chainlesschain 0.163.1 → 0.163.3

package/src/commands/mcp.js

@@ -5,6 +5,7 @@
 
 import fs from "fs";
 import path from "path";
+import { isProxy } from "node:util/types";
 import chalk from "chalk";
 import ora from "ora";
 import { logger } from "../lib/logger.js";
@@ -45,8 +46,19 @@ import {
   issueMcpStdioExecutionAuthority,
   materializeApprovedMcpStdioInvocation,
   resolveMcpStdioExecutionApproval,
+  verifyMcpStdioApprovedWorkingDirectory,
 } from "../lib/mcp-stdio-execution-authority.js";
-import { prepareMcpStdioExecutableIdentity } from "../lib/mcp-stdio-executable-identity.js";
+import {
+  MCP_STDIO_RUNTIME_KINDS,
+  prepareMcpStdioExecutableIdentity,
+} from "../lib/mcp-stdio-executable-identity.js";
+import { resolveMcpStdioSandboxContext } from "../lib/mcp-stdio-workspace-authority.js";
+import {
+  MCP_SANDBOX_BOUNDARIES,
+  MCP_SANDBOX_POLICY_INVALID_CODE,
+  normalizeMcpSandboxPolicy,
+  readMcpStdioCwd,
+} from "../lib/mcp-sandbox-policy.js";
 import {
   materializeMcpStdioNpmPackage,
   parseExactNpmPackageSpec,
@@ -113,6 +125,7 @@ export function authorizeMcpRowForConnect(row, overrides = {}) {
     config,
     approvalKind,
     approvalSource: `${row?.configScope || "user"}:${row?.configSource || "database"}:${row.name}`,
+    workspaceRoot: projectMcpLocation(process.cwd()).root,
   });
   return config;
 }
@@ -121,6 +134,25 @@ function commandWorkspaceBinding() {
   return registerHostHooksV2Workspace(projectMcpLocation(process.cwd()).root);
 }
 
+export function resolveMcpCommandStdioWorkingDirectory(
+  serverName,
+  config,
+  approval,
+  workspaceBinding = commandWorkspaceBinding(),
+) {
+  const context = resolveMcpStdioSandboxContext({
+    serverName,
+    config,
+    workspaceBinding,
+  });
+  if (context.sandboxPolicy && config.cwd) {
+    verifyMcpStdioApprovedWorkingDirectory(approval, context.workingDirectory);
+  }
+  return (
+    context.workingDirectory || context.pluginWorkspaceRoot || process.cwd()
+  );
+}
+
 function getClient() {
   if (!mcpClient) {
     mcpClient = new MCPClient({ workspaceBinding: commandWorkspaceBinding() });
@@ -284,31 +316,95 @@ function headersHelperField(value) {
     : {};
 }
 
-async function readManagedMcpRows() {
-  const { loadManagedSettings } = await import("../lib/settings-loader.cjs");
-  const loaded = loadManagedSettings({ env: process.env });
-  const block =
-    loaded.settings?.managedMcpServers || loaded.settings?.mcpServers || {};
+function invalidMcpSandboxPolicy(message) {
+  const error = new TypeError(message);
+  error.code = MCP_SANDBOX_POLICY_INVALID_CODE;
+  return error;
+}
+
+function readMcpSandboxPolicy(owner, label) {
+  if (!owner || typeof owner !== "object" || isProxy(owner)) {
+    throw invalidMcpSandboxPolicy(`${label} must be a non-Proxy object`);
+  }
+  const descriptor = Object.getOwnPropertyDescriptor(owner, "sandboxPolicy");
+  if (!descriptor) return { present: false, policy: null };
+  if (!("value" in descriptor)) {
+    throw invalidMcpSandboxPolicy(
+      `${label}.sandboxPolicy must be an own data property`,
+    );
+  }
+  return {
+    present: true,
+    policy: normalizeMcpSandboxPolicy(descriptor.value, {
+      label: `${label}.sandboxPolicy`,
+    }),
+  };
+}
+
+function collectMcpSandboxBoundary(value, previous = []) {
+  return [...previous, value];
+}
+
+export function mcpSandboxPolicyUpdateFromAddOptions(options = {}) {
+  const boundaries = options.sandboxBoundary;
+  if (boundaries !== undefined && !Array.isArray(boundaries)) {
+    throw invalidMcpSandboxPolicy(
+      "--sandbox-boundary must be supplied as a repeatable option",
+    );
+  }
+  if (options.clearSandboxBoundaries && boundaries?.length > 0) {
+    throw invalidMcpSandboxPolicy(
+      "--clear-sandbox-boundaries cannot be combined with --sandbox-boundary",
+    );
+  }
+  if (options.clearSandboxBoundaries) return null;
+  if (!boundaries || boundaries.length === 0) return undefined;
+  return normalizeMcpSandboxPolicy(
+    { requiredBoundaries: boundaries },
+    { label: "--sandbox-boundary" },
+  );
+}
+
+export function managedMcpRowsFromSettings(settings, file) {
+  const block = settings?.managedMcpServers || settings?.mcpServers || {};
   if (!block || typeof block !== "object" || Array.isArray(block)) return [];
   return Object.entries(block)
     .filter(([, config]) => config && typeof config === "object")
-    .map(([name, config]) => ({
-      name,
-      command: config.command || null,
-      args: Array.isArray(config.args) ? config.args : [],
-      env: config.env && typeof config.env === "object" ? config.env : {},
-      url: config.url || null,
-      transport: inferTransport(config),
-      headers:
-        config.headers && typeof config.headers === "object"
-          ? config.headers
-          : {},
-      ...headersHelperField(config.headersHelper),
-      autoConnect: config.autoConnect !== false,
-      configScope: "managed",
-      configSource: loaded.file,
-      projectPath: null,
-    }));
+    .map(([name, config]) => {
+      const { policy: sandboxPolicy } = readMcpSandboxPolicy(
+        config,
+        `Managed MCP server "${name}"`,
+      );
+      const { cwd } = readMcpStdioCwd(config, {
+        label: `Managed MCP server "${name}"`,
+      });
+      return {
+        name,
+        command: config.command || null,
+        args: Array.isArray(config.args) ? config.args : [],
+        env: config.env && typeof config.env === "object" ? config.env : {},
+        runtimeKind: config.runtimeKind || null,
+        ...(cwd ? { cwd } : {}),
+        ...(sandboxPolicy ? { sandboxPolicy } : {}),
+        url: config.url || null,
+        transport: inferTransport(config),
+        headers:
+          config.headers && typeof config.headers === "object"
+            ? config.headers
+            : {},
+        ...headersHelperField(config.headersHelper),
+        autoConnect: config.autoConnect !== false,
+        configScope: "managed",
+        configSource: file,
+        projectPath: null,
+      };
+    });
+}
+
+async function readManagedMcpRows() {
+  const { loadManagedSettings } = await import("../lib/settings-loader.cjs");
+  const loaded = loadManagedSettings({ env: process.env });
+  return managedMcpRowsFromSettings(loaded.settings, loaded.file);
 }
 
 function projectMcpLocation(cwd = process.cwd()) {
@@ -361,11 +457,21 @@ export function readProjectMcpRows(cwd = process.cwd()) {
   return Object.entries(document.mcpServers)
     .filter(([, config]) => config && typeof config === "object")
     .map(([name, config]) => {
+      const { policy: sandboxPolicy } = readMcpSandboxPolicy(
+        config,
+        `Project MCP server "${name}"`,
+      );
+      const { cwd } = readMcpStdioCwd(config, {
+        label: `Project MCP server "${name}"`,
+      });
       const row = {
         name,
         command: config.command || null,
         args: Array.isArray(config.args) ? config.args : [],
         env: config.env && typeof config.env === "object" ? config.env : {},
+        runtimeKind: config.runtimeKind || null,
+        ...(cwd ? { cwd } : {}),
+        ...(sandboxPolicy ? { sandboxPolicy } : {}),
         url: config.url || null,
         transport: inferTransport(config),
         headers:
@@ -379,7 +485,7 @@ export function readProjectMcpRows(cwd = process.cwd()) {
         projectPath: root,
       };
       Object.defineProperty(row, PROJECT_MCP_FILE_TRUST, { value: trusted });
-      if (trusted && row.headersHelper) {
+      if (trusted && (row.headersHelper || inferTransport(row) === "stdio")) {
         row.projectMcpWorkspaceAuthority = issueProjectMcpWorkspaceAuthority({
           file,
           content,
@@ -409,10 +515,44 @@ function writeProjectMcpDocument(file, document) {
 
 export function writeProjectMcpServer(name, server, cwd = process.cwd()) {
   const { file, document } = readProjectMcpDocument(cwd);
+  if (!server || typeof server !== "object" || isProxy(server)) {
+    throw invalidMcpSandboxPolicy(
+      `Project MCP server "${name}" must be a non-Proxy object`,
+    );
+  }
+  const existing = document.mcpServers[name];
+  const requestedPolicy = readMcpSandboxPolicy(
+    server,
+    `Project MCP server "${name}" update`,
+  );
+  const retainedPolicy = requestedPolicy.present
+    ? requestedPolicy
+    : existing && typeof existing === "object" && !Array.isArray(existing)
+      ? readMcpSandboxPolicy(existing, `Existing project MCP server "${name}"`)
+      : { present: false, policy: null };
+  const requestedCwd = readMcpStdioCwd(server, {
+    label: `Project MCP server "${name}" update`,
+  });
+  const existingCwd =
+    existing && typeof existing === "object" && !Array.isArray(existing)
+      ? readMcpStdioCwd(existing, {
+          label: `Existing project MCP server "${name}"`,
+        })
+      : { present: false, cwd: null };
+  const retainedCwd = requestedCwd.present
+    ? requestedCwd.cwd
+    : existingCwd.present
+      ? existingCwd.cwd
+      : null;
   const config = {};
   if (server.command) config.command = server.command;
   if (server.args?.length) config.args = server.args;
   if (server.env && Object.keys(server.env).length > 0) config.env = server.env;
+  if (server.runtimeKind) config.runtimeKind = server.runtimeKind;
+  if (typeof retainedCwd === "string" && retainedCwd.length > 0) {
+    config.cwd = retainedCwd;
+  }
+  if (retainedPolicy.policy) config.sandboxPolicy = retainedPolicy.policy;
   if (server.url) config.url = server.url;
   if (server.transport) config.transport = server.transport;
   if (server.headers && Object.keys(server.headers).length > 0) {
@@ -866,6 +1006,11 @@ export function registerMcpCommand(program) {
           { serverName: name, config: authorized },
         );
         const invocation = materializeApprovedMcpStdioInvocation(approval);
+        const approvedCwd = resolveMcpCommandStdioWorkingDirectory(
+          name,
+          invocation,
+          approval,
+        );
         const approvalRecord = resolveMcpStdioExecutionApproval(approval);
         const materialized = materializeMcpStdioNpmPackage({
           approvalRecord,
@@ -886,7 +1031,7 @@ export function registerMcpCommand(program) {
           serverName: name,
           config: invocation,
           approval,
-          cwd: process.cwd(),
+          cwd: approvedCwd,
           env: process.env,
           retrust: true,
         });
@@ -967,11 +1112,16 @@ export function registerMcpCommand(program) {
           { serverName: name, config: authorized },
         );
         const invocation = materializeApprovedMcpStdioInvocation(approval);
+        const approvedCwd = resolveMcpCommandStdioWorkingDirectory(
+          name,
+          invocation,
+          approval,
+        );
         const prepared = prepareMcpStdioExecutableIdentity({
           serverName: name,
           config: invocation,
           approval,
-          cwd: process.cwd(),
+          cwd: approvedCwd,
           env: process.env,
           retrust: true,
         });
@@ -1012,6 +1162,19 @@ export function registerMcpCommand(program) {
     .argument("<name>", "Server name")
     .option("-c, --command <cmd>", "Server command to run (stdio transport)")
     .option("-a, --args <args>", "Command arguments (comma-separated)")
+    .option(
+      "--runtime-kind <kind>",
+      "stdio runtime semantics: native | node | python | posix-shell | powershell | java | dotnet",
+    )
+    .option(
+      "--sandbox-boundary <boundary>",
+      `Require a stdio sandbox boundary (${MCP_SANDBOX_BOUNDARIES.join(" | ")}); repeatable`,
+      collectMcpSandboxBoundary,
+    )
+    .option(
+      "--clear-sandbox-boundaries",
+      "Explicitly remove previously configured stdio sandbox boundaries",
+    )
     .option(
       "-u, --url <url>",
       "Server URL (http / https / ws / wss transports)",
@@ -1051,6 +1214,24 @@ export function registerMcpCommand(program) {
           logger.error("Use either -c <command> or -u <url>, not both.");
           process.exit(1);
         }
+        if (options.runtimeKind && !options.command) {
+          throw new Error("--runtime-kind is only supported with --command");
+        }
+        if (
+          options.runtimeKind &&
+          !MCP_STDIO_RUNTIME_KINDS.includes(options.runtimeKind)
+        ) {
+          throw new Error(
+            `Invalid --runtime-kind; expected one of: ${MCP_STDIO_RUNTIME_KINDS.join(", ")}`,
+          );
+        }
+        const sandboxPolicyUpdate =
+          mcpSandboxPolicyUpdateFromAddOptions(options);
+        if (sandboxPolicyUpdate !== undefined && !options.command) {
+          throw new Error(
+            "--sandbox-boundary and --clear-sandbox-boundaries are only supported with --command",
+          );
+        }
 
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         if (!ctx.db) {
@@ -1137,13 +1318,28 @@ export function registerMcpCommand(program) {
         }
 
         const workspaceRoot = projectMcpLocation(process.cwd()).root;
-        const previousLocal =
-          configScope === "local"
-            ? config.get(name, { scope: "local", cwd: workspaceRoot })
-            : null;
+        const previousStored =
+          configScope === "project"
+            ? null
+            : config.get(name, {
+                scope: configScope,
+                cwd: workspaceRoot,
+              });
+        const previousLocal = configScope === "local" ? previousStored : null;
+        const effectiveSandboxPolicy =
+          sandboxPolicyUpdate === undefined
+            ? previousStored?.sandboxPolicy || null
+            : sandboxPolicyUpdate;
+        let configuredSandboxPolicy = effectiveSandboxPolicy;
         const storedConfig = {
           command: options.command || null,
           args,
+          runtimeKind: options.command ? options.runtimeKind || null : null,
+          ...(sandboxPolicyUpdate !== undefined
+            ? { sandboxPolicy: sandboxPolicyUpdate }
+            : effectiveSandboxPolicy
+              ? { sandboxPolicy: effectiveSandboxPolicy }
+              : {}),
           url: options.url || null,
           transport,
           env: {},
@@ -1160,6 +1356,9 @@ export function registerMcpCommand(program) {
             storedConfig,
             process.cwd(),
           );
+          configuredSandboxPolicy =
+            readProjectMcpRows(process.cwd()).find((row) => row.name === name)
+              ?.sandboxPolicy || null;
         } else {
           if (configScope === "local" && previousLocal?.headersHelper) {
             revokeLocalMcpHeadersHelperTrust({
@@ -1190,6 +1389,12 @@ export function registerMcpCommand(program) {
           name,
           command: options.command || null,
           args,
+          runtimeKind: storedConfig.runtimeKind,
+          ...(configuredSandboxPolicy
+            ? { sandboxPolicy: configuredSandboxPolicy }
+            : sandboxPolicyUpdate === null
+              ? { sandboxPolicy: null }
+              : {}),
           url: options.url || null,
           transport,
           autoConnect: !!options.autoConnect,
@@ -1212,6 +1417,16 @@ export function registerMcpCommand(program) {
             logger.log(
               `  ${chalk.gray("Command:")} ${options.command} ${args.join(" ")}`,
             );
+            if (storedConfig.runtimeKind) {
+              logger.log(
+                `  ${chalk.gray("Runtime kind:")} ${storedConfig.runtimeKind}`,
+              );
+            }
+            if (configuredSandboxPolicy) {
+              logger.log(
+                `  ${chalk.gray("Sandbox boundaries:")} ${configuredSandboxPolicy.requiredBoundaries.join(", ")}`,
+              );
+            }
           }
           if (configScope === "project") {
             logger.log(

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.163.3",
+      "cliVersions": ["0.163.2", "0.163.3"],
+      "date": "2026-08-10",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.163.3: isolated background agents and policy-bound runtimes",
+          "body": "> `chainlesschain` **0.163.2 → 0.163.3** (candidate; not yet published,\n> 2026-08-10).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Git background isolation by default**: `cc agent --bg` runs started from a\n  clean Git checkout and not using `--input-format stream-json` now create a\n  worktree at committed `HEAD`; `--worktree` requests the same path and only\n  `--no-worktree` opts into the shared checkout. Foreground runs, runs using\n  `--input-format stream-json`, and non-Git runs retain their prior behavior,\n  while a dirty Git source is rejected instead of silently omitting uncommitted\n  changes.\n- **Generation- and token-fenced ownership**: locked atomic state, immutable\n  worktree/profile identity, worker-generation claims, terminal-absorbing\n  updates, durable turn intents, and stop/cleanup fences prevent stale\n  cooperative workers from reviving or deleting live work. Versioned,\n  secret-free launch profiles preserve compatible resume settings.\n- **Grammar-safe detached arguments**: new background launches preserve option\n  values and `--` literals, pass prompts as one `--print=<text>` token,\n  canonicalize resume/continue/fork to one session, and remap repository\n  `--add-dir` roots into the worktree. Canonical external roots remain shared\n  and produce a warning.\n- **Policy-bearing stdio MCP sources**: explicit `--mcp-config`, managed and\n  registered local/project/user sources, trusted project configuration, Skill,\n  and Cowork definitions propagate normalized `filesystem`/`network`\n  requirements plus separately validated working-directory/workspace authority\n  to the Process Broker. Unprovable requirements fail closed, and invalid named\n  higher-precedence entries do not fall through to a weaker source.\n- **Sealed Linux plugin file sets**: strict direct Plugin Node and supported\n  narrow native ELF launches snapshot every pinned regular plugin file into\n  sealed anonymous data-bind mounts. Dynamic native evidence covers only\n  `PT_INTERP` and direct `DT_NEEDED`; tree attestation remains per-file rather\n  than one atomic filesystem snapshot.\n- **Contained Windows adapter artifacts**: helper, cache, and test artifacts use\n  an attested non-reparse local temporary root, identity/content rechecks,\n  randomized materialization, and bounded retirement. Unknown or unverifiable\n  leftovers are preserved and make cleanup fail closed.\n- **Fail-closed CI routing**: the generic selector routes the defined Windows\n  helper-support paths to their CLI contract tests, supports multi-suite\n  execution, and cannot turn selected-test or primary-run failure into a\n  fallback/diagnostic pass. Full-suite workflows provision their required\n  dependencies explicitly; this routing does not replace the exact-SHA release\n  matrices.\n- **Known residuals**: non-Git, `--input-format stream-json`, `--no-worktree`,\n  and external `add-dir` roots are not worktree-isolated. Spawn-to-PID\n  hard-crash recovery and long-soak closure remain open; Linux native\n  dependency evidence is non-transitive and has no `dlopen` closure; Windows\n  path operations are\n  re-attested but not handle-atomic. macOS atomic runtime execution, arbitrary\n  shared-library closure, remote revocation, signed native distribution, and\n  alias telemetry/removal remain out of scope, so this release does not claim\n  complete P1-2 closure.\n- **Release status**: final tag, exact source SHA, workflow run IDs, package\n  digest, provenance, and public registry readback are intentionally omitted\n  until the exact `0.163.3` release commit passes the required Linux, Windows,\n  and macOS `CLI CI` and `CLI Strict Sandbox` gates and the npm release/readback\n  workflows complete successfully."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.163.2",
+      "cliVersions": ["0.163.1", "0.163.2"],
+      "date": "2026-08-09",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed — cc CLI 0.163.2: fail-closed MCP capsule sandbox composition",
+          "body": "> `chainlesschain` **0.163.1 → 0.163.2** (published from exact SHA\n> `2d6f19aea243ed4f054b585d4bc709d4209ff80d`, 2026-08-09). CLI-only release;\n> `@chainlesschain/personal-data-hub` remains **0.4.57** and\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Explicit MCP runtime identity**: stdio MCP configuration now supports\n  `--runtime-kind` for `native`, `node`, `python`, `posix-shell`, `powershell`,\n  `java`, and `dotnet`. Recognized runtimes cannot be relabeled, while renamed\n  or custom runtime executables must declare their semantics before trust is\n  granted. The declaration persists through local, project, managed, Skill, and\n  Cowork configuration sources.\n- **Descriptor-bound Linux MCP capsules**: fixed npm/Node MCP servers now keep\n  the verified Node runtime and entry source bound through launch. The direct\n  inherited-FD path and the `bwrap` filesystem/network/process-tree path both\n  validate the exact runtime, entry, and passthrough arguments; ambiguous\n  separators, path traversal, mixed evidence families, and pathname replacement\n  fail closed.\n- **One-launch Windows MCP authority**: restricted-token and AppContainer plans\n  are issued only by the production adapter and admitted only by the built-in\n  Broker. The private capability binds the original contract, helper payload,\n  environment, stdio handles, and post-spawn closure; validation and post-spawn\n  authority are delete-before-use, cleanup revokes abandoned plans, and replay\n  or injected-adapter plans are rejected before native spawn.\n- **Honest macOS boundary**: public Darwin exec/spawn APIs cannot atomically bind\n  the verified runtime descriptor to the launched image, so strict MCP capsule\n  startup now returns a typed fail-closed result instead of claiming a\n  pathname-based code snapshot. A root-owned/signed broker or equivalent atomic\n  exec design remains a separate roadmap requirement.\n- **Malicious-host evidence v4**: repeated Linux descriptor-bound\n  pathname-replacement probes, explicit macOS fail-closed evidence, and the\n  separately enforced Windows strict gate now use distinct evidence contracts.\n  Formal soak workflows bind their inputs and aggregate artifacts to an exact\n  source SHA.\n- **Accurate native release status**: the unsigned six-target native build/run\n  validation is no longer reported as missing. Native publication remains\n  fail-closed pending Linux signing, Windows Authenticode, macOS\n  signing/notarization, signed install/upgrade/rollback validation,\n  package-manager publication, and public artifact readback.\n- **Scope remains narrow**: this patch does not claim arbitrary native/shared\n  library closure, remote distributed revocation, permissioned or unrestricted\n  Node-builtin modes, the complete malicious Skill matrix, or signed native\n  distribution. All 25 deprecated command aliases remain retained; the\n  `0.164.0` removal floor and representative opt-in telemetry are still unmet.\n- **Published release evidence**: immutable tag `v-npm-0-163-2` resolves to\n  exact source commit `2d6f19aea243ed4f054b585d4bc709d4209ff80d`.\n  Its Linux, Windows, and macOS `CLI CI` and `CLI Strict Sandbox` matrices,\n  formal two-hour reliability/malicious MCP soak, and dedicated npm release all\n  succeeded. The release workflow completed its exact-SHA gate, immutable\n  tarball/CycloneDX SBOM, Trusted Publishing, SLSA provenance, registry\n  readback, and npmmirror synchronization; the independent public readback\n  proved the registry tarball byte-identical to the workflow artifact. The\n  public tarball SHA-256 is\n  `394a755d52fca98e7527228859a78e1c57eae69abfdcaf77cc56e9b665b13fe1`."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.163.1",
@@ -10,7 +36,7 @@
       "sections": [
         {
           "heading": "Fixed — cc CLI 0.163.1: bounded long sessions and reliability gates",
-          "body": "> `chainlesschain` **0.163.0 → 0.163.1** (release candidate,\n> 2026-08-08). CLI-only release metadata;\n> `@chainlesschain/personal-data-hub` remains **0.4.57** and\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Bounded long-session compaction**: prior durable conversation summaries and\n  compacted tool records are folded into the next summary instead of remaining\n  as permanently accumulated system messages. A 2,000-turn regression keeps\n  compaction state bounded while preserving checkpoint and other trusted host\n  provenance.\n- **Race-safe live session tails**: transcript deletion or restoration between\n  the path check and asynchronous `stat`/`open` is reclassified through the\n  durable session witness. Followers now fail closed with the governed deleted\n  or unverified-transcript error instead of leaking a platform-dependent raw\n  `ENOENT`.\n- **Atomic Windows MCP runtime launch**: the strict sandbox holds verified\n  runtime and entry identities through suspended process image creation, then\n  re-attests before resume. A real pathname-replacement race fails closed\n  before untrusted entry code executes.\n- **Real cross-platform reliability probes**: the formal matrix now includes\n  persisted EROFS/ENOSPC sessions, bounded pipe consumers, native TTY\n  screen-reader mode with multilingual keyboard input, Windows/macOS Unicode\n  clipboard round trips, localhost SSH disconnects, oversized MCP output,\n  concurrent agents, and two-hour resource accounting. Disk mounts are retired\n  from their actual `sessions` targets during cleanup.\n- **Deterministic two-hour workload**: the required 1,000 duplex turns are\n  paced across the complete soak window instead of becoming a platform-speed\n  stress loop with millions of extra turns. The RSS/FD/handle thresholds remain\n  unchanged, and the screen-reader probe waits for the real REPL prompt before\n  injecting multilingual keyboard input.\n- **Native release credentials fail closed**: the six-target native workflow\n  refuses to build a release until Linux signing, Windows Authenticode, macOS\n  signing/notarization, and updater keys are all configured. This npm release\n  does not claim the separate native distribution chain is complete.\n- **Release status**: exact source commit `a29eb4203d` passed the complete Linux,\n  Windows, and macOS `CLI CI` and `CLI Strict Sandbox` matrices. The dedicated\n  release workflow then ran in dry-run mode, with the exact-SHA, artifact, and\n  publish jobs skipped; neither `v-npm-0-163-1` nor registry version `0.163.1`\n  exists. The two-hour reliability matrix is recorded separately as product\n  evidence and cannot be replaced by local smoke tests."
+          "body": "> `chainlesschain` **0.163.0 → 0.163.1** (published from exact SHA\n> `e3f56b11e27ae1bd5d19ad8638434843c244aa68`, 2026-08-08). CLI-only release;\n> `@chainlesschain/personal-data-hub` remains **0.4.57** and\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Bounded long-session compaction**: prior durable conversation summaries and\n  compacted tool records are folded into the next summary instead of remaining\n  as permanently accumulated system messages. A 2,000-turn regression keeps\n  compaction state bounded while preserving checkpoint and other trusted host\n  provenance.\n- **Race-safe live session tails**: transcript deletion or restoration between\n  the path check and asynchronous `stat`/`open` is reclassified through the\n  durable session witness. Followers now fail closed with the governed deleted\n  or unverified-transcript error instead of leaking a platform-dependent raw\n  `ENOENT`.\n- **Atomic Windows MCP runtime launch**: the strict sandbox holds verified\n  runtime and entry identities through suspended process image creation, then\n  re-attests before resume. A real pathname-replacement race fails closed\n  before untrusted entry code executes.\n- **Real cross-platform reliability probes**: the formal matrix now includes\n  persisted EROFS/ENOSPC sessions, bounded pipe consumers, native TTY\n  screen-reader mode with multilingual keyboard input, Windows/macOS Unicode\n  clipboard round trips, localhost SSH disconnects, oversized MCP output,\n  concurrent agents, and two-hour resource accounting. Disk mounts are retired\n  from their actual `sessions` targets during cleanup.\n- **Deterministic two-hour workload**: the required 1,000 duplex turns are\n  paced across the complete soak window instead of becoming a platform-speed\n  stress loop with millions of extra turns. The RSS/FD/handle thresholds remain\n  unchanged, and the screen-reader probe waits for the real REPL prompt before\n  injecting multilingual keyboard input.\n- **Native release credentials fail closed**: the six-target native workflow\n  refuses to build a release until Linux signing, Windows Authenticode, macOS\n  signing/notarization, and updater keys are all configured. This npm release\n  does not claim the separate native distribution chain is complete.\n- **Reproducible embedded Web Panel**: the CLI pack path now builds from a clean,\n  lockfile-driven Web Panel dependency graph, pins the Vite/Rollup/Intlify runtime\n  chain, bounds Rollup file concurrency, and keeps Node 22 standalone bases\n  deterministic across Linux, Windows, macOS, x64, and ARM64 validation hosts.\n- **Release status**: immutable tag `v-npm-0-163-1` resolves to exact source\n  commit `e3f56b11e27ae1bd5d19ad8638434843c244aa68`. That SHA passed the complete\n  Linux, Windows, and macOS `CLI CI` and `CLI Strict Sandbox` matrices, the\n  unsigned six-target native validation, and the three-OS two-hour reliability\n  gate. The dedicated npm release completed its exact-SHA gate, immutable\n  tarball/CycloneDX SBOM, Trusted Publishing, SLSA provenance, registry readback,\n  and npmmirror synchronization. The public registry tarball is byte-identical\n  to the workflow artifact (SHA-256\n  `d9e09e25c6086e0777e97a670105649e3a7e5fb1c2816e1834557da32157cbee`)."
         }
       ]
     },
@@ -23,7 +49,7 @@
       "sections": [
         {
           "heading": "Fixed — cc CLI 0.163.0: macOS PTY launch and native host validation",
-          "body": "> `chainlesschain` **0.162.200 → 0.163.0** (release candidate,\n> 2026-08-08). CLI-only release metadata;\n> `@chainlesschain/personal-data-hub` remains **0.4.57** and\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **macOS PTY installation repair**: `node-pty@1.1.0` publishes its macOS\n  `spawn-helper` prebuilds without executable bits, which made fresh ARM64 and\n  Intel installs fail with `posix_spawnp failed`. The CLI postinstall now\n  repairs and verifies that narrowly resolved regular file, rejects symlinked\n  helpers, and the reliability workflow fails early if the executable bit is\n  missing before running a real PTY scenario.\n- **Real native target hosts**: the standalone native release matrix now maps\n  Linux, Windows, and macOS x64/ARM64 targets to six matching GitHub-hosted\n  runners and requires each artifact to execute on its own architecture. The\n  previous cross-target smoke-test skip is removed. This improves native\n  evidence readiness but does not claim signing, notarization, or public native\n  distribution is complete.\n- **Second command-observation cycle starts**: `0.163.0` begins the second minor\n  release cycle for lifecycle telemetry. All 25 deprecated compatibility\n  aliases remain retained because representative opt-in collector coverage,\n  per-command sample floors, and the `0.164.0` removal floor are not yet met.\n- **Pre-release evidence**: implementation SHA `38cd849ed16f` passed\n  [CLI Strict Sandbox](https://github.com/chainlesschain/chainlesschain/actions/runs/31202334570)\n  on Ubuntu, Windows, and macOS. This final version commit must independently\n  pass exact-SHA `CLI CI` and `CLI Strict Sandbox` before publication."
+          "body": "> `chainlesschain` **0.162.200 → 0.163.0** (published from exact SHA\n> `aed0a3ae5327917ce0490a5decbddd777f66f33b`, 2026-08-08). CLI-only release;\n> `@chainlesschain/personal-data-hub` remains **0.4.57** and\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **macOS PTY installation repair**: `node-pty@1.1.0` publishes its macOS\n  `spawn-helper` prebuilds without executable bits, which made fresh ARM64 and\n  Intel installs fail with `posix_spawnp failed`. The CLI postinstall now\n  repairs and verifies that narrowly resolved regular file, rejects symlinked\n  helpers, and the reliability workflow fails early if the executable bit is\n  missing before running a real PTY scenario.\n- **Real native target hosts**: the standalone native release matrix now maps\n  Linux, Windows, and macOS x64/ARM64 targets to six matching GitHub-hosted\n  runners and requires each artifact to execute on its own architecture. The\n  previous cross-target smoke-test skip is removed. This improves native\n  evidence readiness but does not claim signing, notarization, or public native\n  distribution is complete.\n- **Second command-observation cycle starts**: `0.163.0` begins the second minor\n  release cycle for lifecycle telemetry. All 25 deprecated compatibility\n  aliases remain retained because representative opt-in collector coverage,\n  per-command sample floors, and the `0.164.0` removal floor are not yet met.\n- **Release evidence**: tag `v-npm-0-163-0` resolves to exact SHA\n  `aed0a3ae5327917ce0490a5decbddd777f66f33b`. Its\n  [CLI CI](https://github.com/chainlesschain/chainlesschain/actions/runs/31205224902),\n  [CLI Strict Sandbox](https://github.com/chainlesschain/chainlesschain/actions/runs/31205231874),\n  and [dedicated npm release](https://github.com/chainlesschain/chainlesschain/actions/runs/31209345410)\n  completed the three-OS matrices, immutable tarball/SBOM, provenance, registry\n  readback, and npmmirror synchronization before `0.163.1` superseded it."
         }
       ]
     },