chainlesschain 0.165.3 → 0.165.5

package/src/commands/session.js

@@ -67,6 +67,7 @@ import { registerSessionMcpRecoveryCommands } from "./session-mcp-recovery.js";
 import { registerSessionShowSubcommand } from "./session-show.js";
 import { registerSessionObservabilitySubcommand } from "./session-observability.js";
 import { registerSessionLocationSubcommands } from "./session-location.js";
+import { registerSessionBudgetCommands } from "./session-budget.js";
 
 export const _deps = {
   execFileSync: (...args) => executionBroker.execFileSync(...args),
@@ -224,6 +225,7 @@ export function registerSessionCommand(program) {
 
   registerSessionMcpRecoveryCommands(session);
   registerSessionLocationSubcommands(session);
+  registerSessionBudgetCommands(session);
 
   // session list
   session
@@ -318,6 +320,7 @@ export function registerSessionCommand(program) {
         let remote = [];
         let team = [];
         let workflow = [];
+        let dynamicWorkflow = [];
         let artifacts = [];
         let prLinks = {};
 
@@ -382,6 +385,22 @@ export function registerSessionCommand(program) {
         } catch (error) {
           sourceErrors.workflow = error?.message || String(error);
         }
+        try {
+          const { listDynamicWorkflowWorkbenchStates } =
+            await import("../lib/dynamic-workflow-runtime.js");
+          const discovered = listDynamicWorkflowWorkbenchStates(projectRoot, {
+            limit,
+          });
+          dynamicWorkflow = discovered.runs.map((item) => ({
+            ...item,
+            cwd: projectRoot,
+          }));
+          if (discovered.invalidCount > 0) {
+            sourceErrors.dynamicWorkflow = `${discovered.invalidCount} durable workflow state file(s) failed validation`;
+          }
+        } catch (error) {
+          sourceErrors.dynamicWorkflow = error?.message || String(error);
+        }
         try {
           // A file checkpoint is advertised only after the existing CLI git
           // engine proves that the exact worktree is supported. Copy-mode
@@ -431,8 +450,9 @@ export function registerSessionCommand(program) {
           // checkpoint action unavailable with its explicit reason.
         }
         try {
-          const { ArtifactStore } = await import("../lib/artifact-store.js");
-          artifacts = new ArtifactStore().list();
+          const { ArtifactStore, publicArtifactMetadata } =
+            await import("../lib/artifact-store.js");
+          artifacts = new ArtifactStore().list().map(publicArtifactMetadata);
         } catch {
           // Summaries are optional; absence never removes a session.
         }
@@ -451,6 +471,7 @@ export function registerSessionCommand(program) {
           remote,
           team,
           workflow,
+          dynamicWorkflow,
           artifacts,
           prLinks,
           sourceErrors,

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.165.5",
+      "cliVersions": ["0.165.4", "0.165.5"],
+      "date": "2026-08-20",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.165.5: governed recovery and native add-on policy",
+          "body": "> `chainlesschain` **0.165.4 -> 0.165.5** (candidate; not yet published,\n> 2026-08-20).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.59**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Recoverable Artifact workflows**: inspect and settle orphaned Artifact\n  writes through a bounded CLI-owned recovery projection, retain exact\n  access/deletion evidence, and surface workbench state without letting IDE\n  clients derive storage mutations.\n- **Durable workflow recovery**: plan and resume interrupted workflow stages\n  through persisted authority and checkpoint evidence, with tighter session\n  and execution-location projections for CLI, WebSocket, and IDE consumers.\n- **Native MCP add-on policy**: admit only supported native loader shapes and\n  validated executable/package identities. Unsupported or ambiguous native\n  add-ons now return typed fail-closed rejections instead of crossing the\n  strict process boundary.\n- **Release-candidate gates**: add cross-host Marketplace, accessibility,\n  execution-location, context/permission, and live-provider campaigns while\n  keeping CI dependency installation clean and deterministic.\n- **Release status**: publication requires this exact candidate commit to pass\n  the complete Linux, Windows, and macOS `CLI CI` and `CLI Strict Sandbox`\n  matrices. The immutable npm tag and registry readback will be recorded only\n  after those gates succeed."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.165.4",
+      "cliVersions": ["0.165.3", "0.165.4"],
+      "date": "2026-08-20",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.165.4: first install without a native build toolchain",
+          "body": "> `chainlesschain` **0.165.3 -> 0.165.4** (published from exact SHA\n> `86abb5f65e39f0dd553040fbfce07277336dfeeb`, 2026-08-20).\n> CLI release includes `@chainlesschain/personal-data-hub` **0.4.59**;\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Portable first install**: Personal Data Hub now declares\n  `better-sqlite3-multiple-ciphers` as an optional dependency. If a prebuilt\n  binary cannot be downloaded, npm may skip the failed `node-gyp` fallback\n  instead of aborting `npm install -g chainlesschain`; the CLI remains usable\n  through its bundled `sql.js` WASM fallback.\n- **No-toolchain install gate**: the Windows and Linux global-install smoke\n  deliberately disables native prebuilds and points node-gyp at a nonexistent\n  Python executable. The packed candidate must still install and both `cc` and\n  `chainlesschain` must start without `--ignore-scripts`.\n- **Published release evidence**: immutable tag `v-npm-0-165-4`, three-OS\n  `CLI CI` (`32375466808`), `CLI Strict Sandbox` (`32375466552`), npm release\n  (`32375466545`), and independent registry readback (`32377326843`) all bind\n  exact SHA `86abb5f65e`. npm reports `latest=0.165.4`; the public tarball\n  SHA-1 is `69ad469872d4e51d1cc2af7223d81eb6fed1dc50`."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.165.3",
@@ -10,7 +36,7 @@
       "sections": [
         {
           "heading": "Fixed — cc CLI 0.165.3: durable background keeper retirement",
-          "body": "> `chainlesschain` **0.165.2 -> 0.165.3** (candidate; not yet published,\n> 2026-08-19).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.58**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Durable keeper retirement evidence**: a Worker accepts a lost keeper\n  response only when the persisted retirement record matches the exact worker\n  generation, turn attempt, process identities, start anchors, and cleanup\n  confirmation. Ambiguous or partial records continue to fail closed.\n- **Bounded keeper health probes**: Windows process-identity checks are delayed\n  until the application heartbeat is actually silent, avoiding synchronized\n  helper-process storms while preserving an exact-identity backstop before\n  cleanup.\n- **Recoverable lock publication**: a lock owned by a provably dead process can\n  be reclaimed even when that owner published its release marker but crashed\n  before removing its private staging path. Active or identity-mismatched\n  owners remain fenced.\n- **Idempotent bootstrap release**: a matching bootstrap release can be replayed\n  after READY, and the Worker retransmits it when READY is repeated. Nonce,\n  generation, attempt, wrapper PID, and runtime PID mismatches remain rejected.\n- **Release status**: immutable tag, final source SHA, workflow run IDs, npm\n  provenance, package digests, and registry readback remain intentionally\n  absent until the exact `0.165.3` candidate passes complete `CLI CI`,\n  `CLI Strict Sandbox`, and the dedicated cross-platform keeper soak, followed\n  by the npm release and independent public readback workflows."
+          "body": "> `chainlesschain` **0.165.2 -> 0.165.3** (published from exact SHA\n> `7d3eb9ea8046330e2b264bf2309337ebbbbcbacc`, 2026-08-19).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.58**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Durable keeper retirement evidence**: a Worker accepts a lost keeper\n  response only when the persisted retirement record matches the exact worker\n  generation, turn attempt, process identities, start anchors, and cleanup\n  confirmation. Ambiguous or partial records continue to fail closed.\n- **Bounded keeper health probes**: Windows process-identity checks are delayed\n  until the application heartbeat is actually silent, avoiding synchronized\n  helper-process storms while preserving an exact-identity backstop before\n  cleanup.\n- **Recoverable lock publication**: a lock owned by a provably dead process can\n  be reclaimed even when that owner published its release marker but crashed\n  before removing its private staging path. Active or identity-mismatched\n  owners remain fenced.\n- **Idempotent bootstrap release**: a matching bootstrap release can be replayed\n  after READY, and the Worker retransmits it when READY is repeated. Nonce,\n  generation, attempt, wrapper PID, and runtime PID mismatches remain rejected.\n- **Release status**: immutable tag `v-npm-0-165-3` and the public npm package\n  bind exact SHA `7d3eb9ea80`. Its push `CLI CI` (`32212502595`),\n  `CLI Strict Sandbox` (`32212502463`), and npm release (`32212502480`) passed;\n  it is now superseded by the fully read-back `0.165.4` production baseline."
         }
       ]
     },
@@ -23,7 +49,7 @@
       "sections": [
         {
           "heading": "Fixed — cc CLI 0.165.2: governed plugins and keeper handoff reliability",
-          "body": "> `chainlesschain` **0.165.1 → 0.165.2** (candidate; not yet published,\n> 2026-08-18).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.58**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Governed plugin transactions and provenance**: marketplace payload,\n  activation, install, update, transaction recovery, and provenance decisions\n  bind immutable source identities and digests. Registry cache entries are\n  content-addressed, while corrupt, stale, or mismatched recovery evidence\n  continues to fail closed.\n- **Strict plugin execution boundaries**: the remaining live plugin fixtures\n  now execute in the strict Linux sandbox, MCP security soak provisions its\n  required Bubblewrap boundary explicitly, and release fixtures exercise the\n  production activation path instead of accepting inactive coverage.\n- **Durable workflow authority**: provider requests and settlements, nested and\n  parallel tool effects, child and descendant calls, and timeout outcomes gain\n  durable identity-bound receipts so retries cannot silently reuse ambiguous\n  execution authority.\n- **Background keeper lock handoff**: an owner that durably publishes its exact\n  release marker treats the marker as the logical handoff even when another\n  contender wins physical cleanup. Wrong, corrupt, or active foreign claimants\n  remain rejected, and POSIX/Windows process identity and cleanup races retain\n  bounded fail-closed handling.\n- **Scheduler campaign continuity**: scheduled long-soak dispatches use a pinned\n  campaign identity, refuse overlapping segments, and can auto-finalize only\n  after the required cross-platform evidence window is complete.\n- **Cross-platform release stability**: generated command help stays in sync;\n  POSIX fsync-failure fixtures match the actual read mode; registry cache tests\n  follow immutable URL-plus-digest semantics; and macOS marketplace replay uses\n  isolated local scope instead of leaking state through the runner user home.\n- **Release status**: immutable tag, final source SHA, workflow run IDs, npm\n  provenance, package digests, and registry readback remain intentionally\n  absent until the final `0.165.2` merge SHA passes complete `CLI CI` and\n  `CLI Strict Sandbox` matrices on Linux, Windows, and macOS, followed by the\n  dedicated npm release and independent public readback workflows. The active\n  two-hour Keeper/reliability runs and the 72-hour scheduler campaign are not\n  claimed as completed release evidence here."
+          "body": "> `chainlesschain` **0.165.1 → 0.165.2** (published from exact SHA\n> `775d5667bc7bdcf8fed3f834d3ba2eda43526128`, 2026-08-18).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.58**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Governed plugin transactions and provenance**: marketplace payload,\n  activation, install, update, transaction recovery, and provenance decisions\n  bind immutable source identities and digests. Registry cache entries are\n  content-addressed, while corrupt, stale, or mismatched recovery evidence\n  continues to fail closed.\n- **Strict plugin execution boundaries**: the remaining live plugin fixtures\n  now execute in the strict Linux sandbox, MCP security soak provisions its\n  required Bubblewrap boundary explicitly, and release fixtures exercise the\n  production activation path instead of accepting inactive coverage.\n- **Durable workflow authority**: provider requests and settlements, nested and\n  parallel tool effects, child and descendant calls, and timeout outcomes gain\n  durable identity-bound receipts so retries cannot silently reuse ambiguous\n  execution authority.\n- **Background keeper lock handoff**: an owner that durably publishes its exact\n  release marker treats the marker as the logical handoff even when another\n  contender wins physical cleanup. Wrong, corrupt, or active foreign claimants\n  remain rejected, and POSIX/Windows process identity and cleanup races retain\n  bounded fail-closed handling.\n- **Scheduler campaign continuity**: scheduled long-soak dispatches use a pinned\n  campaign identity, refuse overlapping segments, and can auto-finalize only\n  after the required cross-platform evidence window is complete.\n- **Cross-platform release stability**: generated command help stays in sync;\n  POSIX fsync-failure fixtures match the actual read mode; registry cache tests\n  follow immutable URL-plus-digest semantics; and macOS marketplace replay uses\n  isolated local scope instead of leaking state through the runner user home.\n- **Release status**: immutable tag `v-npm-0-165-2` and the public npm package\n  bind exact SHA `775d5667bc`. Its `CLI CI` (`32110231013`),\n  `CLI Strict Sandbox` (`32110230842`), and npm release (`32114134884`) passed.\n  Later releases supersede it; the 72-hour scheduler campaign and signed native\n  distribution remain separate evidence boundaries."
         }
       ]
     },

package/src/gateways/ws/artifact-protocol.js

@@ -11,7 +11,8 @@
  *                                                 mime, encoding, content, size,
  *                                                 truncated, previewable}
  *   artifact-remove  {artifactId}              → {type:"artifact-remove", removed, found}
- *   artifact-clean   {}                        → {type:"artifact-clean", removed}
+ *   artifact-clean   {cleanupId?}              → {type:"artifact-clean", cleanupId,
+ *                                                 removed, settled, cleanup}
  *
  * Preview policy: text mimes stream as utf8 (capped, `truncated` flagged);
  * images as base64 (hard cap — an oversized image reports previewable:false
@@ -25,6 +26,10 @@
 
 import path from "node:path";
 import { readFileSync, statSync } from "node:fs";
+import { publicArtifactMetadata } from "../../lib/artifact-store.js";
+import { authorizeArtifactContentAccess } from "../../lib/artifact-access-ledger.js";
+import { settleArtifactDeletion } from "../../lib/artifact-deletion-ledger.js";
+import { settleArtifactCleanup } from "../../lib/artifact-cleanup-ledger.js";
 
 /** Text preview cap (utf8 chars ≈ bytes for the common case). */
 export const TEXT_PREVIEW_CAP = 256 * 1024;
@@ -61,7 +66,11 @@ export async function handleArtifactList(server, id, ws, message) {
     if (message.kind) {
       artifacts = artifacts.filter((e) => e.kind === String(message.kind));
     }
-    server._send(ws, { id, type: "artifact-list", artifacts });
+    server._send(ws, {
+      id,
+      type: "artifact-list",
+      artifacts: artifacts.map(publicArtifactMetadata),
+    });
   } catch (err) {
     sendError(server, id, ws, "ARTIFACT_LIST_FAILED", err.message);
   }
@@ -86,7 +95,7 @@ export async function handleArtifactShow(server, id, ws, message) {
     server._send(ws, {
       id,
       type: "artifact-show",
-      artifact: { ...entry, storedPath: store.storedPath(entry) },
+      artifact: publicArtifactMetadata(entry),
     });
   } catch (err) {
     sendError(server, id, ws, "ARTIFACT_SHOW_FAILED", err.message);
@@ -161,9 +170,17 @@ export async function handleArtifactContent(server, id, ws, message) {
           reason: `image exceeds the ${IMAGE_PREVIEW_CAP} byte preview cap`,
         });
       }
-      const body = readFileSync(storedPath);
+      const authorization = authorizeArtifactContentAccess(store, {
+        artifactId: entry.id,
+        client: "websocket",
+        action: "preview",
+        accessId: message.accessId,
+      });
+      const body = readFileSync(authorization.storedPath);
       return server._send(ws, {
         ...base,
+        access: authorization.access,
+        accessRecorded: authorization.recorded,
         previewable: true,
         encoding: "base64",
         truncated: false,
@@ -172,13 +189,23 @@ export async function handleArtifactContent(server, id, ws, message) {
     }
     // text
     const cap = Math.min(
-      Number(message.maxBytes) > 0 ? Number(message.maxBytes) : TEXT_PREVIEW_CAP,
+      Number(message.maxBytes) > 0
+        ? Number(message.maxBytes)
+        : TEXT_PREVIEW_CAP,
       TEXT_PREVIEW_CAP,
     );
-    const text = readFileSync(storedPath, "utf-8");
+    const authorization = authorizeArtifactContentAccess(store, {
+      artifactId: entry.id,
+      client: "websocket",
+      action: "preview",
+      accessId: message.accessId,
+    });
+    const text = readFileSync(authorization.storedPath, "utf-8");
     const truncated = text.length > cap;
     server._send(ws, {
       ...base,
+      access: authorization.access,
+      accessRecorded: authorization.recorded,
       previewable: true,
       encoding: "utf8",
       truncated,
@@ -195,25 +222,62 @@ export async function handleArtifactRemove(server, id, ws, message) {
       return sendError(server, id, ws, "NO_ARTIFACT_ID", "artifactId required");
     }
     const store = await loadStore();
-    const found = store.remove(message.artifactId);
+    const deletion = settleArtifactDeletion(store, {
+      deletionId: message.deletionId,
+      artifactId: message.artifactId,
+      reason: "explicit",
+      client: "websocket",
+    });
     server._send(ws, {
       id,
       type: "artifact-remove",
       artifactId: message.artifactId,
-      removed: found ? message.artifactId : null,
-      found,
+      deletionId: deletion.deletionId,
+      removed: deletion.found ? message.artifactId : null,
+      found: deletion.found,
+      settled: deletion.settled,
+      recorded: deletion.recorded,
+      deletion: deletion.deletion,
     });
   } catch (err) {
-    sendError(server, id, ws, "ARTIFACT_REMOVE_FAILED", err.message);
+    server._send(ws, {
+      id,
+      type: "error",
+      code: "ARTIFACT_REMOVE_FAILED",
+      message: err.message,
+      deletionId: err.deletionId || message.deletionId || null,
+    });
   }
 }
 
 export async function handleArtifactClean(server, id, ws, message) {
   try {
     const store = await loadStore();
-    const { removed } = store.cleanupExpired();
-    server._send(ws, { id, type: "artifact-clean", removed });
+    const cleanup = settleArtifactCleanup(store, {
+      cleanupId: message.cleanupId,
+      client: "websocket",
+    });
+    server._send(ws, {
+      id,
+      type: "artifact-clean",
+      cleanupId: cleanup.cleanupId,
+      removed: cleanup.removed,
+      removedNow: cleanup.removedNow,
+      alreadyAbsent: cleanup.alreadyAbsent,
+      selected: cleanup.selected,
+      settled: cleanup.settled,
+      recorded: cleanup.recorded,
+      cleanup: cleanup.cleanup,
+      items: cleanup.items,
+    });
   } catch (err) {
-    sendError(server, id, ws, "ARTIFACT_CLEAN_FAILED", err.message);
+    server._send(ws, {
+      id,
+      type: "error",
+      code: "ARTIFACT_CLEAN_FAILED",
+      message: err.message,
+      cleanupId: err.cleanupId || message.cleanupId || null,
+      ...(err.cleanup ? { cleanup: err.cleanup } : {}),
+    });
   }
 }

package/src/gateways/ws/message-dispatcher.js

@@ -76,6 +76,61 @@ async function executeWithIdempotency(server, id, ws, message, stream) {
   return outcome;
 }
 
+/**
+ * Persist a schema-declared secret received over the authenticated WS
+ * connection without ever placing it in a CLI command string or process argv.
+ *
+ * `server._setSecretConfigValue` is an injection seam for focused protocol
+ * tests. Production servers lazily load the same config manager used by
+ * `cc config set-secret`, so desktop web-shell and standalone `cc ui` share
+ * one storage implementation.
+ */
+export async function handleConfigSetSecret(server, id, ws, message) {
+  const key = message?.key;
+  const value = message?.value;
+
+  if (typeof key !== "string" || !key) {
+    server._send(ws, {
+      id,
+      type: "error",
+      code: "CONFIG_SECRET_INVALID_KEY",
+      message: "A schema-declared secret key is required",
+    });
+    return;
+  }
+  if (typeof value !== "string" || value.length === 0) {
+    server._send(ws, {
+      id,
+      type: "error",
+      code: "CONFIG_SECRET_EMPTY",
+      message: "Secret input was empty; configuration was not changed",
+    });
+    return;
+  }
+
+  try {
+    const setSecretConfigValue =
+      server._setSecretConfigValue ||
+      (await import("../../lib/config-manager.js")).setSecretConfigValue;
+    const result = setSecretConfigValue(key, value, { storage: "auto" });
+    server._send(ws, {
+      id,
+      type: "config-set-secret-result",
+      success: true,
+      key,
+      storage: result.storage,
+      backend: result.backend ?? null,
+    });
+  } catch (error) {
+    server._send(ws, {
+      id,
+      type: "error",
+      code: error?.code || "CONFIG_SECRET_WRITE_FAILED",
+      message: error?.message || "Could not save configuration secret",
+    });
+  }
+}
+
 export function createWsMessageDispatcher(server) {
   return {
     async dispatch(clientId, ws, message) {
@@ -123,6 +178,8 @@ export function createWsMessageDispatcher(server) {
         "permission-rules-get": () => server._handlePermissionRulesGet(id, ws),
         "permission-rules-set": () =>
           server._handlePermissionRulesSet(id, ws, message),
+        "config-set-secret": () =>
+          handleConfigSetSecret(server, id, ws, message),
         "slash-command": () => server._handleSlashCommand(id, ws, message),
         "session-answer": () => server._handleSessionAnswer(id, ws, message),
         "remote-session-create": () =>