chainlesschain 0.164.0 → 0.165.2

package/src/commands/session-location.js

@@ -4,9 +4,24 @@ import { TextDecoder } from "node:util";
 import {
   buildExecutionLocationCatalog,
   buildExecutionLocationHandoffPreview,
+  computeExecutionLocationTargetFactsDigest,
 } from "../lib/execution-location-contract.js";
 import { captureAmbientExecutionLocation } from "../lib/execution-location-runtime.js";
-import { getVerifiedSessionExecutionLocationAuthority } from "../harness/jsonl-session-store.js";
+import {
+  EXECUTION_LOCATION_TARGET_ATTESTATION_SCHEMA,
+  EXECUTION_LOCATION_TARGET_RESUME_SCHEMA,
+  attestExecutionLocationTarget,
+  readExecutionLocationProfile,
+  resumeExecutionLocationTarget,
+} from "../lib/execution-location-target.js";
+import {
+  MAX_SESSION_REPLICA_BYTES,
+  SESSION_EXECUTION_LOCATION_HANDOFF_INSTALL_SCHEMA,
+  getVerifiedSessionExecutionLocationAuthority,
+  installSessionReplica,
+  installSessionReplicaWithLocationHandoff,
+  readVerifiedTranscriptBytes,
+} from "../harness/jsonl-session-store.js";
 import {
   sameFileStatIdentity,
   samePathHandleFileIdentity,
@@ -112,10 +127,13 @@ export function projectSessionExecutionLocation(sessionId, deps = {}) {
   )(sessionId);
   return {
     schema: SESSION_EXECUTION_LOCATION_AUTHORITY_SCHEMA,
-    authority: "verified-session-start",
+    authority: authority.authority || "verified-session-start",
     sessionId: authority.sessionId,
     headHash: authority.headHash,
     eventCount: authority.eventCount,
+    bindingEventHash: authority.bindingEventHash ?? null,
+    bindingEventCount: authority.bindingEventCount ?? null,
+    locationHandoff: authority.locationHandoff ?? null,
     binding: authority.binding,
   };
 }
@@ -156,6 +174,146 @@ export function projectExecutionLocationHandoff(
   };
 }
 
+export function projectExecutionLocationTargetAttestation(
+  sessionId,
+  target,
+  factsPath,
+  profilePath,
+  deps = {},
+) {
+  const handoff = projectExecutionLocationHandoff(
+    sessionId,
+    target,
+    factsPath,
+    deps,
+  );
+  const profile = (
+    deps.readExecutionLocationProfile || readExecutionLocationProfile
+  )(profilePath, deps);
+  return (deps.attestExecutionLocationTarget || attestExecutionLocationTarget)(
+    { handoff, profile },
+    deps,
+  );
+}
+
+export function resumeSessionAtExecutionLocation(
+  sessionId,
+  target,
+  factsPath,
+  profilePath,
+  expectedTargetFactsDigest,
+  deps = {},
+) {
+  const handoff = projectExecutionLocationHandoff(
+    sessionId,
+    target,
+    factsPath,
+    deps,
+  );
+  const profile = (
+    deps.readExecutionLocationProfile || readExecutionLocationProfile
+  )(profilePath, deps);
+  const transcriptBytes =
+    profile.sessionStore?.mode === "replicated"
+      ? (deps.readVerifiedTranscriptBytes || readVerifiedTranscriptBytes)(
+          sessionId,
+        )
+      : null;
+  const readSourceAuthority = () => {
+    const authority = (
+      deps.getVerifiedSessionExecutionLocationAuthority ||
+      getVerifiedSessionExecutionLocationAuthority
+    )(sessionId);
+    return {
+      sessionId: authority.sessionId,
+      headHash: authority.headHash,
+      eventCount: authority.eventCount,
+    };
+  };
+  return (deps.resumeExecutionLocationTarget || resumeExecutionLocationTarget)(
+    {
+      handoff,
+      profile,
+      expectedTargetFactsDigest,
+      transcriptBytes,
+      readSourceAuthority,
+    },
+    deps,
+  );
+}
+
+function readBoundedReplicaInput(deps = {}) {
+  if (process.stdin.isTTY) {
+    throw new Error("session replica bytes must be provided on stdin");
+  }
+  const runtimeFs = deps.fs || fs;
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const chunk = Buffer.allocUnsafe(
+      Math.min(64 * 1024, MAX_SESSION_REPLICA_BYTES + 1 - total),
+    );
+    const count = runtimeFs.readSync(0, chunk, 0, chunk.length, null);
+    if (count === 0) break;
+    total += count;
+    if (total > MAX_SESSION_REPLICA_BYTES) {
+      throw new Error(
+        `session replica exceeds ${MAX_SESSION_REPLICA_BYTES} bytes`,
+      );
+    }
+    chunks.push(chunk.subarray(0, count));
+  }
+  if (total === 0) throw new Error("session replica stdin is empty");
+  return Buffer.concat(chunks, total);
+}
+
+export function receiveSessionReplica(
+  sessionId,
+  expectedHeadHash,
+  expectedEventCount,
+  expectedTranscriptDigest,
+  deps = {},
+) {
+  const bytes = (deps.readSessionReplicaInput || readBoundedReplicaInput)(deps);
+  return (deps.installSessionReplica || installSessionReplica)(
+    sessionId,
+    bytes,
+    {
+      headHash: expectedHeadHash,
+      eventCount: Number(expectedEventCount),
+      transcriptDigest: expectedTranscriptDigest,
+    },
+  );
+}
+
+export function prepareSessionReplicaHandoff(sessionId, options, deps = {}) {
+  const bytes = (deps.readSessionReplicaInput || readBoundedReplicaInput)(deps);
+  const binding = projectCurrentExecutionLocation({}, deps).binding;
+  const targetFactsDigest = computeExecutionLocationTargetFactsDigest(binding);
+  if (targetFactsDigest !== String(options.expectedTargetFactsDigest || "")) {
+    throw new Error("target facts changed before location handoff append");
+  }
+  return (
+    deps.installSessionReplicaWithLocationHandoff ||
+    installSessionReplicaWithLocationHandoff
+  )(
+    sessionId,
+    bytes,
+    {
+      headHash: options.expectedHeadHash,
+      eventCount: Number(options.expectedEventCount),
+      transcriptDigest: options.expectedTranscriptDigest,
+    },
+    {
+      profileDigest: options.profileDigest,
+      targetEvidenceId: options.targetEvidenceId,
+      targetFactsDigest,
+      attestationDigest: options.attestationDigest,
+      binding,
+    },
+  );
+}
+
 function renderBinding(binding) {
   const git = binding.source.git;
   return [
@@ -180,6 +338,30 @@ function writeProjection(projection, options = {}) {
     process.stdout.write(`${JSON.stringify(projection, null, 2)}\n`);
     return;
   }
+  if (projection.schema === EXECUTION_LOCATION_TARGET_ATTESTATION_SCHEMA) {
+    process.stdout.write(
+      `ATTESTED ${projection.binding.location}\nFacts: ${projection.targetFactsDigest}\nAttestation: ${projection.attestationDigest}\nGaps: ${projection.gaps.join(", ")}\n`,
+    );
+    return;
+  }
+  if (projection.schema === EXECUTION_LOCATION_TARGET_RESUME_SCHEMA) {
+    process.stdout.write(
+      `RESUME EXITED ${projection.target}\nReceipt: ${projection.receiptDigest}\nGaps: ${projection.gaps.join(", ")}\n`,
+    );
+    return;
+  }
+  if (projection.schema === "chainlesschain.session-replica-install/v1") {
+    process.stdout.write(
+      `${projection.installed ? "INSTALLED" : "ALREADY PRESENT"} ${projection.sessionId}\nReceipt: ${projection.receiptDigest}\n`,
+    );
+    return;
+  }
+  if (projection.schema === SESSION_EXECUTION_LOCATION_HANDOFF_INSTALL_SCHEMA) {
+    process.stdout.write(
+      `HANDOFF ANCHORED ${projection.sessionId}\nTarget head: ${projection.targetHeadHash}\nReceipt: ${projection.receiptDigest}\n`,
+    );
+    return;
+  }
   if (projection.binding) {
     process.stdout.write(`${renderBinding(projection.binding)}\n`);
     return;
@@ -217,7 +399,7 @@ function runAction(action, options = {}) {
   }
 }
 
-export function registerSessionLocationSubcommands(session) {
+export function registerSessionLocationSubcommands(session, deps = {}) {
   const location = session
     .command("location")
     .description(
@@ -230,7 +412,7 @@ export function registerSessionLocationSubcommands(session) {
     .option("--json", "Machine-readable JSON output")
     .action((options) => {
       process.exitCode = runAction(
-        () => projectCurrentExecutionLocation({}, {}),
+        () => projectCurrentExecutionLocation({}, deps),
         options,
       );
     });
@@ -241,7 +423,7 @@ export function registerSessionLocationSubcommands(session) {
     .option("--json", "Machine-readable JSON output")
     .action((id, options) => {
       process.exitCode = runAction(
-        () => projectSessionExecutionLocation(id),
+        () => projectSessionExecutionLocation(id, deps),
         options,
       );
     });
@@ -254,7 +436,7 @@ export function registerSessionLocationSubcommands(session) {
     .option("--json", "Machine-readable JSON output")
     .action((options) => {
       process.exitCode = runAction(
-        () => projectExecutionLocationComparison({}, {}),
+        () => projectExecutionLocationComparison({}, deps),
         options,
       );
     });
@@ -269,7 +451,136 @@ export function registerSessionLocationSubcommands(session) {
     .option("--json", "Machine-readable JSON output")
     .action((id, target, options) => {
       process.exitCode = runAction(
-        () => projectExecutionLocationHandoff(id, target, options.facts),
+        () => projectExecutionLocationHandoff(id, target, options.facts, deps),
+        options,
+      );
+    });
+
+  location
+    .command("attest <id> <target>")
+    .description(
+      "Invoke a fixed target-side probe and bind observed host facts to a handoff",
+    )
+    .requiredOption(
+      "--facts <path>",
+      "Versioned Git/summary/artifact/permission/target evidence JSON",
+    )
+    .requiredOption(
+      "--profile <path>",
+      "Secret-free WSL/SSH/Container target profile JSON",
+    )
+    .option("--json", "Machine-readable JSON output")
+    .action((id, target, options) => {
+      process.exitCode = runAction(
+        () =>
+          projectExecutionLocationTargetAttestation(
+            id,
+            target,
+            options.facts,
+            options.profile,
+            deps,
+          ),
+        options,
+      );
+    });
+
+  location
+    .command("receive <id>")
+    .description("Install an exact verified session replica from bounded stdin")
+    .requiredOption(
+      "--expected-head-hash <sha256>",
+      "Exact unprefixed transcript head hash",
+    )
+    .requiredOption(
+      "--expected-event-count <count>",
+      "Exact transcript event count",
+    )
+    .requiredOption(
+      "--expected-transcript-digest <sha256>",
+      "Exact SHA-256 digest of stdin bytes",
+    )
+    .option("--json", "Machine-readable JSON receipt")
+    .action((id, options) => {
+      process.exitCode = runAction(
+        () =>
+          receiveSessionReplica(
+            id,
+            options.expectedHeadHash,
+            options.expectedEventCount,
+            options.expectedTranscriptDigest,
+            deps,
+          ),
+        options,
+      );
+    });
+
+  location
+    .command("prepare <id>")
+    .description(
+      "Install an exact replica and append a canonical target-location handoff",
+    )
+    .requiredOption(
+      "--expected-head-hash <sha256>",
+      "Exact unprefixed source transcript head hash",
+    )
+    .requiredOption(
+      "--expected-event-count <count>",
+      "Exact source transcript event count",
+    )
+    .requiredOption(
+      "--expected-transcript-digest <sha256>",
+      "Exact SHA-256 digest of stdin bytes",
+    )
+    .requiredOption(
+      "--expected-target-facts-digest <sha256>",
+      "Stable target facts digest from target attestation",
+    )
+    .requiredOption("--profile-digest <sha256>", "Exact target profile digest")
+    .requiredOption(
+      "--target-evidence-id <id>",
+      "Exact handoff target evidence id",
+    )
+    .requiredOption(
+      "--attestation-digest <sha256>",
+      "Exact target attestation digest",
+    )
+    .option("--json", "Machine-readable JSON receipt")
+    .action((id, options) => {
+      process.exitCode = runAction(
+        () => prepareSessionReplicaHandoff(id, options, deps),
+        options,
+      );
+    });
+
+  location
+    .command("resume <id> <target>")
+    .description(
+      "Re-attest a target, verify its canonical session replica, and resume there",
+    )
+    .requiredOption(
+      "--facts <path>",
+      "Versioned Git/summary/artifact/permission/target evidence JSON",
+    )
+    .requiredOption(
+      "--profile <path>",
+      "Secret-free WSL/SSH/Container target profile JSON",
+    )
+    .requiredOption(
+      "--expected-target-facts-digest <sha256>",
+      "Exact stable target facts digest from session location attest",
+    )
+    .option("--json", "Machine-readable JSON receipt after target exit")
+    .action((id, target, options) => {
+      process.exitCode = runAction(
+        () =>
+          resumeSessionAtExecutionLocation(
+            id,
+            target,
+            options.facts,
+            options.profile,
+            options.expectedTargetFactsDigest,
+            deps,
+          ),
         options,
       );
     });

package/src/constants.js

@@ -30,7 +30,7 @@ export const LLM_PROVIDERS = {
   volcengine: {
     name: "Volcengine (火山引擎/豆包)",
     defaultBaseUrl: "https://ark.cn-beijing.volces.com/api/v3",
-    defaultModel: "doubao-seed-2-1-pro-260628",
+    defaultModel: "deepseek-v4-flash-260425",
     requiresApiKey: true,
   },
   openai: {
@@ -144,7 +144,7 @@ export const DEFAULT_CONFIG = {
     provider: "volcengine",
     apiKey: null,
     baseUrl: "https://ark.cn-beijing.volces.com/api/v3",
-    model: "doubao-seed-2-1-pro-260628",
+    model: "deepseek-v4-flash-260425",
     // When true, `cc ask` (provider=ollama only) overrides baseUrl to point at
     // the Android LocalLlmServer (127.0.0.1:18484). User opt-in toggle:
     //   cc config set llm.preferAndroidLocal true

package/src/data/changelog.json

@@ -1,16 +1,42 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.165.2",
+      "cliVersions": ["0.165.1", "0.165.2"],
+      "date": "2026-08-18",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed — cc CLI 0.165.2: governed plugins and keeper handoff reliability",
+          "body": "> `chainlesschain` **0.165.1 → 0.165.2** (candidate; not yet published,\n> 2026-08-18).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.58**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Governed plugin transactions and provenance**: marketplace payload,\n  activation, install, update, transaction recovery, and provenance decisions\n  bind immutable source identities and digests. Registry cache entries are\n  content-addressed, while corrupt, stale, or mismatched recovery evidence\n  continues to fail closed.\n- **Strict plugin execution boundaries**: the remaining live plugin fixtures\n  now execute in the strict Linux sandbox, MCP security soak provisions its\n  required Bubblewrap boundary explicitly, and release fixtures exercise the\n  production activation path instead of accepting inactive coverage.\n- **Durable workflow authority**: provider requests and settlements, nested and\n  parallel tool effects, child and descendant calls, and timeout outcomes gain\n  durable identity-bound receipts so retries cannot silently reuse ambiguous\n  execution authority.\n- **Background keeper lock handoff**: an owner that durably publishes its exact\n  release marker treats the marker as the logical handoff even when another\n  contender wins physical cleanup. Wrong, corrupt, or active foreign claimants\n  remain rejected, and POSIX/Windows process identity and cleanup races retain\n  bounded fail-closed handling.\n- **Scheduler campaign continuity**: scheduled long-soak dispatches use a pinned\n  campaign identity, refuse overlapping segments, and can auto-finalize only\n  after the required cross-platform evidence window is complete.\n- **Cross-platform release stability**: generated command help stays in sync;\n  POSIX fsync-failure fixtures match the actual read mode; registry cache tests\n  follow immutable URL-plus-digest semantics; and macOS marketplace replay uses\n  isolated local scope instead of leaking state through the runner user home.\n- **Release status**: immutable tag, final source SHA, workflow run IDs, npm\n  provenance, package digests, and registry readback remain intentionally\n  absent until the final `0.165.2` merge SHA passes complete `CLI CI` and\n  `CLI Strict Sandbox` matrices on Linux, Windows, and macOS, followed by the\n  dedicated npm release and independent public readback workflows. The active\n  two-hour Keeper/reliability runs and the 72-hour scheduler campaign are not\n  claimed as completed release evidence here."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.165.1",
+      "cliVersions": ["0.164.0", "0.165.1"],
+      "date": "2026-08-17",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.165.1: runtime admission, remote authority, and background containment",
+          "body": "> `chainlesschain` **0.164.0 → 0.165.1** (published from exact SHA\n> `1a10ed7c8fd14d12f7760e948ff8efe36c766602`, 2026-08-17).\n> CLI release includes `@chainlesschain/personal-data-hub` **0.4.58**;\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Dynamic workflow run admission**: Cowork workflow execution revalidates the\n  immutable definition digest, execution-authority session, permissions,\n  sandbox, scale, and cost gates when a run starts instead of treating an\n  earlier preflight as continuing authority.\n- **Durable remote authority**: CLI-hosted approval, relay membership, and\n  reconnect reconciliation bind responses and commits to durable membership\n  epochs. Stale, revoked, mismatched, or unavailable authority fails closed.\n- **Canonical execution boundaries**: background `run_shell`, plugin-bin, and\n  delivery paths validate canonical workspace and configured repository\n  authority before executing or pushing. Linux child descriptors not declared\n  by the execution contract are closed before launch.\n- **Background keeper containment**: supervisor state locks publish ownership\n  atomically, distinguish zombies and reused PIDs, preserve POSIX process-group\n  cleanup, contain released turns after Worker loss, and require durable cleanup\n  evidence before retiring worktrees. POSIX socket namespaces and Windows exit\n  settlement are bounded for hosted and local environments.\n- **Cross-platform release evidence**: CLI workflows install the candidate's\n  dependency closure, bind reusable jobs to the exact source SHA, keep each\n  platform's evidence isolated, and retain bounded diagnostics for transient\n  process-identity and cleanup races.\n- **Dependency security closure**: the CLI requires the patched `js-yaml`\n  3.15.1 line, while Personal Data Hub 0.4.58 advances its bounded ZIP adapter\n  to `adm-zip` 0.6.0 so a crafted archive cannot trigger the disclosed 4 GB\n  allocation path before adapter-level entry validation.\n- **Release boundary**: the separate plugin marketplace payload/activation\n  hardening later passed its own exact-head gates at `89c498cc46` and merged\n  through PR #215 (`089336992d`). It remains intentionally excluded from this\n  immutable tarball and is tracked as a post-`0.165.1` source increment.\n- **Release packaging recovery**: immutable tag `v-npm-0-165-0` stopped before\n  any registry write because its SBOM resolver tried to fetch the coordinated\n  PDH 0.4.58 candidate before that package could be published. The 0.165.1\n  workflow resolves the SBOM from exact-SHA internal package tarballs instead.\n- **Published release evidence**: immutable tag `v-npm-0-165-1` resolves to\n  exact source commit `1a10ed7c8fd14d12f7760e948ff8efe36c766602`.\n  Its Linux, Windows, and macOS `CLI CI` (`32038591204`) and\n  `CLI Strict Sandbox` (`32038590960`) matrices passed; the dedicated npm\n  release (`32038590940`) and independent public readback (`32039659372`)\n  succeeded. npm reports `latest=0.165.1`; the public tarball SHA-1 is\n  `51ce645bebbe63ae168386cb8b6122a67c7d0813` and SHA-256 is\n  `5806d34b6659dcc632dad31db3acdc2f4fa07fb924b7d93de1d22637a3186241`."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.164.0",
       "cliVersions": ["0.163.8", "0.164.0"],
-      "date": "2026-08-15",
+      "date": "2026-08-16",
       "title": "",
       "sections": [
         {
           "heading": "Added — cc CLI 0.164.0: governed marketplace, execution authority, and native isolation hardening",
-          "body": "> `chainlesschain` **0.163.8 → 0.164.0** (candidate; not yet published,\n> 2026-08-15).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Native clipboard images**: `/paste-image` can attach bounded PNG, JPEG,\n  GIF, and WebP clipboard payloads to the next vision turn. Windows, macOS,\n  Wayland, and X11 host adapters use literal arguments, private temporary\n  files, signature checks, byte/count limits, and the Process Broker boundary.\n- **Scoped execution and context authority**: runtime permissions now expose\n  exact side-effect explanations and scoped decisions, while session execution\n  locations, IDE context-center evidence, prompt interactions, and durable\n  workflow definitions carry versioned identities instead of ambient context.\n- **Governed plugin marketplace**: catalog, multi-registry candidate selection,\n  install authority, update-impact review, artifact byte readback, and remote\n  artifact verification bind publisher, digest, signature, source, policy, and\n  approval evidence before plugin installation or update.\n- **Background keeper containment**: an independent keeper records Worker and\n  descendant PIDs, retires interrupted turns under bounded Windows identity and\n  cleanup budgets, and emits strict formal/smoke evidence contracts. The local\n  real-spawn regression is green; the three-platform formal keeper aggregate is\n  still required before P1-2 can be marked complete.\n- **MCP capsule boundary evidence**: materialized capsules bind the exact Node\n  builtin capability set and OS execution-context requirements. Formal evidence\n  now hashes and reparses each live result and schedules three independent\n  fresh-isolate probes per platform across a two-hour span; smoke evidence is\n  explicitly non-qualifying.\n- **Session and remote-approval hardening**: canonical session persistence gains\n  additional crash and anti-rollback checks. Client-hosted remote approval uses\n  durable same-machine membership epochs and fails closed on stale, revoked, or\n  unavailable authority. Signed coordinator/host lease modules are included as\n  a foundation only; they are not yet wired as a complete cross-host dispatch\n  fence and do not claim distributed consensus or revoke closure.\n- **Linux dynamic-native isolation candidate**: strict Linux native execution\n  recursively attests the ELF startup graph, snapshots caller-owned runtime and\n  plugin bytes, exposes only a read-only descriptor-bound namespace, and blocks\n  loader-input acquisition and nested mount namespaces with a dynamic-only\n  seccomp profile. The typed claim is limited to pathname-visible loader input;\n  broad `sharedLibraryClosure` remains false, JIT/custom loaders are excluded,\n  and packed Linux runtimes fail closed until separately supported.\n- **macOS signed launcher candidate**: a fixed signed/root helper contract can\n  copy and hash runtime and entry descriptors into root-protected snapshots,\n  gate entry until the runtime pathname is removed, supervise the target, and\n  fail closed when ownership, receipt, protocol, or signing evidence differs.\n  It remains disabled until the protected x64/arm64 workflow proves Developer\n  ID signing, notarization, root package installation, and the full live race\n  matrix; it does not claim shared-library closure.\n- **Compatibility and reliability boundary**: reaching the documented\n  `0.164.0` removal floor does not replace representative telemetry. All 25\n  compatibility aliases remain retained because approved cohort export,\n  three-platform reporting coverage, accepted points, and per-command usage are\n  still absent. The scheduler campaign remains incomplete, and the uncommitted\n  remote `run_shell` lease-consumption vertical is excluded after its expanded\n  parallel matrix did not finish fully green.\n- **Release authority hardening**: manual npm workflow runs are dry-run only;\n  production packaging and publishing require an immutable `v-npm-*` tag-push\n  event. Operator-controlled version text is no longer interpolated into shell\n  scripts, release Actions are commit-pinned, and independent readback validates\n  a canonical numeric SemVer before resolving the tag and attested artifact.\n- **Release status**: final tag, source SHA, workflow run IDs, package digests,\n  provenance, and registry readback are intentionally omitted until the exact\n  `0.164.0` release merge commit passes complete `CLI CI` and\n  `CLI Strict Sandbox` matrices on Linux, Windows, and macOS, followed by the\n  dedicated npm release and independent public readback workflows."
+          "body": "> `chainlesschain` **0.163.8 → 0.164.0** (published from exact SHA\n> `313dec85cffa09dbb183be17d2b6597e303bed5f`, 2026-08-16).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Native clipboard images**: `/paste-image` can attach bounded PNG, JPEG,\n  GIF, and WebP clipboard payloads to the next vision turn. Windows, macOS,\n  Wayland, and X11 host adapters use literal arguments, private temporary\n  files, signature checks, byte/count limits, and the Process Broker boundary.\n- **Scoped execution and context authority**: runtime permissions now expose\n  exact side-effect explanations and scoped decisions, while session execution\n  locations, IDE context-center evidence, prompt interactions, and durable\n  workflow definitions carry versioned identities instead of ambient context.\n- **Governed plugin marketplace**: catalog, multi-registry candidate selection,\n  install authority, update-impact review, artifact byte readback, and remote\n  artifact verification bind publisher, digest, signature, source, policy, and\n  approval evidence before plugin installation or update.\n- **Background keeper containment**: an independent keeper records Worker and\n  descendant PIDs, retires interrupted turns under bounded Windows identity and\n  cleanup budgets, and emits strict formal/smoke evidence contracts. The local\n  real-spawn regression is green; the three-platform formal keeper aggregate is\n  still required before P1-2 can be marked complete.\n- **MCP capsule boundary evidence**: materialized capsules bind the exact Node\n  builtin capability set and OS execution-context requirements. Formal evidence\n  now hashes and reparses each live result and schedules three independent\n  fresh-isolate probes per platform across a two-hour span; smoke evidence is\n  explicitly non-qualifying.\n- **Session and remote-approval hardening**: canonical session persistence gains\n  additional crash and anti-rollback checks. Client-hosted remote approval uses\n  durable same-machine membership epochs and fails closed on stale, revoked, or\n  unavailable authority. Signed coordinator/host lease modules are included as\n  a foundation only; they are not yet wired as a complete cross-host dispatch\n  fence and do not claim distributed consensus or revoke closure.\n- **Linux dynamic-native isolation candidate**: strict Linux native execution\n  recursively attests the ELF startup graph, snapshots caller-owned runtime and\n  plugin bytes, exposes only a read-only descriptor-bound namespace, and blocks\n  loader-input acquisition and nested mount namespaces with a dynamic-only\n  seccomp profile. The typed claim is limited to pathname-visible loader input;\n  broad `sharedLibraryClosure` remains false, JIT/custom loaders are excluded,\n  and packed Linux runtimes fail closed until separately supported.\n- **macOS signed launcher candidate**: a fixed signed/root helper contract can\n  copy and hash runtime and entry descriptors into root-protected snapshots,\n  gate entry until the runtime pathname is removed, supervise the target, and\n  fail closed when ownership, receipt, protocol, or signing evidence differs.\n  It remains disabled until the protected x64/arm64 workflow proves Developer\n  ID signing, notarization, root package installation, and the full live race\n  matrix; it does not claim shared-library closure.\n- **Compatibility and reliability boundary**: reaching the documented\n  `0.164.0` removal floor does not replace representative telemetry. All 25\n  compatibility aliases remain retained because approved cohort export,\n  three-platform reporting coverage, accepted points, and per-command usage are\n  still absent. The scheduler campaign remains incomplete, and the uncommitted\n  remote `run_shell` lease-consumption vertical is excluded after its expanded\n  parallel matrix did not finish fully green.\n- **Release authority hardening**: manual npm workflow runs are dry-run only;\n  production packaging and publishing require an immutable `v-npm-*` tag-push\n  event. Operator-controlled version text is no longer interpolated into shell\n  scripts, release Actions are commit-pinned, and independent readback validates\n  a canonical numeric SemVer before resolving the tag and attested artifact.\n- **Published release evidence**: immutable tag `v-npm-0-164-0` resolves to\n  exact source commit `313dec85cffa09dbb183be17d2b6597e303bed5f`. Its\n  Linux, Windows, and macOS `CLI CI` (`31912844177`) and\n  `CLI Strict Sandbox` (`31912844034`) matrices passed; the dedicated npm\n  release (`31912844032`) and independent public readback (`31913903124`)\n  succeeded. npm reports `latest=0.164.0`; the public tarball SHA-1 is\n  `2d13836305c6841b7fe5bcd059bc8ef25127fc3d` and SHA-256 is\n  `4d7f36f11bd2bfc1b85eee87392b74bd948e7cc33698cd35c87bff72fb3b4c16`."
         }
       ]
     },