chainlesschain 0.165.1 → 0.165.2

package/src/lib/public-ide-capability-manifest.js

@@ -161,7 +161,7 @@ const DESKTOP_SHORTCUT_KEYS = [
 export const PUBLIC_IDE_CAPABILITY_MANIFEST = freeze({
   schema: "chainlesschain.public-ide-capabilities/v1",
   schemaVersion: 1,
-  minimumCliVersion: "0.162.47",
+  minimumCliVersion: "0.162.190",
   protocol: buildCompatFixture(),
   bridge: {
     schemaVersion: 1,

package/src/lib/remote-membership-coordinator.js

@@ -8,12 +8,14 @@
  * with a pinned Ed25519 key; WebSocket delivery is transport only and never an
  * authority by itself.
  *
- * Integration status: this module is a deployable contract, but the current
- * remote-session registry, approval bridge, and agent dispatch paths do not
- * call it yet. Cross-host revoke closure therefore remains false until every
- * real side-effect entry point performs the online one-shot consume. A
- * successful consume linearizes dispatch authority; it cannot undo an external
- * effect after that effect has started.
+ * Production integration: the Remote Session registry and WebSocket protocol
+ * use this coordinator, the client-hosted approval bridge durably adopts and
+ * ACKs its signed leases, and Agent shell dispatch consumes the exact one-shot
+ * lease online immediately before the side effect. Side-effect paths without
+ * that consume boundary reject Remote approval instead of falling back to a
+ * cached decision. This provides cross-host revoke fencing under one online,
+ * strongly consistent coordinator; it does not claim quorum availability or
+ * undo an external effect after a successful consume has linearized dispatch.
  */
 
 import fs from "node:fs";

package/src/lib/sub-agent-context.js

@@ -31,6 +31,27 @@ const SUMMARY_DIRECT_THRESHOLD = 500; // chars — below this, use result as-is
 const SUMMARY_SECTION_PATTERN =
   /^##\s*(Summary|Result|Output|Conclusion|Answer)/im;
 const TRUNCATE_LENGTH = 500;
+const PROVIDER_CLIENT_REQUEST_ID_RE = /^ccwf_[a-f0-9]{64}$/;
+const PROVIDER_CALL_ID_RE = /^[A-Za-z0-9._:-]{1,256}$/;
+const PROVIDER_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+const WORKFLOW_EFFECT_ID_RE = /^sha256:[a-f0-9]{64}$/;
+const WORKFLOW_CHILD_EFFECT_PROTOCOL = "cc-workflow-child-effect/v1";
+const WORKFLOW_TOOL_CALL_ID_RE = /^[\x21-\x7e]{1,512}$/;
+const WORKFLOW_TOOL_NAME_RE = /^[A-Za-z0-9._:-]{1,256}$/;
+
+function ownDataValue(value, property) {
+  if (!value || (typeof value !== "object" && typeof value !== "function")) {
+    return undefined;
+  }
+  try {
+    const descriptor = Object.getOwnPropertyDescriptor(value, property);
+    return descriptor && Object.hasOwn(descriptor, "value")
+      ? descriptor.value
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
 
 function runtimeUsageObserverFailure(error, code, message) {
   const failure =
@@ -132,6 +153,8 @@ export class SubAgentContext {
    * @param {boolean} [options.memoryEnabled=true] - When false, the child's
    *   context engine suppresses hierarchical-memory recall (contract memory:false)
    * @param {object} [options.llmOptions] - LLM provider/model/key options
+   * @param {string} [options.workflowEffectId] - Durable workflow effect bound
+   *   to provider request identities for this child run
    * @param {string} [options.cwd] - Working directory
    * @param {boolean} [options.useWorktree] - Force worktree isolation (overrides flag)
    * @param {function} [options.onUsageBoundary] - Synchronous observer for
@@ -207,6 +230,11 @@ export class SubAgentContext {
     this._runId = null;
     this._checkpointIds = [];
     this._toolUseIds = [];
+    this._workflowEffectId = options.workflowEffectId ?? null;
+    this._providerRequestAttempts = [];
+    this._providerRequestReceipts = [];
+    this._nestedEffectAttempts = [];
+    this._nestedEffectSettlements = [];
 
     // ── Isolated state ──────────────────────────────────────────────
     // Independent message history — never shared with parent
@@ -547,7 +575,9 @@ export class SubAgentContext {
       }
       return result;
     } catch (err) {
-      if (err?.runtimeLedgerPersistence === true) throw err;
+      if (err?.runtimeLedgerPersistence === true || this._workflowEffectId) {
+        throw err;
+      }
       // If worktree creation fails (e.g. not a git repo), fall back to direct
       this.status = "failed";
       this.completedAt = new Date().toISOString();
@@ -615,6 +645,17 @@ export class SubAgentContext {
     }
     options.toolAdmission = this.toolAdmission;
     options.skillAllowlist = this.skillAllowlist;
+    // A caller cannot replace the durable outer effect through loopOptions.
+    // agentLoop validates the canonical sha256 form before any provider call.
+    if (this._workflowEffectId) {
+      options.workflowEffectId = this._workflowEffectId;
+      options.onProviderRequestBoundary = (event) => {
+        this._recordProviderRequestAttempt(event);
+      };
+    } else {
+      delete options.workflowEffectId;
+      delete options.onProviderRequestBoundary;
+    }
     const authority = this._parentAuthority;
     if (authority.permissionRules) {
       options.permissionRules = authority.permissionRules;
@@ -651,6 +692,22 @@ export class SubAgentContext {
     let observeUsageSettlement = null;
     let observeToolBoundary = null;
     let observeToolSettlement = null;
+    const providerReceiptForSettlement = (event) => {
+      for (
+        let index = this._providerRequestReceipts.length - 1;
+        index >= 0;
+        index -= 1
+      ) {
+        const receipt = this._providerRequestReceipts[index];
+        if (
+          receipt.callId === event?.callId &&
+          (!event?.provider || receipt.provider === event.provider)
+        ) {
+          return { ...receipt };
+        }
+      }
+      return null;
+    };
     if (strictUsageTelemetry) {
       // Presence is checked without invoking either observer. In particular,
       // do not manufacture a null "validation event" that a durable writer
@@ -805,11 +862,29 @@ export class SubAgentContext {
           }
         }
         if (event.type === "tool-executing" && event.tool_use_id) {
+          this._recordNestedEffectAttempt(event);
           const toolUseId = String(event.tool_use_id);
           if (!this._toolUseIds.includes(toolUseId)) {
             this._toolUseIds.push(toolUseId);
           }
         }
+        if (event.type === "provider-request-receipt") {
+          this._providerRequestReceipts.push(
+            Object.freeze({
+              protocol: event.protocol,
+              provider: event.provider,
+              workflowEffectId: event.workflowEffectId,
+              callId: event.callId,
+              callSequence: event.callSequence,
+              source: event.source,
+              clientRequestId: event.clientRequestId,
+              requestId: event.requestId || null,
+              responseId: event.responseId || null,
+              requestIdentitySemantics: event.requestIdentitySemantics,
+              independentlyReadable: event.independentlyReadable,
+            }),
+          );
+        }
 
         if (event.type === "token-usage") {
           const forwardedUsage = {
@@ -819,6 +894,7 @@ export class SubAgentContext {
             model: event.model || null,
             usage: event.usage || null,
             ...(event.source ? { source: event.source } : {}),
+            providerReceipt: providerReceiptForSettlement(event),
             attribution: event.attribution || null,
             ...(event.boundaryNotified === true ||
             event.ledgerPersisted === true
@@ -865,6 +941,9 @@ export class SubAgentContext {
         }
 
         if (event.type === "model-usage-started") {
+          if (event.providerRequestId) {
+            this._recordProviderRequestAttempt(event);
+          }
           if (strictUsageTelemetry) {
             if (
               event.boundaryNotified === true ||
@@ -896,6 +975,7 @@ export class SubAgentContext {
                 ? "semantic-compaction"
                 : "model"),
             code: event.code || "provider_transport_outcome_unknown",
+            providerReceipt: providerReceiptForSettlement(event),
             attribution: event.attribution || null,
             ...(event.boundaryNotified === true ||
             event.ledgerPersisted === true
@@ -932,9 +1012,26 @@ export class SubAgentContext {
         }
 
         if (event.type === "tool-result") {
+          const nestedEffectSettlement =
+            this._recordNestedEffectSettlement(event);
           if (strictUsageTelemetry && event.tool_use_id) {
             observeToolSettlement(event);
           }
+          // A consumer may stop the async generator after this yielded result
+          // because of cancellation or a local token budget. Fence the unknown
+          // here, after the strict settlement observer closes its boundary, so
+          // generator.return() cannot suppress the outer reconciliation signal.
+          if (nestedEffectSettlement?.outcomeUnknown === true) {
+            const error = new Error(
+              `Workflow-bound nested tool ${nestedEffectSettlement.tool} has an unknown outcome and requires reconciliation`,
+            );
+            error.code = "CC_WORKFLOW_NESTED_TOOL_OUTCOME_UNKNOWN";
+            error.workflowEffectOutcomeUnknown = true;
+            error.workflowEffectId = nestedEffectSettlement.workflowEffectId;
+            error.workflowChildEffectId =
+              nestedEffectSettlement.childEffectId;
+            throw error;
+          }
           // Store large tool results as artifacts
           const resultStr = JSON.stringify(event.result);
           // Estimate token count from tool result (~4 chars per token)
@@ -1004,8 +1101,22 @@ export class SubAgentContext {
           "Strict child execution ended with an unsettled provider or tool call",
         );
       }
+      if (
+        this._workflowEffectId &&
+        this._nestedEffectAttempts.length !==
+          this._nestedEffectSettlements.length
+      ) {
+        const error = new Error(
+          "Workflow-bound child execution ended with an unsettled nested effect",
+        );
+        error.code = "CC_WORKFLOW_CHILD_EFFECT_SETTLEMENT_INCOMPLETE";
+        error.workflowEffectOutcomeUnknown = true;
+        throw error;
+      }
     } catch (err) {
-      if (err?.runtimeLedgerPersistence === true) throw err;
+      if (err?.runtimeLedgerPersistence === true || this._workflowEffectId) {
+        throw err;
+      }
       if (this.isAborted()) {
         this.forceComplete(this._cancelReason || "cancelled", {
           partialContent: lastContent,
@@ -1159,11 +1270,166 @@ export class SubAgentContext {
       parentTraceId: this._hookParentTraceId || null,
       checkpointIds: [...this._checkpointIds],
       toolUseIds: [...this._toolUseIds],
+      ...(this._workflowEffectId
+        ? {
+            providerRequestAttempts: this.providerRequestAttempts(),
+            providerRequestReceipts: this.providerRequestReceipts(),
+            nestedEffectAttempts: this.nestedEffectAttempts(),
+            nestedEffectSettlements: this.nestedEffectSettlements(),
+          }
+        : {}),
       worktreeId: worktree?.branch || this._worktreeBranch || null,
       worktreePath: worktree?.path || this._worktreePath || null,
     };
   }
 
+  /**
+   * Effect-bound provider calls admitted before transport dispatch.
+   */
+  providerRequestAttempts() {
+    return this._providerRequestAttempts.map((attempt) => ({ ...attempt }));
+  }
+
+  /**
+   * Provider-returned request identifiers observed during this child run.
+   * Values are copied so callers cannot mutate recovery evidence in place.
+   */
+  providerRequestReceipts() {
+    return this._providerRequestReceipts.map((receipt) => ({ ...receipt }));
+  }
+
+  nestedEffectAttempts() {
+    return this._nestedEffectAttempts.map((attempt) => ({ ...attempt }));
+  }
+
+  nestedEffectSettlements() {
+    return this._nestedEffectSettlements.map((settlement) => ({
+      ...settlement,
+    }));
+  }
+
+  _recordNestedEffectAttempt(event) {
+    if (!this._workflowEffectId) return;
+    const attempt = {
+      protocol: event?.workflowEffectProtocol,
+      workflowEffectId: event?.workflowEffectId,
+      childEffectId: event?.workflowChildEffectId,
+      childSequence: event?.workflowChildSequence,
+      kind: "tool",
+      tool: event?.tool,
+      toolUseId: event?.tool_use_id,
+      identitySemantics: "runtime-derived",
+    };
+    if (
+      attempt.protocol !== WORKFLOW_CHILD_EFFECT_PROTOCOL ||
+      attempt.workflowEffectId !== this._workflowEffectId ||
+      !WORKFLOW_EFFECT_ID_RE.test(attempt.childEffectId || "") ||
+      !Number.isSafeInteger(attempt.childSequence) ||
+      attempt.childSequence < 1 ||
+      !WORKFLOW_TOOL_NAME_RE.test(attempt.tool || "") ||
+      !WORKFLOW_TOOL_CALL_ID_RE.test(attempt.toolUseId || "") ||
+      this._nestedEffectAttempts.some(
+        (existing) =>
+          existing.childEffectId === attempt.childEffectId ||
+          existing.childSequence === attempt.childSequence,
+      )
+    ) {
+      const error = new TypeError(
+        "workflow nested-effect boundary is malformed or duplicated",
+      );
+      error.code = "CC_WORKFLOW_CHILD_EFFECT_BOUNDARY_INVALID";
+      throw error;
+    }
+    this._nestedEffectAttempts.push(Object.freeze(attempt));
+  }
+
+  _recordNestedEffectSettlement(event) {
+    if (!this._workflowEffectId || !event?.workflowChildEffectId) return null;
+    const attempt = this._nestedEffectAttempts.find(
+      (candidate) =>
+        candidate.childEffectId === event.workflowChildEffectId,
+    );
+    const outcomeUnknown = ownDataValue(event.result, "outcomeUnknown") === true;
+    const resultError = ownDataValue(event.result, "error");
+    const mcpLedgerId = ownDataValue(event.result, "mcpLedgerId") ?? null;
+    const settlement = {
+      protocol: event?.workflowEffectProtocol,
+      workflowEffectId: event?.workflowEffectId,
+      childEffectId: event?.workflowChildEffectId,
+      childSequence: event?.workflowChildSequence,
+      kind: "tool",
+      tool: event?.tool,
+      toolUseId: event?.tool_use_id,
+      status: outcomeUnknown
+        ? "outcome_unknown"
+        : event?.error || resultError
+          ? "failed"
+          : "completed",
+      outcomeUnknown,
+      mcpLedgerId,
+      mcpLedgerPrewritePersisted:
+        ownDataValue(event.result, "mcpLedgerPrewritePersisted") === true,
+      mcpLedgerSettlementPersisted:
+        ownDataValue(event.result, "mcpLedgerSettlementPersisted") === true,
+    };
+    if (
+      !attempt ||
+      settlement.protocol !== WORKFLOW_CHILD_EFFECT_PROTOCOL ||
+      settlement.workflowEffectId !== this._workflowEffectId ||
+      settlement.childSequence !== attempt.childSequence ||
+      settlement.tool !== attempt.tool ||
+      settlement.toolUseId !== attempt.toolUseId ||
+      (mcpLedgerId !== null &&
+        !PROVIDER_CALL_ID_RE.test(String(mcpLedgerId))) ||
+      this._nestedEffectSettlements.some(
+        (existing) => existing.childEffectId === settlement.childEffectId,
+      )
+    ) {
+      const error = new TypeError(
+        "workflow nested-effect settlement is malformed or duplicated",
+      );
+      error.code = "CC_WORKFLOW_CHILD_EFFECT_SETTLEMENT_INVALID";
+      error.workflowEffectOutcomeUnknown = true;
+      throw error;
+    }
+    this._nestedEffectSettlements.push(Object.freeze(settlement));
+    return settlement;
+  }
+
+  _recordProviderRequestAttempt(event) {
+    if (!this._workflowEffectId) return;
+    const attempt = {
+      protocol: "cc-provider-request-attempt/v1",
+      provider: event?.provider,
+      workflowEffectId: event?.workflowEffectId,
+      callId: event?.callId,
+      callSequence: event?.callSequence,
+      source: event?.source,
+      clientRequestId: event?.providerRequestId,
+      requestIdentitySemantics: event?.requestIdentitySemantics,
+    };
+    if (
+      !PROVIDER_NAME_RE.test(attempt.provider || "") ||
+      attempt.workflowEffectId !== this._workflowEffectId ||
+      !PROVIDER_CALL_ID_RE.test(attempt.callId || "") ||
+      !Number.isSafeInteger(attempt.callSequence) ||
+      attempt.callSequence < 1 ||
+      !["model", "semantic-compaction"].includes(attempt.source) ||
+      !PROVIDER_CLIENT_REQUEST_ID_RE.test(attempt.clientRequestId || "") ||
+      attempt.requestIdentitySemantics !== "trace-only" ||
+      this._providerRequestAttempts.some(
+        (existing) => existing.callId === attempt.callId,
+      )
+    ) {
+      const error = new TypeError(
+        "workflow provider request boundary is malformed or duplicated",
+      );
+      error.code = "CC_WORKFLOW_PROVIDER_REQUEST_BOUNDARY_INVALID";
+      throw error;
+    }
+    this._providerRequestAttempts.push(Object.freeze(attempt));
+  }
+
   /**
    * True when this sub-agent has been asked to stop — either via an external
    * abort signal or via this context's own `abort()` (precise single-agent

package/src/lib/task-model-selector.js

@@ -24,7 +24,7 @@ export const TaskType = {
  */
 const TASK_MODEL_MAP = {
   [TaskType.CHAT]: {
-    volcengine: "doubao-seed-2-1-pro-260628",
+    volcengine: "deepseek-v4-flash-260425",
     openai: "gpt-4o-mini",
     anthropic: "claude-sonnet-4-6",
     deepseek: "deepseek-chat",

package/src/lib/with-file-lock.js

@@ -88,7 +88,22 @@ export function withFileLock(targetPath, fn, opts = {}) {
       const incumbent = ownerRead.owner;
       acquisitionError = ownerRead.error;
       if (incumbent) {
-        if (!isOwnerAlive(incumbent)) {
+        // The owner writes this exact-token marker only after its critical
+        // section has finished. A Windows sharing violation can then prevent
+        // the final recursive removal while the owner process remains alive,
+        // which would otherwise strand every later strict caller behind a
+        // lock that no longer protects any work. Complete only the release
+        // explicitly published by the still-current owner; a missing,
+        // corrupt or mismatched marker remains fail-closed.
+        const publishedRelease = completePublishedRelease(
+          _fs,
+          lockDir,
+          incumbent,
+          owner,
+          isOwnerAlive,
+        );
+        if (publishedRelease.completed) continue;
+        if (!publishedRelease.published && !isOwnerAlive(incumbent)) {
           if (reclaimOwnedDirectory(_fs, lockDir, incumbent, isOwnerAlive)) {
             continue;
           }
@@ -146,7 +161,7 @@ export function withFileLock(targetPath, fn, opts = {}) {
   let releaseError = null;
   if (held) {
     try {
-      released = releaseOwnedDirectory(_fs, lockDir, owner);
+      released = releaseOwnedDirectory(_fs, lockDir, owner, isOwnerAlive);
     } catch (error) {
       releaseError = error;
     }
@@ -160,8 +175,9 @@ export function withFileLock(targetPath, fn, opts = {}) {
     throw error;
   }
   if (held && released && yieldAfterReleaseMs > 0) {
-    // The lock is already gone. This lets an existing waiter run before a
-    // process performing many tiny transactions can immediately reacquire it.
+    // The lock is gone or its exact release marker has transferred cleanup to
+    // contenders. Let an existing waiter run before a process performing many
+    // tiny transactions can immediately reacquire it.
     _sleep(yieldAfterReleaseMs);
   }
   return result;
@@ -383,7 +399,69 @@ function reclaimLegacyDirectory(_fs, lockDir, stat) {
   return true;
 }
 
-function releaseOwnedDirectory(_fs, lockDir, owner) {
+function completePublishedRelease(_fs, lockDir, owner, claimant, ownerAlive) {
+  const markerPath = path.join(lockDir, `.release-${owner.token}`);
+  if (!sameOwner(readOwner(_fs, markerPath), owner)) {
+    return { published: false, completed: false };
+  }
+  const claimPath = path.join(lockDir, `.release-claim-${owner.token}`);
+  for (;;) {
+    const existingClaim = readOwner(_fs, claimPath);
+    if (existingClaim) {
+      if (sameOwner(existingClaim, claimant)) break;
+      if (!ownerAlive(existingClaim)) {
+        if (removeOwnMarker(_fs, claimPath, existingClaim)) continue;
+      }
+      return { published: true, completed: false };
+    }
+    try {
+      writeOwnerMarker(_fs, claimPath, claimant);
+      break;
+    } catch (error) {
+      if (error?.code === "ENOENT") {
+        return { published: true, completed: !directoryExists(_fs, lockDir) };
+      }
+      if (error?.code === "EEXIST" || isTransientLockError(error)) {
+        return { published: true, completed: false };
+      }
+      throw error;
+    }
+  }
+  if (!sameOwner(readOwner(_fs, path.join(lockDir, "owner.json")), owner)) {
+    removeOwnMarker(_fs, claimPath, claimant);
+    return { published: true, completed: false };
+  }
+  const cleanupDir = `${lockDir}.released-${owner.token}-${claimant.token}`;
+  try {
+    // Detach the exact released directory from the acquisition path before
+    // cleaning it. Recursive removal may span several Windows filesystem
+    // operations; deleting `lockDir` in place lets a new atomic acquirer
+    // install a replacement between those operations and risks deleting that
+    // replacement. The claimant token makes delayed cleanup private to this
+    // handoff, just like the owner's normal rename-first release path.
+    _fs.renameSync(lockDir, cleanupDir);
+    try {
+      _fs.rmSync(cleanupDir, { recursive: true, force: true });
+    } catch {
+      // The acquisition path is already free. A uniquely named released
+      // directory is harmless bounded debris if Windows still holds a handle.
+    }
+    return { published: true, completed: true };
+  } catch (error) {
+    removeOwnMarker(_fs, claimPath, claimant);
+    if (error?.code === "ENOENT") {
+      return { published: true, completed: !directoryExists(_fs, lockDir) };
+    }
+    // A Windows sharing transient leaves the exact release marker in place so
+    // this or another contender can retry within its normal deadline.
+    if (isTransientLockError(error)) {
+      return { published: true, completed: false };
+    }
+    throw error;
+  }
+}
+
+function releaseOwnedDirectory(_fs, lockDir, owner, ownerAlive) {
   if (!sameOwner(readOwner(_fs, path.join(lockDir, "owner.json")), owner)) {
     return false;
   }
@@ -419,6 +497,18 @@ function releaseOwnedDirectory(_fs, lockDir, owner) {
     removeOwnMarker(_fs, markerPath, owner);
     return false;
   }
+  if (typeof _fs.renameSync === "function") {
+    // After publishing the marker, use the same exclusive claim protocol as a
+    // later contender. The releasing process must not perform an unclaimed,
+    // delayed delete: another process could complete the release and install a
+    // replacement lock before that delete resumes.
+    // Publishing the exact release marker is the logical handoff point. A
+    // contender may win the cleanup claim before this owner does; that is a
+    // successful release, not lost ownership, because every acquirer must
+    // complete or wait behind the published marker before entering its body.
+    return completePublishedRelease(_fs, lockDir, owner, owner, ownerAlive)
+      .published;
+  }
   _fs.rmSync(lockDir, { recursive: true, force: true });
   return true;
 }