chainlesschain 0.163.7 → 0.163.8

package/src/commands/team.js

@@ -57,6 +57,7 @@ import {
 } from "../lib/agent-team/team-control-store.js";
 import { TeamProcessCheckpointBroker } from "../lib/agent-team/team-process-checkpoint.js";
 import { registerTeamDistributedCommands } from "./team-distributed.js";
+import { registerTeamMergeReviewCommands } from "./team-merge-review.js";
 import {
   sameFileStatIdentity,
   samePathHandleFileIdentity,
@@ -1451,6 +1452,7 @@ export function registerTeamCommand(program, { logger } = {}) {
     agentExecutor: spawnAgent,
     buildAgentPrompt: buildTeamAgentPrompt,
   });
+  registerTeamMergeReviewCommands(team, { logger: log });
 
   team
     .command("control-bindings")

package/src/data/changelog.json

@@ -1,6 +1,19 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.163.8",
+      "cliVersions": ["0.163.7", "0.163.8"],
+      "date": "2026-08-14",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.163.8: governed recovery, merge review, and MCP resource templates",
+          "body": "> `chainlesschain` **0.163.7 → 0.163.8** (candidate; not yet published,\n> 2026-08-14).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Crash-safe scheduler source persistence**: Agenda and Cowork authoritative\n  stores now reject unreadable, malformed, and non-object records instead of\n  treating them as empty state. Generation replacement uses private exclusive\n  temporary files, complete short-write loops, file fsync, atomic rename, and\n  POSIX directory fsync, while distinguishing pre-rename `not-committed`\n  failures from post-rename durability-unknown outcomes.\n- **Deterministic scheduler disk-fault closure**: fault injection covers ENOSPC,\n  partial writes, file and directory fsync failures, rename failures, corrupted\n  source stores, native SQLite `SQLITE_FULL` transaction rollback, Automation\n  source rollback atomicity, database truncation, and clean reopen behavior.\n  Routine and Loop retain their existing durable-store and append/CAS\n  protections.\n- **Governed Automation runtime recovery**: scheduler-backed Automation work can\n  expose exact-fence, control-revision, capability-bound pause and resume safe\n  points. Revisioned incidents support bounded retry or cancellation; retry\n  revalidates the exact dead-letter occurrence, run identity, fence, and error\n  evidence, while manual incidents are not silently replayed.\n- **Governed multi-agent merge review**: `cc team merge-review` subcommands\n  `preview|show|apply|rollback` provide stable file and hunk selection,\n  digest-bound decisions, durable conflict evidence, guarded cross-branch batch\n  publication, and retained-history rollback. Git hooks, repository-local\n  configuration, inherited environment, stale revisions, oversized selections,\n  and changed branch identities fail closed.\n- **Read-only MCP resource templates**: templates-only MCP servers can now\n  register the existing resource surface. The new\n  `list_mcp_resource_templates {server?}` tool reads the bounded discovery\n  cache, supports explicit server filtering, and lets the model instantiate a\n  concrete URI before using the existing `read_mcp_resource` boundary. It does\n  not add an implicit network request, subscription, or automatic URI\n  expansion.\n- **Explicit optional-protocol decisions**: resource templates enter the\n  production read-only surface; resource subscriptions, peer-controlled\n  logging, and completion remain deferred pending bounded consumers and\n  cancellation/recovery UX. MCP sampling remains undeclared and server\n  `createMessage` requests continue to return JSON-RPC `-32601`.\n- **Transaction-time scheduler fencing**: claim, renewal, and settlement paths\n  now read their lease clock inside the write transaction, preventing queue\n  wait time from turning a pre-transaction timestamp into a stale lease or\n  settlement decision.\n- **Formal scheduler soak evidence gate**: Linux, Windows, and macOS workflows\n  now exercise two-worker contention, lease/fence recovery, heartbeat renewal,\n  stale settlement rejection, outcome-unknown no-replay, DST/backlog behavior,\n  SQLite integrity, descendant cleanup, and bounded resource trends. The\n  campaign verifier requires at least four identity-bound formal segments whose\n  authoritative starts span at least 72 natural hours, with no gap above\n  30 hours.\n- **Release boundary**: the scheduler soak implementation and smoke matrices are\n  present, but the required 72-hour formal campaign has not completed; P2-4\n  therefore remains partially complete. Signed native distribution,\n  representative alias-removal telemetry, and the entire unmerged P2-2 native\n  clipboard-image host work remain outside this candidate.\n- **Release status**: final tag, source SHA, workflow run IDs, package digests,\n  provenance, and registry readback are intentionally omitted until the exact\n  `0.163.8` release merge commit passes complete `CLI CI` and\n  `CLI Strict Sandbox` matrices on Linux, Windows, and macOS, followed by the\n  dedicated npm release and independent public readback workflows."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.163.7",
@@ -10,7 +23,7 @@
       "sections": [
         {
           "heading": "Added — cc CLI 0.163.7: governed scheduler migration and causal observability",
-          "body": "> `chainlesschain` **0.163.6 → 0.163.7** (candidate; not yet published,\n> 2026-08-14).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Five-domain migration journal**: Agenda, Cowork Cron, Routine, Automation,\n  and Loop migrations use the scheduler store schema-v5 journal with\n  domain-typed source locators, immutable source/target digest bindings,\n  idempotent recovery, and fail-closed rejection of conflicting or ambiguous\n  legacy entries.\n- **Governed rollback controls**: the new scheduler migration `list`, `show`,\n  and `rollback` commands expose redacted migration status and blockers.\n  Rollback requires the latest evidence digest, an interactive TTY, and the\n  exact typed challenge before reopening any legacy source.\n- **Target-first recovery and CAS fencing**: rollback stops or restores the\n  scheduler target before restoring the legacy source, validates target\n  revision, definition and execution evidence, and makes terminal source\n  restoration retry-safe across process crashes. This is not a claim of one\n  atomic transaction across independent stores or filesystems.\n- **Fail-closed source identity**: Windows drive and UNC paths are canonicalized\n  while relative, incomplete and device-namespace paths are rejected.\n  Automation migration requires an existing native SQLite database and refuses\n  the non-durable sql.js fallback; Loop restoration remains bound to its durable\n  retirement fence, marker and original source digest.\n- **Windows persistence hardening**: team adjudication atomic replacement\n  retries only transient Windows `EACCES`, `EBUSY`, and `EPERM` sharing\n  failures with bounded backoff and authority-path revalidation. Exhausted,\n  non-transient, and non-Windows replacement failures continue to fail closed.\n- **Cross-platform CI hardening**: migration fixtures verify retirement fences\n  and canonical source identities consistently across operating systems, while\n  distributed-queue and authority test workers use bounded lifetimes and attach\n  result observers before short-lived children can exit. Terminal Skill\n  authority fixtures now use an explicit parent acknowledgement before clean\n  exit, removing Windows IPC exit-before-message ordering ambiguity without\n  weakening concurrent revocation assertions.\n- **Verified causal delivery reports**: scoped sessions can be bound by exact\n  transcript head and event count to digest-protected delivery states. The new\n  session observability commands export a redacted session-to-delivery graph\n  spanning diffs, gates, artifacts, pull requests, and merges, with exact\n  workspace, team, and policy filters.\n- **Fail-closed call-ledger budgets**: `call-ledger@1` brackets model, retry,\n  compaction, subagent, isolated-skill, and tool calls with known or unknown\n  settlements. Strict budget mode rejects exceeded and unevaluable results\n  instead of treating missing token, cost, retry, or tool-latency evidence as\n  zero.\n- **Background recovery authority hardening**: verified transcript CAS,\n  delegated recovery leases, IPC sender/nonce binding, bootstrap guards, exact\n  process-group termination checks, and terminal cleanup prevent uncertain or\n  still-live descendants from authorizing recovery or worktree deletion.\n- **Causal evidence boundary**: report bindings prove exact verified revisions,\n  not that a model call semantically caused a source hunk. Scope labels are not\n  identity or membership proofs, digests are not signatures, anti-rollback is\n  machine-local, and incomplete or legacy ledgers remain partial or unknown.\n- **Known residuals**: scheduler ENOSPC/partial-write/fsync/rename/SQLite fault\n  closure and the Linux, Windows, and macOS long-soak matrix remain open.\n  Signed native distribution and representative alias-removal telemetry also\n  remain outside this candidate.\n- **Release status**: final tag, source SHA, workflow run IDs, package digest,\n  provenance, and registry readback are intentionally omitted until the exact\n  `0.163.7` release merge commit passes both required workflow matrices on\n  Linux, Windows, and macOS, followed by the dedicated npm release and\n  independent public readback workflows."
+          "body": "> `chainlesschain` **0.163.6 → 0.163.7** (published from exact SHA\n> `3e997168621c53708a1682868c6cc4edc9baf15b`, 2026-08-14).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Five-domain migration journal**: Agenda, Cowork Cron, Routine, Automation,\n  and Loop migrations use the scheduler store schema-v5 journal with\n  domain-typed source locators, immutable source/target digest bindings,\n  idempotent recovery, and fail-closed rejection of conflicting or ambiguous\n  legacy entries.\n- **Governed rollback controls**: the new scheduler migration `list`, `show`,\n  and `rollback` commands expose redacted migration status and blockers.\n  Rollback requires the latest evidence digest, an interactive TTY, and the\n  exact typed challenge before reopening any legacy source.\n- **Target-first recovery and CAS fencing**: rollback stops or restores the\n  scheduler target before restoring the legacy source, validates target\n  revision, definition and execution evidence, and makes terminal source\n  restoration retry-safe across process crashes. This is not a claim of one\n  atomic transaction across independent stores or filesystems.\n- **Fail-closed source identity**: Windows drive and UNC paths are canonicalized\n  while relative, incomplete and device-namespace paths are rejected.\n  Automation migration requires an existing native SQLite database and refuses\n  the non-durable sql.js fallback; Loop restoration remains bound to its durable\n  retirement fence, marker and original source digest.\n- **Windows persistence hardening**: team adjudication atomic replacement\n  retries only transient Windows `EACCES`, `EBUSY`, and `EPERM` sharing\n  failures with bounded backoff and authority-path revalidation. Exhausted,\n  non-transient, and non-Windows replacement failures continue to fail closed.\n- **Cross-platform CI hardening**: migration fixtures verify retirement fences\n  and canonical source identities consistently across operating systems, while\n  distributed-queue and authority test workers use bounded lifetimes and attach\n  result observers before short-lived children can exit. Terminal Skill\n  authority fixtures now use an explicit parent acknowledgement before clean\n  exit, removing Windows IPC exit-before-message ordering ambiguity without\n  weakening concurrent revocation assertions.\n- **Verified causal delivery reports**: scoped sessions can be bound by exact\n  transcript head and event count to digest-protected delivery states. The new\n  session observability commands export a redacted session-to-delivery graph\n  spanning diffs, gates, artifacts, pull requests, and merges, with exact\n  workspace, team, and policy filters.\n- **Fail-closed call-ledger budgets**: `call-ledger@1` brackets model, retry,\n  compaction, subagent, isolated-skill, and tool calls with known or unknown\n  settlements. Strict budget mode rejects exceeded and unevaluable results\n  instead of treating missing token, cost, retry, or tool-latency evidence as\n  zero.\n- **Background recovery authority hardening**: verified transcript CAS,\n  delegated recovery leases, IPC sender/nonce binding, bootstrap guards, exact\n  process-group termination checks, and terminal cleanup prevent uncertain or\n  still-live descendants from authorizing recovery or worktree deletion.\n- **Causal evidence boundary**: report bindings prove exact verified revisions,\n  not that a model call semantically caused a source hunk. Scope labels are not\n  identity or membership proofs, digests are not signatures, anti-rollback is\n  machine-local, and incomplete or legacy ledgers remain partial or unknown.\n- **Release boundary**: deterministic scheduler disk-fault closure landed after\n  this immutable release and is not attributed to its tarball. The\n  three-platform long-soak campaign, signed native distribution, and\n  representative alias-removal telemetry remained outside this release.\n- **Published release evidence**: immutable tag `v-npm-0-163-7` resolves to\n  exact source commit `3e997168621c53708a1682868c6cc4edc9baf15b`. Its Linux,\n  Windows, and macOS `CLI CI` (`31745391661`, attempt 2) and\n  `CLI Strict Sandbox` (`31745391321`) matrices passed; the dedicated npm\n  release (`31748153519`) completed its exact-SHA gate, immutable package,\n  Trusted Publishing, and signed provenance, and the independent public\n  readback (`31749404980`) succeeded. npm reports `latest=0.163.7`; the public\n  tarball SHA-1 is `5bfb7471643cfe4d4cd0b0a382b31c63fc1efdff` and SHA-256 is\n  `d7ca295e6cdb4e442ee7ad6bb9cc0b9d923f40de4eae395974d91b4dfab83a9d`."
         }
       ]
     },

package/src/lib/agent-schedule-store.js

@@ -258,6 +258,21 @@ function agendaStoreError(code, message, { retryable = false, retryAt } = {}) {
   return error;
 }
 
+function agendaPersistenceError(
+  code,
+  message,
+  cause,
+  { filePath, commitState } = {},
+) {
+  const error = new Error(message, { cause });
+  error.name = "AgendaScheduleStoreError";
+  error.code = code;
+  error.filePath = filePath;
+  if (typeof cause?.code === "string") error.fsCode = cause.code;
+  if (commitState) error.commitState = commitState;
+  return error;
+}
+
 function applyScheduledAgentSuccess(entry, atMs) {
   if (entry.kind === "wakeup") {
     entry.status = "fired";
@@ -666,9 +681,16 @@ export function previousCronTime(expr, fromMs, options = {}) {
 // ─── store ───────────────────────────────────────────────────────────────
 
 export class AgentScheduleStore {
-  constructor({ dir = null, now = () => Date.now() } = {}) {
+  constructor({
+    dir = null,
+    now = () => Date.now(),
+    fileSystem = fs,
+    platform = process.platform,
+  } = {}) {
     this.dir = dir || agentScheduleDir();
     this._now = typeof now === "function" ? now : () => now;
+    this._fs = fileSystem;
+    this._platform = platform;
   }
 
   _file(kind) {
@@ -676,37 +698,124 @@ export class AgentScheduleStore {
   }
 
   _ensureDir() {
-    fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+    this._fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
   }
 
-  _readAll(kind) {
+  _readAll(kind, { failOnMalformed = false } = {}) {
+    const filePath = this._file(kind);
     let raw;
     try {
-      raw = fs.readFileSync(this._file(kind), "utf-8");
-    } catch {
-      return [];
+      raw = this._fs.readFileSync(filePath, "utf-8");
+    } catch (cause) {
+      if (cause?.code === "ENOENT") return [];
+      throw agendaPersistenceError(
+        "AGENDA_SCHEDULE_STORE_READ_FAILED",
+        `Agenda schedule store read failed (${filePath})`,
+        cause,
+        { filePath },
+      );
     }
     const entries = [];
+    let lineNumber = 0;
     for (const line of raw.split("\n")) {
+      lineNumber += 1;
       const trimmed = line.trim();
       if (!trimmed) continue;
       try {
-        entries.push(JSON.parse(trimmed));
-      } catch {
+        const entry = JSON.parse(trimmed);
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+          throw new TypeError("schedule entry must be an object");
+        }
+        entries.push(entry);
+      } catch (cause) {
+        if (failOnMalformed) {
+          throw agendaPersistenceError(
+            "AGENDA_SCHEDULE_STORE_MALFORMED",
+            `Agenda schedule store contains malformed JSONL (${filePath}:${lineNumber})`,
+            cause,
+            { filePath },
+          );
+        }
         // Skip a corrupt line rather than throwing — one bad append must not
-        // poison the whole store (per-row resilience, like the JSON.parse sweep).
+        // poison advisory reads. Authoritative mutations opt into strict mode
+        // so they never replace a store after silently dropping durable rows.
       }
     }
     return entries;
   }
 
   _writeAll(kind, entries) {
-    this._ensureDir();
+    const filePath = this._file(kind);
     const body = entries.map((entry) => JSON.stringify(entry)).join("\n");
-    fs.writeFileSync(this._file(kind), body ? body + "\n" : "", {
-      encoding: "utf-8",
-      mode: 0o600,
-    });
+    const contents = Buffer.from(body ? `${body}\n` : "", "utf8");
+    const temporaryPath = path.join(
+      this.dir,
+      `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`,
+    );
+    let descriptor = null;
+    let renamed = false;
+
+    try {
+      this._ensureDir();
+      descriptor = this._fs.openSync(temporaryPath, "wx", 0o600);
+      let offset = 0;
+      while (offset < contents.length) {
+        const written = this._fs.writeSync(
+          descriptor,
+          contents,
+          offset,
+          contents.length - offset,
+          null,
+        );
+        if (!Number.isSafeInteger(written) || written <= 0) {
+          const cause = new Error("write returned no progress");
+          cause.code = "EIO";
+          throw cause;
+        }
+        offset += written;
+      }
+      this._fs.fsyncSync(descriptor);
+      this._fs.closeSync(descriptor);
+      descriptor = null;
+      this._fs.renameSync(temporaryPath, filePath);
+      renamed = true;
+
+      if (this._platform !== "win32") {
+        const directoryDescriptor = this._fs.openSync(this.dir, "r");
+        try {
+          this._fs.fsyncSync(directoryDescriptor);
+        } finally {
+          this._fs.closeSync(directoryDescriptor);
+        }
+      }
+    } catch (cause) {
+      if (descriptor !== null) {
+        try {
+          this._fs.closeSync(descriptor);
+        } catch {
+          // Preserve the original persistence failure.
+        }
+      }
+      if (!renamed) {
+        try {
+          this._fs.unlinkSync(temporaryPath);
+        } catch {
+          // Best-effort orphan cleanup; the authoritative file is untouched.
+        }
+      }
+      throw agendaPersistenceError(
+        "AGENDA_SCHEDULE_STORE_WRITE_FAILED",
+        `Agenda schedule store write failed (${filePath})`,
+        cause,
+        {
+          filePath,
+          // A failure before rename leaves the old generation authoritative.
+          // A directory-fsync failure after rename makes crash durability
+          // unknowable even though an immediate read sees the new generation.
+          commitState: renamed ? "unknown" : "not-committed",
+        },
+      );
+    }
   }
 
   // ── create ──────────────────────────────────────────────────────────────
@@ -741,7 +850,7 @@ export class AgentScheduleStore {
       createdAt: now,
       status: "pending",
     };
-    const entries = this._readAll("wakeup");
+    const entries = this._readAll("wakeup", { failOnMalformed: true });
     entries.push(entry);
     this._writeAll("wakeup", entries);
     return entry;
@@ -786,7 +895,7 @@ export class AgentScheduleStore {
       runs: 0,
       status: "active",
     };
-    const entries = this._readAll("cron");
+    const entries = this._readAll("cron", { failOnMalformed: true });
     entries.push(entry);
     this._writeAll("cron", entries);
     return entry;
@@ -882,7 +991,7 @@ export class AgentScheduleStore {
       checks: 0,
       status: "active",
     };
-    const entries = this._readAll("monitor");
+    const entries = this._readAll("monitor", { failOnMalformed: true });
     entries.push(entry);
     this._writeAll("monitor", entries);
     return entry;
@@ -917,7 +1026,7 @@ export class AgentScheduleStore {
       path.join(this.dir, ".agenda-claims"),
       () => {
         for (const kind of SCHEDULE_KINDS) {
-          const entries = this._readAll(kind);
+          const entries = this._readAll(kind, { failOnMalformed: true });
           const entry = entries.find((candidate) => candidate.id === id);
           if (!entry) continue;
           if (!isSchedulableStatus(entry)) {
@@ -993,7 +1102,7 @@ export class AgentScheduleStore {
       path.join(this.dir, ".agenda-claims"),
       () => {
         for (const kind of SCHEDULE_KINDS) {
-          const entries = this._readAll(kind);
+          const entries = this._readAll(kind, { failOnMalformed: true });
           const entry = entries.find((candidate) => candidate.id === id);
           if (!entry) continue;
           const prior = entry.schedulerMigration;
@@ -1079,7 +1188,7 @@ export class AgentScheduleStore {
       path.join(this.dir, ".agenda-claims"),
       () => {
         for (const kind of SCHEDULE_KINDS) {
-          const entries = this._readAll(kind);
+          const entries = this._readAll(kind, { failOnMalformed: true });
           const entry = entries.find((candidate) => candidate.id === id);
           if (!entry) continue;
           const migration = entry.schedulerMigration;
@@ -1171,7 +1280,9 @@ export class AgentScheduleStore {
       () => {
         const claimed = [];
         for (const scheduleKind of kinds) {
-          const entries = this._readAll(scheduleKind);
+          const entries = this._readAll(scheduleKind, {
+            failOnMalformed: true,
+          });
           let changed = false;
           for (const entry of entries) {
             if (!isSchedulableStatus(entry) || isEntryExpired(entry, now))
@@ -1242,7 +1353,7 @@ export class AgentScheduleStore {
       path.join(this.dir, ".agenda-claims"),
       () => {
         for (const kind of SCHEDULE_KINDS) {
-          const entries = this._readAll(kind);
+          const entries = this._readAll(kind, { failOnMalformed: true });
           const entry = entries.find((candidate) => candidate.id === id);
           if (!entry) continue;
           const prior = entry.schedulerExecution;
@@ -1330,7 +1441,7 @@ export class AgentScheduleStore {
       path.join(this.dir, ".agenda-claims"),
       () => {
         for (const kind of SCHEDULE_KINDS) {
-          const entries = this._readAll(kind);
+          const entries = this._readAll(kind, { failOnMalformed: true });
           const entry = entries.find((candidate) => candidate.id === id);
           if (!entry) continue;
           const evidence = entry.schedulerExecution;
@@ -1408,7 +1519,7 @@ export class AgentScheduleStore {
       path.join(this.dir, ".agenda-claims"),
       () => {
         for (const kind of SCHEDULE_KINDS) {
-          const entries = this._readAll(kind);
+          const entries = this._readAll(kind, { failOnMalformed: true });
           const entry = entries.find((candidate) => candidate.id === id);
           if (!entry) continue;
           const evidence = entry.schedulerExecution;
@@ -1484,7 +1595,7 @@ export class AgentScheduleStore {
     const now = atMs != null ? atMs : this._now();
     const retired = [];
     for (const kind of SCHEDULE_KINDS) {
-      const entries = this._readAll(kind);
+      const entries = this._readAll(kind, { failOnMalformed: true });
       let changed = false;
       for (const entry of entries) {
         if (isSchedulableStatus(entry) && isEntryExpired(entry, now)) {
@@ -1501,7 +1612,7 @@ export class AgentScheduleStore {
 
   cancel(id) {
     for (const kind of SCHEDULE_KINDS) {
-      const entries = this._readAll(kind);
+      const entries = this._readAll(kind, { failOnMalformed: true });
       const idx = entries.findIndex((entry) => entry.id === id);
       if (idx >= 0) {
         const [removed] = entries.splice(idx, 1);
@@ -1522,7 +1633,7 @@ export class AgentScheduleStore {
   pruneTerminal({ before = Infinity } = {}) {
     const removed = [];
     for (const kind of SCHEDULE_KINDS) {
-      const entries = this._readAll(kind);
+      const entries = this._readAll(kind, { failOnMalformed: true });
       const keep = entries.filter((entry) => {
         const prunable =
           TERMINAL_SET.has(entry.status) && terminalAt(entry) <= before;
@@ -1586,7 +1697,7 @@ export class AgentScheduleStore {
   }
 
   _mutate(kind, id, fn) {
-    const entries = this._readAll(kind);
+    const entries = this._readAll(kind, { failOnMalformed: true });
     const entry = entries.find((e) => e.id === id);
     if (!entry) return null;
     fn(entry);