chainlesschain 0.163.6 → 0.163.8

package/src/commands/agent.js

@@ -24,6 +24,7 @@ import {
 import { appendSecurityAuditEvent } from "../lib/security-audit.js";
 import {
   agentPrintArgument,
+  BACKGROUND_EPHEMERAL_UNSUPPORTED_CODE,
   canonicalizeBackgroundSessionArgv,
   captureCommandArgvGrammar,
   transformBackgroundLaunchArgv,
@@ -175,6 +176,52 @@ function readStdin() {
   });
 }
 
+/** Normalize the three opt-in causal-report scope flags without losing empties. */
+export function resolveAgentObservabilityScope(options = {}) {
+  const fields = [
+    ["observabilityWorkspace", "workspaceId", "--observability-workspace"],
+    ["observabilityTeam", "teamId", "--observability-team"],
+    ["observabilityPolicy", "policyId", "--observability-policy"],
+  ];
+  const providedFields = fields.filter(
+    ([optionName]) => options[optionName] !== undefined,
+  );
+  if (providedFields.length > 0 && options.forkSession === true) {
+    throw new Error(
+      "observability scope flags cannot be combined with --fork-session; a fork inherits the source session's immutable observability scope",
+    );
+  }
+  let provided = false;
+  const scope = {};
+  for (const [optionName, scopeName, flag] of fields) {
+    const value = options[optionName];
+    if (value === undefined) {
+      scope[scopeName] = null;
+      continue;
+    }
+    provided = true;
+    if (typeof value !== "string") {
+      throw new TypeError(`${flag} requires a non-empty string id`);
+    }
+    const normalized = value.trim();
+    const hasControlCharacter = [...normalized].some((character) => {
+      const code = character.codePointAt(0);
+      return code <= 0x1f || code === 0x7f;
+    });
+    if (!normalized || normalized.length > 256 || hasControlCharacter) {
+      throw new TypeError(`${flag} requires a valid non-empty id`);
+    }
+    scope[scopeName] = normalized;
+  }
+  if (!provided) return undefined;
+  if (options.ephemeral === true) {
+    throw new Error(
+      "observability scope requires durable session persistence and cannot be combined with --ephemeral",
+    );
+  }
+  return scope;
+}
+
 export function registerAgentCommand(program) {
   program
     .command("agent")
@@ -496,6 +543,18 @@ export function registerAgentCommand(program) {
       "--max-budget-usd <amount>",
       "Hard USD spend cap: stop the run before the next paid LLM call once the estimated cost reaches this (headless; uses the cc cost price table)",
     )
+    .option(
+      "--observability-workspace <id>",
+      "Persist a workspace scope on new session authority for causal reports",
+    )
+    .option(
+      "--observability-team <id>",
+      "Persist a team scope on new session authority for causal reports",
+    )
+    .option(
+      "--observability-policy <id>",
+      "Persist a policy scope on new session authority for causal reports",
+    )
     .option(
       "--strict-mcp-config",
       "Use ONLY --mcp-config servers; ignore registered (cc mcp add) and IDE-bridge MCP for a reproducible tool surface",
@@ -520,6 +579,19 @@ export function registerAgentCommand(program) {
       false,
     )
     .action(async (task, options, command) => {
+      // Scope is immutable session authority. Resolve every scope/fork
+      // conflict before worktree creation, session forking, bootstrap, or any
+      // other externally visible setup performed by this action.
+      let observabilityScope;
+      try {
+        observabilityScope = resolveAgentObservabilityScope(options);
+      } catch (error) {
+        process.stderr.write(`${error.message}\n`);
+        process.exitCode = 1;
+        return;
+      }
+      const hasObservabilityScope = observabilityScope !== undefined;
+
       // --capabilities: print the machine-readable manifest and exit — no
       // config, no bootstrap, no network (gap-analysis 2026-07-11 快速收益 #6).
       if (options.capabilities) {
@@ -625,6 +697,15 @@ export function registerAgentCommand(program) {
       }
       const backgroundRequested =
         options.background === true || options.bg === true;
+      if (backgroundRequested && options.ephemeral === true) {
+        const error = new Error(
+          "--bg cannot be combined with --ephemeral because background sessions require durable session and interaction authority",
+        );
+        error.code = BACKGROUND_EPHEMERAL_UNSUPPORTED_CODE;
+        process.stderr.write(`${error.message}\n`);
+        process.exitCode = 1;
+        return;
+      }
       const invocationCwd = process.cwd();
       let worktreeDecision = {
         enabled: false,
@@ -1182,7 +1263,6 @@ export function registerAgentCommand(program) {
         const { mergePricing } = await import("../lib/llm-pricing.js");
         priceTable = mergePricing(loadConfig().llm?.pricing);
       }
-
       // 鈹€鈹€ Streaming-input mode (--input-format stream-json) 鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€
       // A persistent multi-turn conversation driven by NDJSON user events on
       // stdin; output is always NDJSON. Routed before single-prompt handling
@@ -1248,6 +1328,9 @@ export function registerAgentCommand(program) {
             maxCostUsd,
             priceTable,
             chatFn: fallbackChatFn,
+            observabilityScope: hasObservabilityScope
+              ? observabilityScope
+              : undefined,
             // --json-schema: structured output for stream-INPUT mode. The schema
             // is resolved + meta-validated up front, its output contract injected
             // into the system prompt, and a per-turn `structured_result` event is
@@ -1544,6 +1627,9 @@ export function registerAgentCommand(program) {
           // --max-budget-usd: hard spend cap (+ price table from config llm.pricing)
           maxCostUsd,
           priceTable,
+          observabilityScope: hasObservabilityScope
+            ? observabilityScope
+            : undefined,
           // --fallback-model: retry once on a backup model on transient errors
           chatFn: fallbackChatFn,
         };
@@ -1701,6 +1787,9 @@ export function registerAgentCommand(program) {
         // --channels: inbound channel listeners (webhook/telegram) whose
         // events become user turns in this session.
         channels: options.channels || null,
+        observabilityScope: hasObservabilityScope
+          ? observabilityScope
+          : undefined,
       });
       await runtime.startAgentSession();
       // Interactive session ended (REPL closed) — settle the worktree.

package/src/commands/automation.js

@@ -12,6 +12,14 @@ import {
   buildAutomationCenterProjection,
   runAutomationCenterAction,
 } from "../lib/automation-center.js";
+import {
+  automationCenterIncidentActionErrorEnvelope,
+  runAutomationCenterIncidentAction,
+} from "../lib/automation-center-incidents.js";
+import {
+  automationCenterRuntimeActionErrorEnvelope,
+  runAutomationCenterRuntimeAction,
+} from "../lib/automation-center-runtime.js";
 import {
   createAutomationCenterRoutine,
   editAutomationCenterRoutine,
@@ -22,6 +30,7 @@ import { parseJsonOption } from "../lib/parse-json-option.js";
 import { AutomationSchedulerBridge } from "../lib/scheduler-kernel/automation-adapter.js";
 import { AutomationEventDispatcher } from "../lib/scheduler-kernel/automation-event-adapter.js";
 import { openSchedulerStore } from "../lib/scheduler-kernel/store.js";
+import { resolveAutomationCenterRuntimeControl } from "../lib/scheduler-kernel/runtime-control-capabilities.js";
 import {
   RoutineSchedulerBridge,
   routineBridgeRunId,
@@ -288,7 +297,8 @@ export function registerAutomationCommand(program) {
         if (
           actionCommand &&
           (actionCommand.name().endsWith("-v2") ||
-            actionCommand.name().startsWith("center-routine-"))
+            actionCommand.name().startsWith("center-routine-") ||
+            actionCommand.name() === "center-runtime-action")
         )
           return;
         const db = await _prepare(thisCommand);
@@ -446,9 +456,13 @@ function _wire(root) {
     .option("--json", "Output as JSON")
     .action(async (opts, cmd) => {
       const db = _dbFromCtx(cmd);
+      let schedulerStore;
       try {
+        schedulerStore = openSchedulerStore();
         const projection = buildAutomationCenterProjection(db, {
           limit: Number(opts.limit),
+          schedulerStore,
+          runtimeCapabilityForKind: resolveAutomationCenterRuntimeControl,
         });
         if (opts.json) console.log(JSON.stringify(projection, null, 2));
         else {
@@ -465,6 +479,94 @@ function _wire(root) {
         logger.error(e.message);
         process.exitCode = 1;
       } finally {
+        schedulerStore?.close();
+        await shutdown();
+      }
+    });
+
+  root
+    .command("center-runtime-action <occurrenceId> <pause|resume>")
+    .description("Pause or resume one exact fenced scheduler occurrence")
+    .requiredOption(
+      "--expected-fence <fence>",
+      "Exact scheduler fence shown by center-projection",
+    )
+    .requiredOption(
+      "--expected-control-revision <revision>",
+      "Exact runtime-control revision shown by center-projection",
+    )
+    .option("--json", "Output as JSON")
+    .action(async (occurrenceId, action, opts) => {
+      let schedulerStore;
+      try {
+        schedulerStore = openSchedulerStore();
+        const result = runAutomationCenterRuntimeAction(schedulerStore, {
+          capabilityForKind: resolveAutomationCenterRuntimeControl,
+          occurrenceId,
+          action,
+          expectedFence: Number(opts.expectedFence),
+          expectedControlRevision: Number(opts.expectedControlRevision),
+        });
+        if (opts.json) console.log(JSON.stringify(result, null, 2));
+        else logger.success(`${occurrenceId} ${action} completed`);
+      } catch (error) {
+        if (opts.json) {
+          console.log(
+            JSON.stringify(
+              automationCenterRuntimeActionErrorEnvelope(error, {
+                occurrenceId,
+                action,
+              }),
+              null,
+              2,
+            ),
+          );
+        } else logger.error(error.message);
+        process.exitCode = 1;
+      } finally {
+        schedulerStore?.close();
+        await shutdown();
+      }
+    });
+
+  root
+    .command("center-incident-action <incidentId> <retry|cancel>")
+    .description("Retry or cancel a revision-gated Automation Center incident")
+    .requiredOption(
+      "--expected-revision <revision>",
+      "Exact incident revision shown by center-projection",
+    )
+    .option("--json", "Output as JSON")
+    .action(async (incidentId, action, opts, cmd) => {
+      const db = _dbFromCtx(cmd);
+      let schedulerStore;
+      try {
+        // Cancellation is incident-local. Retry alone needs the scheduler's
+        // dead-letter evidence and owns this short-lived handle.
+        if (action === "retry") schedulerStore = openSchedulerStore();
+        const result = runAutomationCenterIncidentAction(db, schedulerStore, {
+          incidentId,
+          action,
+          expectedRevision: opts.expectedRevision,
+        });
+        if (opts.json) console.log(JSON.stringify(result, null, 2));
+        else logger.success(`${incidentId} ${action} completed`);
+      } catch (error) {
+        if (opts.json) {
+          console.log(
+            JSON.stringify(
+              automationCenterIncidentActionErrorEnvelope(error, {
+                incidentId,
+                action,
+              }),
+              null,
+              2,
+            ),
+          );
+        } else logger.error(error.message);
+        process.exitCode = 1;
+      } finally {
+        schedulerStore?.close();
         await shutdown();
       }
     });

package/src/commands/chat.js

@@ -4,8 +4,16 @@
  */
 
 import { createAgentRuntimeFactory } from "../runtime/runtime-factory.js";
+import { assertChatSessionUsageAdmission } from "../lib/chat-session-admission.js";
 
-export function registerChatCommand(program) {
+export { assertChatSessionUsageAdmission } from "../lib/chat-session-admission.js";
+
+export function registerChatCommand(program, dependencies = {}) {
+  const createRuntimeFactory =
+    dependencies.createAgentRuntimeFactory || createAgentRuntimeFactory;
+  const assertUsageAdmission =
+    dependencies.assertChatSessionUsageAdmission ||
+    assertChatSessionUsageAdmission;
   program
     .command("chat")
     .description("Start an interactive AI chat session")
@@ -22,7 +30,8 @@ export function registerChatCommand(program) {
     )
     .option("--session <id>", "Resume a previous session (agent mode)")
     .action(async (options) => {
-      const factory = createAgentRuntimeFactory();
+      if (!options.agent) assertUsageAdmission(options.session);
+      const factory = createRuntimeFactory();
       const runtimeOptions = {
         model: options.model,
         provider: options.provider,

package/src/commands/compact.js

@@ -5,7 +5,7 @@
  *
  *   cc compact <session-id>              compact and persist (writes a `compact`
  *                                        checkpoint event the resume path honors)
- *   cc compact <session-id> --dry-run    preview the reduction, write nothing
+ *   cc compact <session-id> --dry-run    offline preview; no provider call/write
  *
  * Engine: PromptCompressor with a bounded structured semantic handoff using the
  * session's recorded provider. `--offline` explicitly selects deterministic
@@ -23,14 +23,17 @@ import chalk from "chalk";
 import { logger } from "../lib/logger.js";
 import {
   appendAuthorityEventIfHead,
+  appendEventIfHead,
   readVerifiedProjection,
   sessionExists,
 } from "../harness/jsonl-session-store.js";
 import { PromptCompressor } from "../harness/prompt-compressor.js";
+import { compactConversationWithProvider } from "../harness/provider-backed-compaction.js";
+import { runMeteredDirectModelCall } from "../lib/direct-model-usage.js";
 import { chatWithTools } from "../runtime/agent-core.js";
 
 /** Build a compressor sized to the session (or explicit overrides). */
-function buildCompressor(options, recorded) {
+function buildCompressor(options, recorded, llmQuery) {
   const maxTokens = options.maxTokens ? Number(options.maxTokens) : undefined;
   const maxMessages = options.maxMessages
     ? Number(options.maxMessages)
@@ -40,7 +43,7 @@ function buildCompressor(options, recorded) {
     return new PromptCompressor({
       maxTokens,
       maxMessages,
-      llmQuery: buildSemanticQuery(options, recorded),
+      llmQuery,
     });
   }
   const model = options.model || recorded.model || undefined;
@@ -49,32 +52,89 @@ function buildCompressor(options, recorded) {
   return new PromptCompressor({
     model,
     provider,
-    llmQuery: buildSemanticQuery(options, { model, provider }),
+    llmQuery,
   });
 }
 
-function buildSemanticQuery(options, recorded) {
+function attachMeteringMetadata(value, { callId, settled }) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return;
+  try {
+    Object.defineProperties(value, {
+      compactionCallId: {
+        configurable: true,
+        value: callId || undefined,
+      },
+      usageLedgerSettled: {
+        configurable: true,
+        value: settled === true,
+      },
+    });
+  } catch {
+    // A frozen provider error still propagates. The durable started row remains
+    // authoritative if its unknown settlement could not be attached here.
+  }
+}
+
+function buildSemanticQuery(options, recorded, sessionId, ledger) {
   const provider = options.provider || recorded.provider || undefined;
   const model = options.model || recorded.model || undefined;
-  if (options.offline || !provider) return null;
+  // A preview must be both write-free and spend-free. It uses the same
+  // deterministic compressor thresholds, but never installs an LLM callback.
+  if (options.offline || options.dryRun || !provider) return null;
   const baseUrl =
     options.baseUrl ||
     (provider === "ollama" ? "http://localhost:11434" : undefined);
   return async (prompt) => {
-    const response = await chatWithTools([{ role: "user", content: prompt }], {
-      provider,
-      model,
-      baseUrl,
-      enabledToolNames: [],
-      extraToolDefinitions: [],
-      maxOutputTokens: 2048,
-    });
-    return {
-      summary: response?.message?.content || "",
-      usage: response?.usage || null,
-      provider,
-      model,
-    };
+    let callId = null;
+    try {
+      const response = await runMeteredDirectModelCall({
+        sessionId,
+        provider,
+        model,
+        source: "semantic-compaction",
+        persist: async (type, data) => {
+          const appended = appendEventIfHead(
+            sessionId,
+            type,
+            data,
+            ledger.headHash,
+          );
+          ledger.headHash = appended.hash;
+          if (type === "model_usage_started") {
+            callId = data.callId;
+            ledger.callId = callId;
+            ledger.started = true;
+          } else {
+            ledger.settled = true;
+          }
+        },
+        call: () =>
+          chatWithTools([{ role: "user", content: prompt }], {
+            provider,
+            model,
+            baseUrl,
+            enabledToolNames: [],
+            extraToolDefinitions: [],
+            hostManagedToolPolicy: null,
+            contextEngine: null,
+            maxOutputTokens: 2048,
+          }),
+      });
+      return {
+        summary: response?.message?.content || "",
+        usage: response?.usage || null,
+        provider,
+        model,
+        callId,
+        usageLedgerSettled: true,
+      };
+    } catch (error) {
+      attachMeteringMetadata(error, {
+        callId: callId || ledger.callId,
+        settled: ledger.settled,
+      });
+      throw error;
+    }
   };
 }
 
@@ -144,9 +204,32 @@ export function registerCompactCommand(program) {
 
         const source = readCompactSource(sessionId);
         const messages = source.messages;
-        const compressor = buildCompressor(options, source.recorded);
+        const ledger = {
+          headHash: source.headHash,
+          callId: null,
+          started: false,
+          settled: false,
+        };
+        const llmQuery = buildSemanticQuery(
+          options,
+          source.recorded,
+          sessionId,
+          ledger,
+        );
+        const compressor = buildCompressor(options, source.recorded, llmQuery);
+        // llmQuery already persisted a complete call ledger. The provider
+        // helper only carries its metadata through stats; its projected usage
+        // event is intentionally not appended a second time here.
         const { messages: compacted, stats } =
-          await compressor.compress(messages);
+          await compactConversationWithProvider(messages, {
+            compressor,
+            provider: options.provider || source.recorded.provider || undefined,
+            model: options.model || source.recorded.model || undefined,
+          });
+
+        if (ledger.started && !ledger.settled) {
+          throw new Error("semantic compaction usage ledger is unsettled");
+        }
 
         const reduced = stats.saved > 0 || compacted.length < messages.length;
 
@@ -170,7 +253,7 @@ export function registerCompactCommand(program) {
             sessionId,
             "compact",
             { ...stats, messages: compacted },
-            source.headHash,
+            ledger.headHash,
           );
         }
 

package/src/commands/loop.js

@@ -44,15 +44,20 @@ import {
   appendEvent,
   appendEventIfHead,
   readEvents,
+  sessionPath,
   sessionExists,
 } from "../harness/jsonl-session-store.js";
 import { openSchedulerStore } from "../lib/scheduler-kernel/store.js";
-import { LoopSchedulerBridge } from "../lib/scheduler-kernel/loop-adapter.js";
+import {
+  LoopSchedulerBridge,
+  migrateSavedLoopSession,
+} from "../lib/scheduler-kernel/loop-adapter.js";
 
 export const _deps = {
   spawn: executionBroker.spawn.bind(executionBroker),
   openSchedulerStore,
   createLoopSchedulerBridge: (options) => new LoopSchedulerBridge(options),
+  migrateSavedLoopSession,
 };
 
 /**
@@ -395,7 +400,7 @@ export function registerLoopCommand(program) {
               : null,
             { title: `loop: ${operands.join(" ")}`.slice(0, 80) },
           );
-          appendEvent(sessionId, "loop_config", {
+          savedConfig = {
             execMode,
             operands,
             dynamic,
@@ -404,7 +409,8 @@ export function registerLoopCommand(program) {
             untilExitZero,
             until: untilRaw || null,
             cwd: executionCwd,
-          });
+          };
+          appendEvent(sessionId, "loop_config", savedConfig);
         }
 
         // --- SIGINT → graceful stop after the current iteration ---
@@ -446,15 +452,27 @@ export function registerLoopCommand(program) {
         try {
           const executionId = sessionId || `loop-${randomUUID()}`;
           schedulerStore = _deps.openSchedulerStore();
+          const definition = {
+            executionId,
+            cwd: executionCwd,
+            execMode,
+            operands,
+            dynamic,
+          };
+          if (persist) {
+            _deps.migrateSavedLoopSession({
+              schedulerStore,
+              sessionId,
+              config: savedConfig,
+              definition,
+              readEvents,
+              appendEventIfHead,
+              sessionFilePath: sessionPath,
+            });
+          }
           const loopScheduler = _deps.createLoopSchedulerBridge({
             schedulerStore,
-            definition: {
-              executionId,
-              cwd: executionCwd,
-              execMode,
-              operands,
-              dynamic,
-            },
+            definition,
             runIteration: async (n, { signal } = {}) => {
               logger.log(chalk.gray(`\n▸ iteration ${n} — ${label}`));
               const t0 = Date.now();

package/src/commands/routine.js

@@ -345,7 +345,7 @@ export function registerRoutineCommand(program) {
             runId,
           });
         }
-        for (const r of store.githubRoutines()) {
+        for (const r of store.githubRoutines({ schedulerMigration: true })) {
           const github = await bridge.pollGithub(r, {
             fetchEvents: defaultFetchEvents,
           });