chainlesschain 0.165.1 → 0.165.2

package/src/commands/session-location.js

@@ -4,9 +4,24 @@ import { TextDecoder } from "node:util";
 import {
   buildExecutionLocationCatalog,
   buildExecutionLocationHandoffPreview,
+  computeExecutionLocationTargetFactsDigest,
 } from "../lib/execution-location-contract.js";
 import { captureAmbientExecutionLocation } from "../lib/execution-location-runtime.js";
-import { getVerifiedSessionExecutionLocationAuthority } from "../harness/jsonl-session-store.js";
+import {
+  EXECUTION_LOCATION_TARGET_ATTESTATION_SCHEMA,
+  EXECUTION_LOCATION_TARGET_RESUME_SCHEMA,
+  attestExecutionLocationTarget,
+  readExecutionLocationProfile,
+  resumeExecutionLocationTarget,
+} from "../lib/execution-location-target.js";
+import {
+  MAX_SESSION_REPLICA_BYTES,
+  SESSION_EXECUTION_LOCATION_HANDOFF_INSTALL_SCHEMA,
+  getVerifiedSessionExecutionLocationAuthority,
+  installSessionReplica,
+  installSessionReplicaWithLocationHandoff,
+  readVerifiedTranscriptBytes,
+} from "../harness/jsonl-session-store.js";
 import {
   sameFileStatIdentity,
   samePathHandleFileIdentity,
@@ -112,10 +127,13 @@ export function projectSessionExecutionLocation(sessionId, deps = {}) {
   )(sessionId);
   return {
     schema: SESSION_EXECUTION_LOCATION_AUTHORITY_SCHEMA,
-    authority: "verified-session-start",
+    authority: authority.authority || "verified-session-start",
     sessionId: authority.sessionId,
     headHash: authority.headHash,
     eventCount: authority.eventCount,
+    bindingEventHash: authority.bindingEventHash ?? null,
+    bindingEventCount: authority.bindingEventCount ?? null,
+    locationHandoff: authority.locationHandoff ?? null,
     binding: authority.binding,
   };
 }
@@ -156,6 +174,146 @@ export function projectExecutionLocationHandoff(
   };
 }
 
+export function projectExecutionLocationTargetAttestation(
+  sessionId,
+  target,
+  factsPath,
+  profilePath,
+  deps = {},
+) {
+  const handoff = projectExecutionLocationHandoff(
+    sessionId,
+    target,
+    factsPath,
+    deps,
+  );
+  const profile = (
+    deps.readExecutionLocationProfile || readExecutionLocationProfile
+  )(profilePath, deps);
+  return (deps.attestExecutionLocationTarget || attestExecutionLocationTarget)(
+    { handoff, profile },
+    deps,
+  );
+}
+
+export function resumeSessionAtExecutionLocation(
+  sessionId,
+  target,
+  factsPath,
+  profilePath,
+  expectedTargetFactsDigest,
+  deps = {},
+) {
+  const handoff = projectExecutionLocationHandoff(
+    sessionId,
+    target,
+    factsPath,
+    deps,
+  );
+  const profile = (
+    deps.readExecutionLocationProfile || readExecutionLocationProfile
+  )(profilePath, deps);
+  const transcriptBytes =
+    profile.sessionStore?.mode === "replicated"
+      ? (deps.readVerifiedTranscriptBytes || readVerifiedTranscriptBytes)(
+          sessionId,
+        )
+      : null;
+  const readSourceAuthority = () => {
+    const authority = (
+      deps.getVerifiedSessionExecutionLocationAuthority ||
+      getVerifiedSessionExecutionLocationAuthority
+    )(sessionId);
+    return {
+      sessionId: authority.sessionId,
+      headHash: authority.headHash,
+      eventCount: authority.eventCount,
+    };
+  };
+  return (deps.resumeExecutionLocationTarget || resumeExecutionLocationTarget)(
+    {
+      handoff,
+      profile,
+      expectedTargetFactsDigest,
+      transcriptBytes,
+      readSourceAuthority,
+    },
+    deps,
+  );
+}
+
+function readBoundedReplicaInput(deps = {}) {
+  if (process.stdin.isTTY) {
+    throw new Error("session replica bytes must be provided on stdin");
+  }
+  const runtimeFs = deps.fs || fs;
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const chunk = Buffer.allocUnsafe(
+      Math.min(64 * 1024, MAX_SESSION_REPLICA_BYTES + 1 - total),
+    );
+    const count = runtimeFs.readSync(0, chunk, 0, chunk.length, null);
+    if (count === 0) break;
+    total += count;
+    if (total > MAX_SESSION_REPLICA_BYTES) {
+      throw new Error(
+        `session replica exceeds ${MAX_SESSION_REPLICA_BYTES} bytes`,
+      );
+    }
+    chunks.push(chunk.subarray(0, count));
+  }
+  if (total === 0) throw new Error("session replica stdin is empty");
+  return Buffer.concat(chunks, total);
+}
+
+export function receiveSessionReplica(
+  sessionId,
+  expectedHeadHash,
+  expectedEventCount,
+  expectedTranscriptDigest,
+  deps = {},
+) {
+  const bytes = (deps.readSessionReplicaInput || readBoundedReplicaInput)(deps);
+  return (deps.installSessionReplica || installSessionReplica)(
+    sessionId,
+    bytes,
+    {
+      headHash: expectedHeadHash,
+      eventCount: Number(expectedEventCount),
+      transcriptDigest: expectedTranscriptDigest,
+    },
+  );
+}
+
+export function prepareSessionReplicaHandoff(sessionId, options, deps = {}) {
+  const bytes = (deps.readSessionReplicaInput || readBoundedReplicaInput)(deps);
+  const binding = projectCurrentExecutionLocation({}, deps).binding;
+  const targetFactsDigest = computeExecutionLocationTargetFactsDigest(binding);
+  if (targetFactsDigest !== String(options.expectedTargetFactsDigest || "")) {
+    throw new Error("target facts changed before location handoff append");
+  }
+  return (
+    deps.installSessionReplicaWithLocationHandoff ||
+    installSessionReplicaWithLocationHandoff
+  )(
+    sessionId,
+    bytes,
+    {
+      headHash: options.expectedHeadHash,
+      eventCount: Number(options.expectedEventCount),
+      transcriptDigest: options.expectedTranscriptDigest,
+    },
+    {
+      profileDigest: options.profileDigest,
+      targetEvidenceId: options.targetEvidenceId,
+      targetFactsDigest,
+      attestationDigest: options.attestationDigest,
+      binding,
+    },
+  );
+}
+
 function renderBinding(binding) {
   const git = binding.source.git;
   return [
@@ -180,6 +338,30 @@ function writeProjection(projection, options = {}) {
     process.stdout.write(`${JSON.stringify(projection, null, 2)}\n`);
     return;
   }
+  if (projection.schema === EXECUTION_LOCATION_TARGET_ATTESTATION_SCHEMA) {
+    process.stdout.write(
+      `ATTESTED ${projection.binding.location}\nFacts: ${projection.targetFactsDigest}\nAttestation: ${projection.attestationDigest}\nGaps: ${projection.gaps.join(", ")}\n`,
+    );
+    return;
+  }
+  if (projection.schema === EXECUTION_LOCATION_TARGET_RESUME_SCHEMA) {
+    process.stdout.write(
+      `RESUME EXITED ${projection.target}\nReceipt: ${projection.receiptDigest}\nGaps: ${projection.gaps.join(", ")}\n`,
+    );
+    return;
+  }
+  if (projection.schema === "chainlesschain.session-replica-install/v1") {
+    process.stdout.write(
+      `${projection.installed ? "INSTALLED" : "ALREADY PRESENT"} ${projection.sessionId}\nReceipt: ${projection.receiptDigest}\n`,
+    );
+    return;
+  }
+  if (projection.schema === SESSION_EXECUTION_LOCATION_HANDOFF_INSTALL_SCHEMA) {
+    process.stdout.write(
+      `HANDOFF ANCHORED ${projection.sessionId}\nTarget head: ${projection.targetHeadHash}\nReceipt: ${projection.receiptDigest}\n`,
+    );
+    return;
+  }
   if (projection.binding) {
     process.stdout.write(`${renderBinding(projection.binding)}\n`);
     return;
@@ -217,7 +399,7 @@ function runAction(action, options = {}) {
   }
 }
 
-export function registerSessionLocationSubcommands(session) {
+export function registerSessionLocationSubcommands(session, deps = {}) {
   const location = session
     .command("location")
     .description(
@@ -230,7 +412,7 @@ export function registerSessionLocationSubcommands(session) {
     .option("--json", "Machine-readable JSON output")
     .action((options) => {
       process.exitCode = runAction(
-        () => projectCurrentExecutionLocation({}, {}),
+        () => projectCurrentExecutionLocation({}, deps),
         options,
       );
     });
@@ -241,7 +423,7 @@ export function registerSessionLocationSubcommands(session) {
     .option("--json", "Machine-readable JSON output")
     .action((id, options) => {
       process.exitCode = runAction(
-        () => projectSessionExecutionLocation(id),
+        () => projectSessionExecutionLocation(id, deps),
         options,
       );
     });
@@ -254,7 +436,7 @@ export function registerSessionLocationSubcommands(session) {
     .option("--json", "Machine-readable JSON output")
     .action((options) => {
       process.exitCode = runAction(
-        () => projectExecutionLocationComparison({}, {}),
+        () => projectExecutionLocationComparison({}, deps),
         options,
       );
     });
@@ -269,7 +451,136 @@ export function registerSessionLocationSubcommands(session) {
     .option("--json", "Machine-readable JSON output")
     .action((id, target, options) => {
       process.exitCode = runAction(
-        () => projectExecutionLocationHandoff(id, target, options.facts),
+        () => projectExecutionLocationHandoff(id, target, options.facts, deps),
+        options,
+      );
+    });
+
+  location
+    .command("attest <id> <target>")
+    .description(
+      "Invoke a fixed target-side probe and bind observed host facts to a handoff",
+    )
+    .requiredOption(
+      "--facts <path>",
+      "Versioned Git/summary/artifact/permission/target evidence JSON",
+    )
+    .requiredOption(
+      "--profile <path>",
+      "Secret-free WSL/SSH/Container target profile JSON",
+    )
+    .option("--json", "Machine-readable JSON output")
+    .action((id, target, options) => {
+      process.exitCode = runAction(
+        () =>
+          projectExecutionLocationTargetAttestation(
+            id,
+            target,
+            options.facts,
+            options.profile,
+            deps,
+          ),
+        options,
+      );
+    });
+
+  location
+    .command("receive <id>")
+    .description("Install an exact verified session replica from bounded stdin")
+    .requiredOption(
+      "--expected-head-hash <sha256>",
+      "Exact unprefixed transcript head hash",
+    )
+    .requiredOption(
+      "--expected-event-count <count>",
+      "Exact transcript event count",
+    )
+    .requiredOption(
+      "--expected-transcript-digest <sha256>",
+      "Exact SHA-256 digest of stdin bytes",
+    )
+    .option("--json", "Machine-readable JSON receipt")
+    .action((id, options) => {
+      process.exitCode = runAction(
+        () =>
+          receiveSessionReplica(
+            id,
+            options.expectedHeadHash,
+            options.expectedEventCount,
+            options.expectedTranscriptDigest,
+            deps,
+          ),
+        options,
+      );
+    });
+
+  location
+    .command("prepare <id>")
+    .description(
+      "Install an exact replica and append a canonical target-location handoff",
+    )
+    .requiredOption(
+      "--expected-head-hash <sha256>",
+      "Exact unprefixed source transcript head hash",
+    )
+    .requiredOption(
+      "--expected-event-count <count>",
+      "Exact source transcript event count",
+    )
+    .requiredOption(
+      "--expected-transcript-digest <sha256>",
+      "Exact SHA-256 digest of stdin bytes",
+    )
+    .requiredOption(
+      "--expected-target-facts-digest <sha256>",
+      "Stable target facts digest from target attestation",
+    )
+    .requiredOption("--profile-digest <sha256>", "Exact target profile digest")
+    .requiredOption(
+      "--target-evidence-id <id>",
+      "Exact handoff target evidence id",
+    )
+    .requiredOption(
+      "--attestation-digest <sha256>",
+      "Exact target attestation digest",
+    )
+    .option("--json", "Machine-readable JSON receipt")
+    .action((id, options) => {
+      process.exitCode = runAction(
+        () => prepareSessionReplicaHandoff(id, options, deps),
+        options,
+      );
+    });
+
+  location
+    .command("resume <id> <target>")
+    .description(
+      "Re-attest a target, verify its canonical session replica, and resume there",
+    )
+    .requiredOption(
+      "--facts <path>",
+      "Versioned Git/summary/artifact/permission/target evidence JSON",
+    )
+    .requiredOption(
+      "--profile <path>",
+      "Secret-free WSL/SSH/Container target profile JSON",
+    )
+    .requiredOption(
+      "--expected-target-facts-digest <sha256>",
+      "Exact stable target facts digest from session location attest",
+    )
+    .option("--json", "Machine-readable JSON receipt after target exit")
+    .action((id, target, options) => {
+      process.exitCode = runAction(
+        () =>
+          resumeSessionAtExecutionLocation(
+            id,
+            target,
+            options.facts,
+            options.profile,
+            options.expectedTargetFactsDigest,
+            deps,
+          ),
         options,
       );
     });

package/src/constants.js

@@ -30,7 +30,7 @@ export const LLM_PROVIDERS = {
   volcengine: {
     name: "Volcengine (火山引擎/豆包)",
     defaultBaseUrl: "https://ark.cn-beijing.volces.com/api/v3",
-    defaultModel: "doubao-seed-2-1-pro-260628",
+    defaultModel: "deepseek-v4-flash-260425",
     requiresApiKey: true,
   },
   openai: {
@@ -144,7 +144,7 @@ export const DEFAULT_CONFIG = {
     provider: "volcengine",
     apiKey: null,
     baseUrl: "https://ark.cn-beijing.volces.com/api/v3",
-    model: "doubao-seed-2-1-pro-260628",
+    model: "deepseek-v4-flash-260425",
     // When true, `cc ask` (provider=ollama only) overrides baseUrl to point at
     // the Android LocalLlmServer (127.0.0.1:18484). User opt-in toggle:
     //   cc config set llm.preferAndroidLocal true

package/src/data/changelog.json

@@ -1,6 +1,19 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.165.2",
+      "cliVersions": ["0.165.1", "0.165.2"],
+      "date": "2026-08-18",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed — cc CLI 0.165.2: governed plugins and keeper handoff reliability",
+          "body": "> `chainlesschain` **0.165.1 → 0.165.2** (candidate; not yet published,\n> 2026-08-18).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.58**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Governed plugin transactions and provenance**: marketplace payload,\n  activation, install, update, transaction recovery, and provenance decisions\n  bind immutable source identities and digests. Registry cache entries are\n  content-addressed, while corrupt, stale, or mismatched recovery evidence\n  continues to fail closed.\n- **Strict plugin execution boundaries**: the remaining live plugin fixtures\n  now execute in the strict Linux sandbox, MCP security soak provisions its\n  required Bubblewrap boundary explicitly, and release fixtures exercise the\n  production activation path instead of accepting inactive coverage.\n- **Durable workflow authority**: provider requests and settlements, nested and\n  parallel tool effects, child and descendant calls, and timeout outcomes gain\n  durable identity-bound receipts so retries cannot silently reuse ambiguous\n  execution authority.\n- **Background keeper lock handoff**: an owner that durably publishes its exact\n  release marker treats the marker as the logical handoff even when another\n  contender wins physical cleanup. Wrong, corrupt, or active foreign claimants\n  remain rejected, and POSIX/Windows process identity and cleanup races retain\n  bounded fail-closed handling.\n- **Scheduler campaign continuity**: scheduled long-soak dispatches use a pinned\n  campaign identity, refuse overlapping segments, and can auto-finalize only\n  after the required cross-platform evidence window is complete.\n- **Cross-platform release stability**: generated command help stays in sync;\n  POSIX fsync-failure fixtures match the actual read mode; registry cache tests\n  follow immutable URL-plus-digest semantics; and macOS marketplace replay uses\n  isolated local scope instead of leaking state through the runner user home.\n- **Release status**: immutable tag, final source SHA, workflow run IDs, npm\n  provenance, package digests, and registry readback remain intentionally\n  absent until the final `0.165.2` merge SHA passes complete `CLI CI` and\n  `CLI Strict Sandbox` matrices on Linux, Windows, and macOS, followed by the\n  dedicated npm release and independent public readback workflows. The active\n  two-hour Keeper/reliability runs and the 72-hour scheduler campaign are not\n  claimed as completed release evidence here."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.165.1",
@@ -10,7 +23,7 @@
       "sections": [
         {
           "heading": "Added — cc CLI 0.165.1: runtime admission, remote authority, and background containment",
-          "body": "> `chainlesschain` **0.164.0 → 0.165.1** (candidate; not yet published,\n> 2026-08-17).\n> CLI candidate with `@chainlesschain/personal-data-hub` **0.4.58**;\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Dynamic workflow run admission**: Cowork workflow execution revalidates the\n  immutable definition digest, execution-authority session, permissions,\n  sandbox, scale, and cost gates when a run starts instead of treating an\n  earlier preflight as continuing authority.\n- **Durable remote authority**: CLI-hosted approval, relay membership, and\n  reconnect reconciliation bind responses and commits to durable membership\n  epochs. Stale, revoked, mismatched, or unavailable authority fails closed.\n- **Canonical execution boundaries**: background `run_shell`, plugin-bin, and\n  delivery paths validate canonical workspace and configured repository\n  authority before executing or pushing. Linux child descriptors not declared\n  by the execution contract are closed before launch.\n- **Background keeper containment**: supervisor state locks publish ownership\n  atomically, distinguish zombies and reused PIDs, preserve POSIX process-group\n  cleanup, contain released turns after Worker loss, and require durable cleanup\n  evidence before retiring worktrees. POSIX socket namespaces and Windows exit\n  settlement are bounded for hosted and local environments.\n- **Cross-platform release evidence**: CLI workflows install the candidate's\n  dependency closure, bind reusable jobs to the exact source SHA, keep each\n  platform's evidence isolated, and retain bounded diagnostics for transient\n  process-identity and cleanup races.\n- **Dependency security closure**: the CLI requires the patched `js-yaml`\n  3.15.1 line, while Personal Data Hub 0.4.58 advances its bounded ZIP adapter\n  to `adm-zip` 0.6.0 so a crafted archive cannot trigger the disclosed 4 GB\n  allocation path before adapter-level entry validation.\n- **Release boundary**: the separate plugin marketplace activation hardening in\n  PR #209 is intentionally excluded because its latest CLI and PR test runs are\n  not green. This candidate does not claim that pending source as published.\n- **Release packaging recovery**: immutable tag `v-npm-0-165-0` stopped before\n  any registry write because its SBOM resolver tried to fetch the coordinated\n  PDH 0.4.58 candidate before that package could be published. The 0.165.1\n  workflow resolves the SBOM from exact-SHA internal package tarballs instead.\n- **Release status**: immutable tag, final source SHA, workflow run IDs, npm\n  provenance, package digests, and registry readback remain intentionally\n  absent until the final merge SHA passes complete `CLI CI` and\n  `CLI Strict Sandbox` matrices on Linux, Windows, and macOS, followed by the\n  dedicated npm release and independent public readback workflows."
+          "body": "> `chainlesschain` **0.164.0 → 0.165.1** (published from exact SHA\n> `1a10ed7c8fd14d12f7760e948ff8efe36c766602`, 2026-08-17).\n> CLI release includes `@chainlesschain/personal-data-hub` **0.4.58**;\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Dynamic workflow run admission**: Cowork workflow execution revalidates the\n  immutable definition digest, execution-authority session, permissions,\n  sandbox, scale, and cost gates when a run starts instead of treating an\n  earlier preflight as continuing authority.\n- **Durable remote authority**: CLI-hosted approval, relay membership, and\n  reconnect reconciliation bind responses and commits to durable membership\n  epochs. Stale, revoked, mismatched, or unavailable authority fails closed.\n- **Canonical execution boundaries**: background `run_shell`, plugin-bin, and\n  delivery paths validate canonical workspace and configured repository\n  authority before executing or pushing. Linux child descriptors not declared\n  by the execution contract are closed before launch.\n- **Background keeper containment**: supervisor state locks publish ownership\n  atomically, distinguish zombies and reused PIDs, preserve POSIX process-group\n  cleanup, contain released turns after Worker loss, and require durable cleanup\n  evidence before retiring worktrees. POSIX socket namespaces and Windows exit\n  settlement are bounded for hosted and local environments.\n- **Cross-platform release evidence**: CLI workflows install the candidate's\n  dependency closure, bind reusable jobs to the exact source SHA, keep each\n  platform's evidence isolated, and retain bounded diagnostics for transient\n  process-identity and cleanup races.\n- **Dependency security closure**: the CLI requires the patched `js-yaml`\n  3.15.1 line, while Personal Data Hub 0.4.58 advances its bounded ZIP adapter\n  to `adm-zip` 0.6.0 so a crafted archive cannot trigger the disclosed 4 GB\n  allocation path before adapter-level entry validation.\n- **Release boundary**: the separate plugin marketplace payload/activation\n  hardening later passed its own exact-head gates at `89c498cc46` and merged\n  through PR #215 (`089336992d`). It remains intentionally excluded from this\n  immutable tarball and is tracked as a post-`0.165.1` source increment.\n- **Release packaging recovery**: immutable tag `v-npm-0-165-0` stopped before\n  any registry write because its SBOM resolver tried to fetch the coordinated\n  PDH 0.4.58 candidate before that package could be published. The 0.165.1\n  workflow resolves the SBOM from exact-SHA internal package tarballs instead.\n- **Published release evidence**: immutable tag `v-npm-0-165-1` resolves to\n  exact source commit `1a10ed7c8fd14d12f7760e948ff8efe36c766602`.\n  Its Linux, Windows, and macOS `CLI CI` (`32038591204`) and\n  `CLI Strict Sandbox` (`32038590960`) matrices passed; the dedicated npm\n  release (`32038590940`) and independent public readback (`32039659372`)\n  succeeded. npm reports `latest=0.165.1`; the public tarball SHA-1 is\n  `51ce645bebbe63ae168386cb8b6122a67c7d0813` and SHA-256 is\n  `5806d34b6659dcc632dad31db3acdc2f4fa07fb924b7d93de1d22637a3186241`."
         }
       ]
     },

package/src/gateways/ws/action-protocol.js

@@ -417,7 +417,7 @@ async function _resolveWorkflowExecutionAuthority(server, sessionId) {
   }
   return Object.freeze({
     schema: WORKFLOW_EXECUTION_AUTHORITY_SCHEMA,
-    authority: "verified-session-start",
+    authority: proof.authority || "verified-session-start",
     sessionId: proof.sessionId,
     headHash: proof.headHash,
     eventCount: proof.eventCount,