chainlesschain 0.163.0 → 0.163.2

package/src/harness/prompt-compressor.js

@@ -13,6 +13,7 @@ import { createHash } from "node:crypto";
 import { feature, featureVariant } from "../lib/feature-flags.js";
 import {
   DURABLE_SYSTEM_MESSAGE_KINDS,
+  getDurableSystemMessageProvenance,
   markDurableSystemMessage,
 } from "../lib/session-message-provenance.js";
 import {
@@ -34,6 +35,14 @@ export const SUMMARY_INPUT_DEFAULT_MAX_CHARS = 24000;
 export const SUMMARY_INPUT_HARD_MAX_CHARS = 32000;
 const SUMMARY_INPUT_MIN_CHARS = 1024;
 
+function isCompactionArtifact(message) {
+  const kind = getDurableSystemMessageProvenance(message)?.kind;
+  return (
+    kind === DURABLE_SYSTEM_MESSAGE_KINDS.COMPACT_SUMMARY ||
+    kind === DURABLE_SYSTEM_MESSAGE_KINDS.COMPACT_TOOL_COLLAPSE
+  );
+}
+
 function boundedPositiveInteger(value, fallback, minimum, maximum) {
   const number = Math.floor(Number(value));
   if (!Number.isFinite(number) || number <= 0) return fallback;
@@ -508,9 +517,13 @@ export class PromptCompressor {
   }
 
   _truncate(messages) {
-    const system = messages.filter((m) => m.role === "system");
+    const system = messages.filter(
+      (m) => m.role === "system" && !isCompactionArtifact(m),
+    );
     const last = [...messages].reverse().find((m) => m.role === "user");
-    const rest = messages.filter((m) => m.role !== "system" && m !== last);
+    const rest = messages.filter(
+      (m) => (m.role !== "system" || isCompactionArtifact(m)) && m !== last,
+    );
 
     let slots = this.maxMessages - system.length;
     if (last) slots -= 1;
@@ -522,10 +535,15 @@ export class PromptCompressor {
   }
 
   async _summarize(messages) {
-    const system = messages.filter((m) => m.role === "system");
+    // Compaction summaries and collapsed tool groups are derived history, not
+    // immutable host instructions. Fold them into the next summary so a long
+    // session cannot retain one additional durable system message per cycle.
+    const system = messages.filter(
+      (m) => m.role === "system" && !isCompactionArtifact(m),
+    );
     const last = [...messages].reverse().find((m) => m.role === "user");
     const toSummarize = messages.filter(
-      (m) => m.role !== "system" && m !== last,
+      (m) => (m.role !== "system" || isCompactionArtifact(m)) && m !== last,
     );
 
     if (toSummarize.length < 3) {

package/src/lib/cowork-mcp-tools.js

@@ -138,6 +138,7 @@ export async function mountTemplateMcpTools(template, opts = {}) {
           serverName: server.name,
           command: server.command,
           args: [...server.args],
+          runtimeKind: server.runtimeKind || null,
           cwd: server.cwd || null,
           envKeys: Object.keys(server.env || {}).sort(),
         })) === true;

package/src/lib/cowork-task-templates.js

@@ -682,6 +682,7 @@ export function getTemplatesForUI() {
               name: s.name,
               command: s.command,
               args: Array.isArray(s.args) ? s.args : [],
+              ...(s.runtimeKind ? { runtimeKind: s.runtimeKind } : {}),
             })),
           }
         : {}),

package/src/lib/mcp-stdio-executable-identity.js

@@ -41,6 +41,10 @@ export const MCP_STDIO_EXECUTABLE_AUTHORITY_REPLAYED_CODE =
   "CC_MCP_STDIO_EXECUTABLE_AUTHORITY_REPLAYED";
 export const MCP_STDIO_EXECUTABLE_IDENTITY_ROLLBACK_CODE =
   "CC_MCP_STDIO_EXECUTABLE_IDENTITY_ROLLBACK";
+export const MCP_STDIO_RUNTIME_KIND_REQUIRED_CODE =
+  "CC_MCP_STDIO_RUNTIME_KIND_REQUIRED";
+export const MCP_STDIO_RUNTIME_KIND_INVALID_CODE =
+  "CC_MCP_STDIO_RUNTIME_KIND_INVALID";
 export const MCP_STDIO_CAPSULE_SANDBOX_CONTRACT_KIND =
   "strict-mcp-node-capsule";
 export const MCP_STDIO_CAPSULE_CODE_SNAPSHOT_BOUNDARY = "code-snapshot";
@@ -54,6 +58,17 @@ const HASH_CHUNK_BYTES = 1024 * 1024;
 const issuedLaunchAuthorities = new WeakMap();
 const issuedCapsuleSandboxContracts = new WeakMap();
 
+export const MCP_STDIO_RUNTIME_KINDS = Object.freeze([
+  "native",
+  "node",
+  "python",
+  "posix-shell",
+  "powershell",
+  "java",
+  "dotnet",
+]);
+const MCP_STDIO_RUNTIME_KIND_SET = new Set(MCP_STDIO_RUNTIME_KINDS);
+
 const DYNAMIC_LAUNCHERS = new Set([
   "bunx",
   "corepack",
@@ -391,6 +406,46 @@ function executableBasename(value) {
     .toLowerCase();
 }
 
+function inferredRuntimeKind(commandPath) {
+  const name = executableBasename(commandPath);
+  if (["node", "nodejs"].includes(name)) return "node";
+  if (/^python(?:w)?(?:\d+(?:\.\d+)*)?$/.test(name)) return "python";
+  if (["bash", "dash", "ksh", "sh", "zsh"].includes(name)) {
+    return "posix-shell";
+  }
+  if (["powershell", "pwsh"].includes(name)) return "powershell";
+  if (name === "java") return "java";
+  if (name === "dotnet") return "dotnet";
+  return null;
+}
+
+export function resolveMcpStdioRuntimeKind(commandPath, requestedKind = null) {
+  const inferred = inferredRuntimeKind(commandPath);
+  if (requestedKind != null) {
+    if (
+      typeof requestedKind !== "string" ||
+      !MCP_STDIO_RUNTIME_KIND_SET.has(requestedKind)
+    ) {
+      throw identityError(
+        MCP_STDIO_RUNTIME_KIND_INVALID_CODE,
+        `MCP stdio runtimeKind must be one of: ${MCP_STDIO_RUNTIME_KINDS.join(", ")}`,
+      );
+    }
+    if (inferred && requestedKind !== inferred) {
+      throw identityError(
+        MCP_STDIO_RUNTIME_KIND_INVALID_CODE,
+        `MCP stdio runtimeKind "${requestedKind}" conflicts with recognized ${inferred} executable "${executableBasename(commandPath)}"`,
+      );
+    }
+    return requestedKind;
+  }
+  if (inferred) return inferred;
+  throw identityError(
+    MCP_STDIO_RUNTIME_KIND_REQUIRED_CODE,
+    `MCP stdio executable "${executableBasename(commandPath)}" has no recognized runtime semantics; set runtimeKind explicitly before trusting it`,
+  );
+}
+
 function materializeLaunchEnvironment(hostEnv, configEnv) {
   const launch = sanitizeMcpStdioHostEnvironment(hostEnv);
   for (const [key, value] of Object.entries(configEnv || {})) {
@@ -617,8 +672,7 @@ function localEntrypoint(value, cwd, label) {
     : path.resolve(cwd, value);
 }
 
-function interpreterEntrypoints(commandPath, args, cwd) {
-  const name = executableBasename(commandPath);
+function interpreterEntrypoints(runtimeKind, args, cwd) {
   const values = [...args];
   const entry = (index, role = "entrypoint") => [
     {
@@ -627,7 +681,7 @@ function interpreterEntrypoints(commandPath, args, cwd) {
       role,
     },
   ];
-  if (["node", "nodejs"].includes(name)) {
+  if (runtimeKind === "node") {
     for (let index = 0; index < values.length; index += 1) {
       const value = values[index];
       if (["-e", "--eval", "-p", "--print"].includes(value)) return [];
@@ -655,7 +709,7 @@ function interpreterEntrypoints(commandPath, args, cwd) {
       "MCP stdio Node launch must provide a script or inline program",
     );
   }
-  if (["python", "python3", "pythonw", "pythonw3"].includes(name)) {
+  if (runtimeKind === "python") {
     for (let index = 0; index < values.length; index += 1) {
       const value = values[index];
       if (value === "-c") return [];
@@ -673,7 +727,7 @@ function interpreterEntrypoints(commandPath, args, cwd) {
       "MCP stdio Python launch must provide a script or inline program",
     );
   }
-  if (["bash", "dash", "ksh", "sh", "zsh"].includes(name)) {
+  if (runtimeKind === "posix-shell") {
     const inline = values.findIndex((value) => value === "-c");
     if (inline >= 0) return [];
     const index = values.findIndex((value) => !value.startsWith("-"));
@@ -683,7 +737,7 @@ function interpreterEntrypoints(commandPath, args, cwd) {
       "MCP stdio shell launch must provide a script or inline command",
     );
   }
-  if (["powershell", "pwsh"].includes(name)) {
+  if (runtimeKind === "powershell") {
     const fileIndex = values.findIndex((value) => /^-file$/i.test(value));
     if (fileIndex >= 0) return entry(fileIndex + 1, "powershell-script");
     if (values.some((value) => /^-(?:command|encodedcommand)$/i.test(value))) {
@@ -694,7 +748,7 @@ function interpreterEntrypoints(commandPath, args, cwd) {
       "MCP stdio PowerShell launch must use -File or an inline command",
     );
   }
-  if (name === "java") {
+  if (runtimeKind === "java") {
     const jarIndex = values.findIndex((value) => value === "-jar");
     if (jarIndex >= 0) return entry(jarIndex + 1, "java-jar");
     throw identityError(
@@ -702,7 +756,7 @@ function interpreterEntrypoints(commandPath, args, cwd) {
       "MCP stdio Java classpath launches are not bound to one entrypoint file",
     );
   }
-  if (name === "dotnet") {
+  if (runtimeKind === "dotnet") {
     const index = values.findIndex((value) => !value.startsWith("-"));
     if (index >= 0 && /\.dll$/i.test(values[index])) {
       return entry(index, "dotnet-assembly");
@@ -844,6 +898,7 @@ export function attestMcpStdioExecutableIdentity({
   env = {},
   cwd = process.cwd(),
   platform = process.platform,
+  runtimeKind: requestedRuntimeKind = null,
 }) {
   const name = executableBasename(command);
   if (DYNAMIC_LAUNCHERS.has(name)) {
@@ -868,8 +923,12 @@ export function attestMcpStdioExecutableIdentity({
       "MCP stdio direct shebang commands do not bind the interpreter bytes; configure the interpreter and script as command + args",
     );
   }
+  const runtimeKind = resolveMcpStdioRuntimeKind(
+    commandIdentity.realPath,
+    requestedRuntimeKind,
+  );
   const launchArgs = [...args];
-  const entrypoints = interpreterEntrypoints(commandPath, launchArgs, cwd).map(
+  const entrypoints = interpreterEntrypoints(runtimeKind, launchArgs, cwd).map(
     ({ argIndex, path: entryPath, role }) => {
       const identity = attestFile(
         entryPath,
@@ -882,7 +941,8 @@ export function attestMcpStdioExecutableIdentity({
     },
   );
   const identity = Object.freeze({
-    version: 1,
+    version: 2,
+    runtimeKind,
     command: commandIdentity,
     entrypoints: Object.freeze(entrypoints),
   });
@@ -919,7 +979,8 @@ function trustMessage(serverName, attestation, status) {
 function materializedAttestation(attestation, materialization) {
   if (!materialization) return attestation;
   const identity = Object.freeze({
-    version: 2,
+    version: 3,
+    runtimeKind: attestation.identity.runtimeKind,
     command: attestation.identity.command,
     entrypoints: attestation.identity.entrypoints,
     materialization: materialization.identity,
@@ -1038,6 +1099,7 @@ export function prepareMcpStdioExecutableIdentity({
       args: effectiveArgs,
       env: config.env || {},
       cwd,
+      runtimeKind: materialization ? "node" : config.runtimeKind,
     }),
     materialization,
   );
@@ -1063,6 +1125,7 @@ export function prepareMcpStdioExecutableIdentity({
       identity: attestation.identity,
       identityDigest: attestation.identityDigest,
       materialization,
+      runtimeKind: attestation.identity.runtimeKind,
     }),
   );
   return Object.freeze({
@@ -1107,6 +1170,7 @@ export function consumeMcpStdioExecutableIdentityAuthority(
     command,
     args,
     cwd: process.cwd(),
+    runtimeKind: issued.runtimeKind,
   });
   if (issued.materialization) {
     const verified = reattestMcpStdioPackageMaterialization(

package/src/lib/mcp-stdio-execution-authority.js

@@ -155,6 +155,10 @@ function invocationSnapshot(serverName, config) {
     command,
     args: Object.freeze(args),
     env: Object.freeze(env.map((entry) => Object.freeze(entry))),
+    runtimeKind: scalar(
+      dataProperty(config, "runtimeKind", null),
+      "runtimeKind",
+    ),
     transport: scalar(dataProperty(config, "transport", null), "transport"),
     origin: scalar(dataProperty(config, "origin", null), "origin"),
     policy: scalar(dataProperty(config, "policy", null), "policy"),
@@ -225,6 +229,7 @@ function materializeSnapshot(snapshot) {
     command: snapshot.command,
     args: [...snapshot.args],
     env: Object.fromEntries(snapshot.env),
+    runtimeKind: snapshot.runtimeKind,
     transport: snapshot.transport,
     origin: snapshot.origin,
     policy: snapshot.policy,

package/src/lib/packer/index.js

@@ -46,7 +46,7 @@ export async function runPack(cliOpts, deps = {}) {
   };
 
   const projectRoot = path.resolve(cliOpts.cwd || process.cwd());
-  const targets = (cliOpts.targets || "node20-win-x64")
+  const targets = (cliOpts.targets || "node22-win-x64")
     .split(",")
     .map((s) => s.trim())
     .filter(Boolean);

package/src/lib/packer/native-prebuild-collector.js

@@ -35,7 +35,7 @@ const TARGET_MODULES = [
 /**
  * @param {object} ctx
  * @param {string} ctx.cliRoot
- * @param {string[]} ctx.targets         e.g. ["node20-win-x64"]
+ * @param {string[]} ctx.targets         e.g. ["node22-win-x64"]
  * @param {string} ctx.tempDir           build temp dir
  * @returns {{ prebuildsDir: string|null, collected: Array, missing: Array }}
  */
@@ -117,11 +117,11 @@ function collectSqlJsAssets(cliRoot, prebuildsDir) {
 }
 
 /**
- * Map "node20-win-x64" -> "win32-x64".
+ * Map "node22-win-x64" -> "win32-x64".
  * Returns null for unrecognized targets.
  */
 export function pkgTargetToPlatformKey(target) {
-  // node20-win-x64
+  // node22-win-x64
   const m = /^node\d+-([a-z]+)-([a-z0-9]+)$/.exec(target);
   if (!m) return null;
   const osMap = {

package/src/lib/packer/pack-update-checker.js

@@ -21,7 +21,7 @@
  *     }
  *   }
  *
- * `target` matches pkg's `node20-<os>-<arch>` convention.
+ * `target` matches pkg's `node22-<os>-<arch>` convention.
  */
 
 import semver from "semver";
@@ -36,7 +36,7 @@ const DEFAULT_TIMEOUT_MS = 10_000;
  * @param {object} ctx
  * @param {string} ctx.manifestUrl          absolute http(s) URL
  * @param {string} ctx.currentVersion       e.g. BAKED.packedCliVersion or VERSION
- * @param {string} [ctx.target]             e.g. "node20-win-x64"; if set, the
+ * @param {string} [ctx.target]             e.g. "node22-win-x64"; if set, the
  *                                          returned artifact matches it
  * @param {number} [ctx.timeoutMs=10000]
  * @param {typeof fetch} [ctx.fetchImpl]    injected for tests

package/src/lib/packer/pkg-config-generator.js

@@ -8,7 +8,7 @@
  *   {
  *     "scripts": ["src/**\/*.js"],
  *     "assets":  ["src/assets/web-panel/**\/*", "templates/**\/*", "prebuilds/**\/*"],
- *     "targets": ["node20-win-x64"],
+ *     "targets": ["node22-win-x64"],
  *     "outputPath": "dist"
  *   }
  *
@@ -160,15 +160,16 @@ export function generatePkgConfig(ctx) {
     ...(projectBaked || {}),
   };
 
-  // Inline the real bin's logic directly. We can't use `import('...')`
-  // because pkg's snapshot bootstrap does not register a dynamic-import
-  // callback (ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING). Static ESM
-  // imports compile fine via yao-pkg's ESM mode.
+  // Inline the real bin's logic directly. Import the phase-0 lazy dispatcher,
+  // not src/index.js: that eager compatibility module uses top-level await and
+  // cannot be loaded by pkg's CommonJS bootstrap on Node 22.
   const entryScript = path.join(pkgConfigDir, "pack-entry.js");
   const ensureUtf8Path = posixify(
     path.join(cliRoot, "src", "lib", "ensure-utf8.js"),
   );
-  const indexPath = posixify(path.join(cliRoot, "src", "index.js"));
+  const lazyDispatchPath = posixify(
+    path.join(cliRoot, "src", "lazy-dispatch.js"),
+  );
   fs.writeFileSync(
     entryScript,
     [
@@ -181,7 +182,7 @@ export function generatePkgConfig(ctx) {
       "import os from 'node:os';",
       "import path from 'node:path';",
       `import { ensureUtf8 } from '${ensureUtf8Path}';`,
-      `import { createProgram } from '${indexPath}';`,
+      `import { runCli } from '${lazyDispatchPath}';`,
       "ensureUtf8();",
       "// Build-time defaults baked by the packer. Each is overridable at",
       "// runtime either via the matching env var or by passing the flag.",
@@ -374,15 +375,15 @@ export function generatePkgConfig(ctx) {
       "// When launched from Explorer, Node exits as soon as the event loop",
       "// drains. If something throws before the UI server starts listening,",
       "// we want the user to see the error — pause on fatal errors.",
-      "process.on('uncaughtException', (err) => {",
+      "function _handleFatal(err) {",
       "  console.error('\\n[cc-pack] Fatal error:', err && err.stack || err);",
       "  if (process.stdin.isTTY) {",
       "    console.error('\\nPress any key to exit...');",
       "    try { process.stdin.setRawMode(true); process.stdin.resume(); process.stdin.once('data', () => process.exit(1)); } catch { process.exit(1); }",
       "  } else { process.exit(1); }",
-      "});",
-      "const program = createProgram();",
-      "program.parse(process.argv);",
+      "}",
+      "process.on('uncaughtException', _handleFatal);",
+      "runCli(process.argv).catch(_handleFatal);",
       "",
     ].join("\n"),
     "utf-8",

package/src/lib/packer/web-panel-builder.js

@@ -37,10 +37,13 @@ export function ensureWebPanel(ctx) {
     fs.existsSync(path.join(d, "index.html")),
   );
 
-  // Decide if a rebuild is needed
+  // A clean source checkout intentionally contains only the tracked
+  // index.html placeholder; the generated asset tree is gitignored. Treat
+  // that placeholder as missing output so native/package builds actually run
+  // build:web-panel instead of failing the asset-count guard below.
   let rebuilt = false;
-  let needsBuild = !distDir;
-  if (distDir && !skipBuild) {
+  let needsBuild = !distDir || countAssets(distDir) < 2;
+  if (!needsBuild && distDir && !skipBuild) {
     needsBuild = isDistStale(distDir);
   }