath)) return null;
+  try {
+    const value = JSON.parse(readFileSync(filePath, "utf8"));
+    if (
+      value?.schema !== SESSION_TOMBSTONE_MARKER_SCHEMA ||
+      value?.id !== sessionId
+    ) {
+      return { id: sessionId, legacy: true };
+    }
+    const generation = normalizeSessionGenerationAuthority(value.generation);
+    return {
+      schema: SESSION_TOMBSTONE_MARKER_SCHEMA,
+      id: sessionId,
+      generation: generation?.sessionId === sessionId ? generation : null,
+      last_hash:
+        typeof value.last_hash === "string" &&
+        /^[0-9a-f]{64}$/.test(value.last_hash)
+          ? value.last_hash
+          : null,
+      event_count: Math.max(0, Number(value.event_count) || 0),
+      deleted_at_ms: Math.max(0, Number(value.deleted_at_ms) || 0),
+    };
+  } catch {
+    return { id: sessionId, legacy: true };
+  }
+}
+
 function appendActivity(dir, meta) {
   const filePath = sessionIndexPath(dir);
   // One compact line is emitted through one O_APPEND write. The journal is a
@@ -159,7 +278,7 @@ export function recordSessionEvent(
   sessionId,
   event,
   lastHash,
-  { resetGeneration = false } = {},
+  { resetGeneration = false, transcriptState = null } = {},
 ) {
   const existing = readSessionMeta(dir, sessionId);
   // Only the transcript writer may authorize a new generation after checking
@@ -170,6 +289,30 @@ export function recordSessionEvent(
     : existing || emptySessionMeta(sessionId);
   current.id = sessionId;
   const next = applyEventToSessionMeta(current, event, lastHash);
+  next.transcript = transcriptState
+    ? {
+        dev: String(transcriptState.dev),
+        ino: String(transcriptState.ino),
+        size: Number(transcriptState.size),
+        mtimeMs: Number(transcriptState.mtimeMs),
+        ctimeMs: Number(transcriptState.ctimeMs),
+        ...(transcriptState.devExact != null
+          ? { devExact: String(transcriptState.devExact) }
+          : {}),
+        ...(transcriptState.inoExact != null
+          ? { inoExact: String(transcriptState.inoExact) }
+          : {}),
+        ...(transcriptState.sizeExact != null
+          ? { sizeExact: String(transcriptState.sizeExact) }
+          : {}),
+        ...(transcriptState.mtimeNs != null
+          ? { mtimeNs: String(transcriptState.mtimeNs) }
+          : {}),
+        ...(transcriptState.ctimeNs != null
+          ? { ctimeNs: String(transcriptState.ctimeNs) }
+          : {}),
+      }
+    : null;
   writeMetaSnapshot(dir, next);
   runSessionScaleFaultHook("afterMetaSnapshot", {
     dir,
@@ -201,7 +344,9 @@ export function recordSessionDeleted(dir, sessionId, timestamp = Date.now()) {
   const tombstone = {
     ...current,
     updated_at_ms: timestamp,
+    deleted_at_ms: timestamp,
     deleted: true,
+    transcript: null,
   };
   writeMetaSnapshot(dir, tombstone);
   appendActivity(dir, tombstone);

package/src/lib/background-interaction-journal.js

@@ -9,7 +9,7 @@
 
 import { createHash } from "node:crypto";
 import {
-  appendEvent as storeAppendEvent,
+  appendAuthorityEvent as storeAppendAuthorityEvent,
   readEvents as storeReadEvents,
   findLatestEvent as storeFindLatestEvent,
 } from "../harness/jsonl-session-store.js";
@@ -26,7 +26,7 @@ export const MAX_BACKGROUND_INTERACTION_RECORDS = 256;
 const TERMINAL_STATUSES = new Set(["resolved", "rejected", "cancelled"]);
 
 export const _deps = {
-  appendEvent: storeAppendEvent,
+  appendEvent: storeAppendAuthorityEvent,
   readEvents: storeReadEvents,
   findLatestEvent: storeFindLatestEvent,
 };