chainlesschain 0.165.2 → 0.165.4

package/src/commands/session.js

@@ -67,6 +67,7 @@ import { registerSessionMcpRecoveryCommands } from "./session-mcp-recovery.js";
 import { registerSessionShowSubcommand } from "./session-show.js";
 import { registerSessionObservabilitySubcommand } from "./session-observability.js";
 import { registerSessionLocationSubcommands } from "./session-location.js";
+import { registerSessionBudgetCommands } from "./session-budget.js";
 
 export const _deps = {
   execFileSync: (...args) => executionBroker.execFileSync(...args),
@@ -103,8 +104,9 @@ function _sessionEpoch(ts) {
  * @returns {{statusBar:string, autoMerge:{allow:boolean,reason:string,unmet:string[]}, lines:string[]}}
  */
 export async function renderPrStatus(signals = {}, opts = {}) {
-  const { strictAutoMergeDecision, describePrStatusBar } =
-    await import("../lib/pr-automation-policy.js");
+  const { strictAutoMergeDecision, describePrStatusBar } = await import(
+    "../lib/pr-automation-policy.js"
+  );
   const autoMerge = strictAutoMergeDecision({
     enabled: opts.enabled === true,
     hasOpenPr: signals.hasOpenPr,
@@ -224,6 +226,7 @@ export function registerSessionCommand(program) {
 
   registerSessionMcpRecoveryCommands(session);
   registerSessionLocationSubcommands(session);
+  registerSessionBudgetCommands(session);
 
   // session list
   session
@@ -347,22 +350,25 @@ export function registerSessionCommand(program) {
           sourceErrors.local = error?.message || String(error);
         }
         try {
-          const { listBackgroundAgents } =
-            await import("../lib/background-agent-supervisor.js");
+          const { listBackgroundAgents } = await import(
+            "../lib/background-agent-supervisor.js"
+          );
           background = listBackgroundAgents({ all: true });
         } catch (error) {
           sourceErrors.background = error?.message || String(error);
         }
         try {
-          const { readRemoteControlStates } =
-            await import("../lib/remote-control.js");
+          const { readRemoteControlStates } = await import(
+            "../lib/remote-control.js"
+          );
           remote = readRemoteControlStates();
         } catch (error) {
           sourceErrors.remote = error?.message || String(error);
         }
         try {
-          const { listCollaborationRuns } =
-            await import("../lib/collaboration-run-store.js");
+          const { listCollaborationRuns } = await import(
+            "../lib/collaboration-run-store.js"
+          );
           team = listCollaborationRuns({ limit }).filter(
             (run) => run?.kind === "team",
           );
@@ -387,8 +393,9 @@ export function registerSessionCommand(program) {
           // engine proves that the exact worktree is supported. Copy-mode
           // checkpoints need explicit paths and therefore cannot truthfully be
           // offered as a one-click session action.
-          const { isCheckpointAvailable } =
-            await import("../lib/checkpoint-store.js");
+          const { isCheckpointAvailable } = await import(
+            "../lib/checkpoint-store.js"
+          );
           const capability = new Map();
           const decorate = (items, pathFor, sessionFor) =>
             items.map((item) => {
@@ -431,8 +438,10 @@ export function registerSessionCommand(program) {
           // checkpoint action unavailable with its explicit reason.
         }
         try {
-          const { ArtifactStore } = await import("../lib/artifact-store.js");
-          artifacts = new ArtifactStore().list();
+          const { ArtifactStore, publicArtifactMetadata } = await import(
+            "../lib/artifact-store.js"
+          );
+          artifacts = new ArtifactStore().list().map(publicArtifactMetadata);
         } catch {
           // Summaries are optional; absence never removes a session.
         }
@@ -443,8 +452,9 @@ export function registerSessionCommand(program) {
           // Summaries are optional; absence never removes a session.
         }
 
-        const { buildSessionProjection } =
-          await import("../lib/session-projection.js");
+        const { buildSessionProjection } = await import(
+          "../lib/session-projection.js"
+        );
         const projection = buildSessionProjection({
           local,
           background,
@@ -468,8 +478,9 @@ export function registerSessionCommand(program) {
           }
         }
       } catch (error) {
-        const { disconnectedSessionProjection } =
-          await import("../lib/session-projection.js");
+        const { disconnectedSessionProjection } = await import(
+          "../lib/session-projection.js"
+        );
         if (options.json) {
           jsonPayload = JSON.stringify(
             disconnectedSessionProjection(error?.message || String(error)),
@@ -519,8 +530,9 @@ export function registerSessionCommand(program) {
         } else {
           // Live path: resolve the session's linked PR and fetch via gh.
           const { getPrLinks } = await import("../lib/pr-link-ledger.js");
-          const { getLastSessionId } =
-            await import("../harness/jsonl-session-store.js");
+          const { getLastSessionId } = await import(
+            "../harness/jsonl-session-store.js"
+          );
           const sid = !id || id === "last" ? getLastSessionId() : id;
           const links = sid ? getPrLinks(sid) : [];
           if (links.length === 0) {
@@ -598,8 +610,9 @@ export function registerSessionCommand(program) {
         // (single / non-TTY / Ctrl-C). Same helper as `cc agent --resume`.
         if (!id) {
           ctx = await bootstrap({ verbose: program.opts().verbose });
-          const { pickRecentSession } =
-            await import("../lib/session-picker.js");
+          const { pickRecentSession } = await import(
+            "../lib/session-picker.js"
+          );
           const picked = await pickRecentSession(ctx);
           if (!picked.id) {
             logger.error(
@@ -629,8 +642,9 @@ export function registerSessionCommand(program) {
         if (jsonlId) {
           // Tamper gate: a broken hash chain means the transcript was edited
           // outside the store — never silently rebuild it as trusted context.
-          const { verifySession } =
-            await import("../harness/jsonl-session-store.js");
+          const { verifySession } = await import(
+            "../harness/jsonl-session-store.js"
+          );
           const trust = verifySession(jsonlId);
           if (["missing", "conflict"].includes(trust.status)) {
             logger.error(
@@ -743,8 +757,9 @@ export function registerSessionCommand(program) {
           );
         }
         if (sid) {
-          const { renderAgentSessionMarkdown } =
-            await import("../lib/agent-session-export.js");
+          const { renderAgentSessionMarkdown } = await import(
+            "../lib/agent-session-export.js"
+          );
           markdown = renderAgentSessionMarkdown(sid, store.readEvents(sid), {
             exportedAt: new Date().toISOString(),
           });
@@ -997,8 +1012,9 @@ export function registerSessionCommand(program) {
         }
         let result;
         if (jsonlId) {
-          const { renameSession } =
-            await import("../harness/jsonl-session-store.js");
+          const { renameSession } = await import(
+            "../harness/jsonl-session-store.js"
+          );
           result = renameSession(jsonlId, normalized);
         } else {
           ctx = await bootstrap({ verbose: program.opts().verbose });
@@ -1037,8 +1053,9 @@ export function registerSessionCommand(program) {
     .option("--json", "Output as JSON")
     .action(async (options) => {
       try {
-        const { pruneJsonlSessions } =
-          await import("../harness/jsonl-session-store.js");
+        const { pruneJsonlSessions } = await import(
+          "../harness/jsonl-session-store.js"
+        );
         const result = pruneJsonlSessions({
           olderThanDays: Number(options.olderThan),
           keep: options.keep != null ? Number(options.keep) : undefined,
@@ -1416,8 +1433,9 @@ export function registerSessionCommand(program) {
     .option("--json", "Output as JSON")
     .action(async (id, options) => {
       try {
-        const { getApprovalGate } =
-          await import("../lib/session-core-singletons.js");
+        const { getApprovalGate } = await import(
+          "../lib/session-core-singletons.js"
+        );
         const gate = await getApprovalGate();
         if (options.set) {
           gate.setSessionPolicy(id, options.set);
@@ -1453,8 +1471,9 @@ export function registerSessionCommand(program) {
     .option("--json", "Output as JSON")
     .action(async (options) => {
       try {
-        const { getSessionManager } =
-          await import("../lib/session-core-singletons.js");
+        const { getSessionManager } = await import(
+          "../lib/session-core-singletons.js"
+        );
         const mgr = getSessionManager();
         const live = mgr.list({
           agentId: options.agent,
@@ -1498,8 +1517,9 @@ export function registerSessionCommand(program) {
     .argument("<id>", "Session ID")
     .action(async (id) => {
       try {
-        const { getSessionManager } =
-          await import("../lib/session-core-singletons.js");
+        const { getSessionManager } = await import(
+          "../lib/session-core-singletons.js"
+        );
         const mgr = getSessionManager();
         if (!mgr.has(id)) {
           logger.error(`Session ${id} is not active in this process`);
@@ -1524,8 +1544,9 @@ export function registerSessionCommand(program) {
     .argument("<id>", "Session ID")
     .action(async (id) => {
       try {
-        const { getSessionManager } =
-          await import("../lib/session-core-singletons.js");
+        const { getSessionManager } = await import(
+          "../lib/session-core-singletons.js"
+        );
         const mgr = getSessionManager();
         const ok = await mgr.resume(id);
         if (!ok) {
@@ -1554,12 +1575,14 @@ export function registerSessionCommand(program) {
     .option("--agent-id <id>", "Agent id for scope=agent")
     .action(async (id, options) => {
       try {
-        const { getSessionManager } =
-          await import("../lib/session-core-singletons.js");
+        const { getSessionManager } = await import(
+          "../lib/session-core-singletons.js"
+        );
         if (options.consolidate) {
           try {
-            const { consolidateJsonlSession } =
-              await import("../lib/session-consolidator.js");
+            const { consolidateJsonlSession } = await import(
+              "../lib/session-consolidator.js"
+            );
             const res = await consolidateJsonlSession(id, {
               scope: options.scope,
               scopeId: options.scopeId || null,
@@ -1778,8 +1801,9 @@ export function registerSessionCommand(program) {
           );
           process.exit(1);
         }
-        const { sessionUsage, allSessionsUsage } =
-          await import("../lib/session-usage.js");
+        const { sessionUsage, allSessionsUsage } = await import(
+          "../lib/session-usage.js"
+        );
         const result = id
           ? sessionUsage(id)
           : allSessionsUsage({ limit: parseInt(options.limit, 10) || 1000 });
@@ -1852,8 +1876,9 @@ export function registerSessionCommand(program) {
     .option("--json", "Machine-readable JSON output")
     .action(async (id) => {
       try {
-        const { getVerifiedSessionObservabilityAuthority } =
-          await import("../harness/jsonl-session-store.js");
+        const { getVerifiedSessionObservabilityAuthority } = await import(
+          "../harness/jsonl-session-store.js"
+        );
         const authority = getVerifiedSessionObservabilityAuthority(id);
         console.log(
           JSON.stringify(
@@ -2291,8 +2316,9 @@ async function mirrorPruneSessions() {
  * (`session.mirror.encryption`). Requires both to be configured.
  */
 async function mirrorRotateKey() {
-  const { createMirror, createMirrorCipher, rotateMirrorKey } =
-    await import("../harness/session-mirror.js");
+  const { createMirror, createMirrorCipher, rotateMirrorKey } = await import(
+    "../harness/session-mirror.js"
+  );
   const { cfg } = await loadConfiguredMirror();
   if (!cfg || !cfg.kind || cfg.kind === "none") {
     return { target: null };

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.165.4",
+      "cliVersions": ["0.165.3", "0.165.4"],
+      "date": "2026-08-20",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.165.4: first install without a native build toolchain",
+          "body": "> `chainlesschain` **0.165.3 -> 0.165.4** (candidate; not yet published,\n> 2026-08-20).\n> CLI release includes `@chainlesschain/personal-data-hub` **0.4.59**;\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Portable first install**: Personal Data Hub now declares\n  `better-sqlite3-multiple-ciphers` as an optional dependency. If a prebuilt\n  binary cannot be downloaded, npm may skip the failed `node-gyp` fallback\n  instead of aborting `npm install -g chainlesschain`; the CLI remains usable\n  through its bundled `sql.js` WASM fallback.\n- **No-toolchain install gate**: the Windows and Linux global-install smoke\n  deliberately disables native prebuilds and points node-gyp at a nonexistent\n  Python executable. The packed candidate must still install and both `cc` and\n  `chainlesschain` must start without `--ignore-scripts`.\n- **Release status**: this is source-level candidate evidence only. Publication\n  still requires the exact release commit to pass the complete Linux, Windows,\n  and macOS `CLI CI` and `CLI Strict Sandbox` matrices before the coordinated\n  PDH and CLI packages are published and independently read back."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.165.3",
+      "cliVersions": ["0.165.2", "0.165.3"],
+      "date": "2026-08-19",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed — cc CLI 0.165.3: durable background keeper retirement",
+          "body": "> `chainlesschain` **0.165.2 -> 0.165.3** (candidate; not yet published,\n> 2026-08-19).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.58**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Durable keeper retirement evidence**: a Worker accepts a lost keeper\n  response only when the persisted retirement record matches the exact worker\n  generation, turn attempt, process identities, start anchors, and cleanup\n  confirmation. Ambiguous or partial records continue to fail closed.\n- **Bounded keeper health probes**: Windows process-identity checks are delayed\n  until the application heartbeat is actually silent, avoiding synchronized\n  helper-process storms while preserving an exact-identity backstop before\n  cleanup.\n- **Recoverable lock publication**: a lock owned by a provably dead process can\n  be reclaimed even when that owner published its release marker but crashed\n  before removing its private staging path. Active or identity-mismatched\n  owners remain fenced.\n- **Idempotent bootstrap release**: a matching bootstrap release can be replayed\n  after READY, and the Worker retransmits it when READY is repeated. Nonce,\n  generation, attempt, wrapper PID, and runtime PID mismatches remain rejected.\n- **Release status**: immutable tag, final source SHA, workflow run IDs, npm\n  provenance, package digests, and registry readback remain intentionally\n  absent until the exact `0.165.3` candidate passes complete `CLI CI`,\n  `CLI Strict Sandbox`, and the dedicated cross-platform keeper soak, followed\n  by the npm release and independent public readback workflows."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.165.2",

package/src/gateways/ws/artifact-protocol.js

@@ -11,7 +11,8 @@
  *                                                 mime, encoding, content, size,
  *                                                 truncated, previewable}
  *   artifact-remove  {artifactId}              → {type:"artifact-remove", removed, found}
- *   artifact-clean   {}                        → {type:"artifact-clean", removed}
+ *   artifact-clean   {cleanupId?}              → {type:"artifact-clean", cleanupId,
+ *                                                 removed, settled, cleanup}
  *
  * Preview policy: text mimes stream as utf8 (capped, `truncated` flagged);
  * images as base64 (hard cap — an oversized image reports previewable:false
@@ -25,6 +26,10 @@
 
 import path from "node:path";
 import { readFileSync, statSync } from "node:fs";
+import { publicArtifactMetadata } from "../../lib/artifact-store.js";
+import { authorizeArtifactContentAccess } from "../../lib/artifact-access-ledger.js";
+import { settleArtifactDeletion } from "../../lib/artifact-deletion-ledger.js";
+import { settleArtifactCleanup } from "../../lib/artifact-cleanup-ledger.js";
 
 /** Text preview cap (utf8 chars ≈ bytes for the common case). */
 export const TEXT_PREVIEW_CAP = 256 * 1024;
@@ -61,7 +66,11 @@ export async function handleArtifactList(server, id, ws, message) {
     if (message.kind) {
       artifacts = artifacts.filter((e) => e.kind === String(message.kind));
     }
-    server._send(ws, { id, type: "artifact-list", artifacts });
+    server._send(ws, {
+      id,
+      type: "artifact-list",
+      artifacts: artifacts.map(publicArtifactMetadata),
+    });
   } catch (err) {
     sendError(server, id, ws, "ARTIFACT_LIST_FAILED", err.message);
   }
@@ -86,7 +95,7 @@ export async function handleArtifactShow(server, id, ws, message) {
     server._send(ws, {
       id,
       type: "artifact-show",
-      artifact: { ...entry, storedPath: store.storedPath(entry) },
+      artifact: publicArtifactMetadata(entry),
     });
   } catch (err) {
     sendError(server, id, ws, "ARTIFACT_SHOW_FAILED", err.message);
@@ -161,9 +170,17 @@ export async function handleArtifactContent(server, id, ws, message) {
           reason: `image exceeds the ${IMAGE_PREVIEW_CAP} byte preview cap`,
         });
       }
-      const body = readFileSync(storedPath);
+      const authorization = authorizeArtifactContentAccess(store, {
+        artifactId: entry.id,
+        client: "websocket",
+        action: "preview",
+        accessId: message.accessId,
+      });
+      const body = readFileSync(authorization.storedPath);
       return server._send(ws, {
         ...base,
+        access: authorization.access,
+        accessRecorded: authorization.recorded,
         previewable: true,
         encoding: "base64",
         truncated: false,
@@ -172,13 +189,23 @@ export async function handleArtifactContent(server, id, ws, message) {
     }
     // text
     const cap = Math.min(
-      Number(message.maxBytes) > 0 ? Number(message.maxBytes) : TEXT_PREVIEW_CAP,
+      Number(message.maxBytes) > 0
+        ? Number(message.maxBytes)
+        : TEXT_PREVIEW_CAP,
       TEXT_PREVIEW_CAP,
     );
-    const text = readFileSync(storedPath, "utf-8");
+    const authorization = authorizeArtifactContentAccess(store, {
+      artifactId: entry.id,
+      client: "websocket",
+      action: "preview",
+      accessId: message.accessId,
+    });
+    const text = readFileSync(authorization.storedPath, "utf-8");
     const truncated = text.length > cap;
     server._send(ws, {
       ...base,
+      access: authorization.access,
+      accessRecorded: authorization.recorded,
       previewable: true,
       encoding: "utf8",
       truncated,
@@ -195,25 +222,62 @@ export async function handleArtifactRemove(server, id, ws, message) {
       return sendError(server, id, ws, "NO_ARTIFACT_ID", "artifactId required");
     }
     const store = await loadStore();
-    const found = store.remove(message.artifactId);
+    const deletion = settleArtifactDeletion(store, {
+      deletionId: message.deletionId,
+      artifactId: message.artifactId,
+      reason: "explicit",
+      client: "websocket",
+    });
     server._send(ws, {
       id,
       type: "artifact-remove",
       artifactId: message.artifactId,
-      removed: found ? message.artifactId : null,
-      found,
+      deletionId: deletion.deletionId,
+      removed: deletion.found ? message.artifactId : null,
+      found: deletion.found,
+      settled: deletion.settled,
+      recorded: deletion.recorded,
+      deletion: deletion.deletion,
     });
   } catch (err) {
-    sendError(server, id, ws, "ARTIFACT_REMOVE_FAILED", err.message);
+    server._send(ws, {
+      id,
+      type: "error",
+      code: "ARTIFACT_REMOVE_FAILED",
+      message: err.message,
+      deletionId: err.deletionId || message.deletionId || null,
+    });
   }
 }
 
 export async function handleArtifactClean(server, id, ws, message) {
   try {
     const store = await loadStore();
-    const { removed } = store.cleanupExpired();
-    server._send(ws, { id, type: "artifact-clean", removed });
+    const cleanup = settleArtifactCleanup(store, {
+      cleanupId: message.cleanupId,
+      client: "websocket",
+    });
+    server._send(ws, {
+      id,
+      type: "artifact-clean",
+      cleanupId: cleanup.cleanupId,
+      removed: cleanup.removed,
+      removedNow: cleanup.removedNow,
+      alreadyAbsent: cleanup.alreadyAbsent,
+      selected: cleanup.selected,
+      settled: cleanup.settled,
+      recorded: cleanup.recorded,
+      cleanup: cleanup.cleanup,
+      items: cleanup.items,
+    });
   } catch (err) {
-    sendError(server, id, ws, "ARTIFACT_CLEAN_FAILED", err.message);
+    server._send(ws, {
+      id,
+      type: "error",
+      code: "ARTIFACT_CLEAN_FAILED",
+      message: err.message,
+      cleanupId: err.cleanupId || message.cleanupId || null,
+      ...(err.cleanup ? { cleanup: err.cleanup } : {}),
+    });
   }
 }