chainlesschain 0.165.4 → 0.165.6

package/src/commands/agent.js

@@ -445,7 +445,7 @@ export function registerAgentCommand(program) {
     )
     .option(
       "--output-style <name>",
-      "Apply a named output-style persona (.claude/output-styles/<name>.md or a built-in: explanatory | learning)",
+      "Apply a named output-style persona (.claude/output-styles/<name>.md or a built-in: concise | explanatory | learning)",
     )
     .option(
       "--input-format <fmt>",
@@ -530,7 +530,11 @@ export function registerAgentCommand(program) {
     )
     .option(
       "--remote-control",
-      "Route confirm-tier approvals to paired mobile/web devices — prints a pairing URI/QR. Headless waits for the remote allow/deny (fail-closed on timeout); interactive races the terminal prompt (first answer wins; also /remote-control)",
+      "Route confirm-tier approvals to paired mobile/web devices — requires a relay or explicit LAN opt-in; headless waits fail-closed, interactive races the terminal prompt (also /remote-control)",
+    )
+    .option(
+      "--remote-control-allow-lan",
+      "Permit --remote-control to expose its authenticated WS endpoint on a trusted LAN",
     )
     .option(
       "--channels <list>",
@@ -1383,6 +1387,7 @@ export function registerAgentCommand(program) {
             cwd,
             permissionPromptTool: options.permissionPromptTool || null,
             remoteControl: options.remoteControl === true,
+            remoteControlAllowLan: options.remoteControlAllowLan === true,
             interactiveApprovals: options.interactiveApprovals === true,
             settingsFile: options.settings || null,
             outputStyle: options.outputStyle || null,
@@ -1685,6 +1690,7 @@ export function registerAgentCommand(program) {
           permissionPromptTool: options.permissionPromptTool || null,
           // --remote-control: approvals from paired mobile/web devices
           remoteControl: options.remoteControl === true,
+          remoteControlAllowLan: options.remoteControlAllowLan === true,
           // --strict-mcp-config: only --mcp-config servers (ignore registered + IDE)
           strictMcpConfig: options.strictMcpConfig === true,
           // --settings: extra .claude/settings.json permission rules
@@ -1836,6 +1842,11 @@ export function registerAgentCommand(program) {
         // === false suppresses the auto-loaded rules.md + cc.md/CLAUDE.md block
         // in the REPL's composed system prompt. Absent (undefined) = default-on.
         projectMemory: options.projectMemory,
+        // Output styles and the one-shot settings layer are also consumed by
+        // the interactive REPL. Keep them on the runtime-policy allowlist so
+        // `--output-style concise` and `--settings` are not silently dropped.
+        outputStyle: options.outputStyle || null,
+        settingsFile: options.settings || null,
         // --fallback-model also applies interactively (wrapper built in the
         // REPL). Pass the fully resolved chain (flag + config default).
         fallbackModels: fallbackModels.length ? fallbackModels : null,
@@ -1854,6 +1865,7 @@ export function registerAgentCommand(program) {
         // --remote-control: start the paired-device approval bridge for the
         // interactive session too (terminal prompt races the device).
         remoteControl: options.remoteControl === true,
+        remoteControlAllowLan: options.remoteControlAllowLan === true,
         // --channels: inbound channel listeners (webhook/telegram) whose
         // events become user turns in this session.
         channels: options.channels || null,

package/src/commands/artifacts.js

@@ -33,6 +33,13 @@ import {
   readArtifactCleanupLedger,
   settleArtifactCleanup,
 } from "../lib/artifact-cleanup-ledger.js";
+import {
+  ARTIFACT_RECOVERY_DECISIONS,
+  adjudicateArtifactRecovery,
+  buildArtifactRecoveryPlan,
+  readArtifactOrphanGcLedger,
+} from "../lib/artifact-recovery.js";
+import { buildArtifactWorkbenchProjection } from "../lib/artifact-workbench-projection.js";
 import {
   assessDeliveryEvidence,
   createDeliveryEvidenceRecord,
@@ -167,6 +174,56 @@ export function registerArtifactsCommand(program) {
       process.exitCode = runArtifactsCleanupLog(options);
     });
 
+  cmd
+    .command("recovery-plan")
+    .description(
+      "Inventory pending settlements and orphaned managed copies without mutating them",
+    )
+    .option(
+      "--timeout-ms <ms>",
+      "Age after which a pending settlement is reported as timed out",
+    )
+    .option("--json", "Machine-readable content-free recovery plan")
+    .action((options) => {
+      process.exitCode = runArtifactsRecoveryPlan(options);
+    });
+
+  cmd
+    .command("workbench")
+    .description(
+      "Project artifacts, returned-result lineage, history, and recovery risk for product clients",
+    )
+    .option("--json", "Machine-readable canonical workbench projection")
+    .action((options) => {
+      process.exitCode = runArtifactsWorkbench(options);
+    });
+
+  cmd
+    .command("recovery-adjudicate <item>")
+    .description(
+      "Apply one explicit, plan-bound administrator recovery decision",
+    )
+    .requiredOption("--plan-digest <digest>", "Exact recovery plan digest")
+    .requiredOption(
+      "--decision <decision>",
+      `Decision (${ARTIFACT_RECOVERY_DECISIONS.join("|")})`,
+    )
+    .option("--adjudication-id <id>", "Stable id for response-loss recovery")
+    .option("--approve", "Confirm the reviewed recovery mutation")
+    .option("--json", "Machine-readable adjudication receipt")
+    .action((item, options) => {
+      process.exitCode = runArtifactsRecoveryAdjudicate(item, options);
+    });
+
+  cmd
+    .command("orphan-gc-log")
+    .description("Verify and display the content-free orphan GC ledger")
+    .option("--adjudication <id>", "Only events for one adjudication id")
+    .option("--json", "Machine-readable verified ledger projection")
+    .action((options) => {
+      process.exitCode = runArtifactsOrphanGcLog(options);
+    });
+
   cmd
     .command("select-gates <input>")
     .description(
@@ -612,6 +669,184 @@ export function runArtifactsCleanupLog(options = {}, deps = {}) {
   }
 }
 
+export function runArtifactsRecoveryPlan(options = {}, deps = {}) {
+  const store = deps.store || new ArtifactStore();
+  try {
+    const parsedTimeout =
+      options.timeoutMs == null ? undefined : Number(options.timeoutMs);
+    const plan = (deps.buildArtifactRecoveryPlan || buildArtifactRecoveryPlan)(
+      store,
+      {
+        ...(parsedTimeout == null ? {} : { timeoutMs: parsedTimeout }),
+        ...(deps.recoveryOptions || {}),
+      },
+    );
+    if (options.json) {
+      console.log(JSON.stringify(plan, null, 2));
+    } else if (plan.items.length === 0) {
+      console.log(
+        chalk.dim(`Artifact recovery is clear (${plan.planDigest}).`),
+      );
+    } else {
+      console.log(
+        chalk.yellow(
+          `Artifact recovery requires review: ${plan.summary.itemCount} item(s), ${plan.summary.criticalCount} critical (${plan.planDigest}).`,
+        ),
+      );
+      for (const item of plan.items) {
+        console.log(
+          `${item.severity}\t${item.kind}\t${item.recommendedDecision}\t${item.itemId}`,
+        );
+      }
+    }
+    return plan.summary.itemCount > 0 ? 2 : 0;
+  } catch (error) {
+    if (options.json) {
+      console.error(
+        JSON.stringify({
+          schema: "cc-artifact-recovery-plan-error/v1",
+          verified: false,
+          error: error.message,
+        }),
+      );
+    } else {
+      console.error(
+        chalk.red(`Artifact recovery inventory failed: ${error.message}`),
+      );
+    }
+    return 1;
+  }
+}
+
+export function runArtifactsWorkbench(options = {}, deps = {}) {
+  const store = deps.store || new ArtifactStore();
+  try {
+    const projection = (
+      deps.buildArtifactWorkbenchProjection || buildArtifactWorkbenchProjection
+    )(store, deps.workbenchOptions || {});
+    if (options.json) {
+      console.log(JSON.stringify(projection, null, 2));
+    } else {
+      console.log(
+        `${projection.artifacts.length} artifact(s); ${projection.recovery.summary.itemCount} recovery item(s); ${projection.history.totalEventCount} history event(s).`,
+      );
+      console.log(chalk.dim(projection.recovery.planDigest));
+    }
+    return 0;
+  } catch (error) {
+    if (options.json) {
+      console.error(
+        JSON.stringify({
+          schema: "cc-artifact-workbench-error/v1",
+          verified: false,
+          error: error.message,
+        }),
+      );
+    } else {
+      console.error(
+        chalk.red(`Artifact workbench projection failed: ${error.message}`),
+      );
+    }
+    return 1;
+  }
+}
+
+export function runArtifactsRecoveryAdjudicate(item, options = {}, deps = {}) {
+  const store = deps.store || new ArtifactStore();
+  try {
+    if (options.decision !== "defer" && options.approve !== true) {
+      throw new Error("recovery mutation requires explicit --approve");
+    }
+    const result = (
+      deps.adjudicateArtifactRecovery || adjudicateArtifactRecovery
+    )(
+      store,
+      {
+        itemId: item,
+        planDigest: options.planDigest,
+        decision: options.decision,
+        adjudicationId: options.adjudicationId,
+      },
+      deps.recoveryOptions || {},
+    );
+    if (options.json) {
+      console.log(JSON.stringify(result, null, 2));
+    } else {
+      console.log(
+        result.settled
+          ? chalk.green(
+              `Artifact recovery adjudication ${result.adjudicationId || options.adjudicationId || ""} settled.`,
+            )
+          : chalk.dim("Artifact recovery item was deferred without mutation."),
+      );
+    }
+    return result.settled || options.decision === "defer" ? 0 : 1;
+  } catch (error) {
+    if (options.json) {
+      console.error(
+        JSON.stringify({
+          schema: "cc-artifact-recovery-adjudication-error/v1",
+          itemId: String(item),
+          settled: false,
+          error: error.message,
+        }),
+      );
+    } else {
+      console.error(
+        chalk.red(`Artifact recovery adjudication failed: ${error.message}`),
+      );
+    }
+    return 1;
+  }
+}
+
+export function runArtifactsOrphanGcLog(options = {}, deps = {}) {
+  const store = deps.store || new ArtifactStore();
+  try {
+    const ledger = (
+      deps.readArtifactOrphanGcLedger || readArtifactOrphanGcLedger
+    )(store, deps.recoveryOptions || {});
+    const events = ledger.events.filter(
+      (event) =>
+        !options.adjudication ||
+        event.adjudicationId === String(options.adjudication),
+    );
+    const projection = {
+      ...ledger,
+      filtered: Boolean(options.adjudication),
+      matchedEventCount: events.length,
+      events,
+    };
+    if (options.json) {
+      console.log(JSON.stringify(projection, null, 2));
+    } else if (events.length === 0) {
+      console.log(chalk.dim("No artifact orphan GC settlement events."));
+    } else {
+      for (const event of events) {
+        console.log(
+          `${event.sequence}\t${event.phase}\t${event.outcome}\t${event.adjudicationId}\t${event.eventDigest}`,
+        );
+      }
+    }
+    return 0;
+  } catch (error) {
+    if (options.json) {
+      console.error(
+        JSON.stringify({
+          schema: "cc-artifact-orphan-gc-ledger-error/v1",
+          verified: false,
+          error: error.message,
+        }),
+      );
+    } else {
+      console.error(
+        chalk.red(`Artifact orphan GC log failed: ${error.message}`),
+      );
+    }
+    return 1;
+  }
+}
+
 function readJsonFile(inputPath, deps = {}) {
   const readFileSync = deps.readFileSync || fs.readFileSync;
   return JSON.parse(readFileSync(inputPath, "utf-8"));

package/src/commands/background-session.js

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from "node:fs";
+import { closeSync, openSync, readSync, statSync } from "node:fs";
 import chalk from "chalk";
 import { logger } from "../lib/logger.js";
 import { readPrLinkLedger } from "../lib/pr-link-ledger.js";
@@ -350,22 +350,112 @@ export async function retryBackgroundNeedsInputNotification(
 export const LOG_TRUNCATION_NOTICE =
   "--- log truncated/rotated, resuming from tail ---";
 const TRUNCATION_RESUME_TAIL_BYTES = 4096;
+export const MAX_BACKGROUND_LOG_DELTA_BYTES = 1024 * 1024;
+
+function backgroundLogSize(file) {
+  try {
+    return statSync(file).size;
+  } catch {
+    return null;
+  }
+}
+
+function completeUtf8PrefixLength(buffer) {
+  if (buffer.length === 0) return 0;
+  let leadIndex = buffer.length - 1;
+  let continuationBytes = 0;
+  while (
+    leadIndex >= 0 &&
+    (buffer[leadIndex] & 0xc0) === 0x80 &&
+    continuationBytes < 3
+  ) {
+    continuationBytes += 1;
+    leadIndex -= 1;
+  }
+  if (leadIndex < 0) return buffer.length;
+  const lead = buffer[leadIndex];
+  const expectedBytes =
+    (lead & 0x80) === 0
+      ? 1
+      : (lead & 0xe0) === 0xc0
+        ? 2
+        : (lead & 0xf0) === 0xe0
+          ? 3
+          : (lead & 0xf8) === 0xf0
+            ? 4
+            : 1;
+  return buffer.length - leadIndex < expectedBytes ? leadIndex : buffer.length;
+}
+
+function readBackgroundLogRange(
+  file,
+  start,
+  length,
+  preserveTrailingUtf8 = false,
+) {
+  if (length <= 0) return { text: "", bytesRead: 0 };
+  let fd;
+  try {
+    fd = openSync(file, "r");
+    const buffer = Buffer.allocUnsafe(length);
+    let bytesRead = 0;
+    while (bytesRead < length) {
+      const count = readSync(
+        fd,
+        buffer,
+        bytesRead,
+        length - bytesRead,
+        start + bytesRead,
+      );
+      if (count === 0) break;
+      bytesRead += count;
+    }
+    const completeBytes = preserveTrailingUtf8
+      ? completeUtf8PrefixLength(buffer.subarray(0, bytesRead))
+      : bytesRead;
+    return {
+      text: buffer.subarray(0, completeBytes).toString("utf8"),
+      bytesRead: completeBytes,
+    };
+  } catch {
+    return { text: "", bytesRead: 0 };
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+}
 
 export function readLogFromOffset(file, offset) {
-  if (!existsSync(file)) return { text: "", offset };
-  const text = readFileSync(file, "utf8");
-  if (offset > text.length) {
+  const normalizedOffset = Number.isSafeInteger(offset)
+    ? Math.max(0, offset)
+    : 0;
+  const size = backgroundLogSize(file);
+  if (size === null) return { text: "", offset: normalizedOffset };
+  if (normalizedOffset > size) {
     // Gap 3: the log shrank under us (rotation/truncation). Resetting the
     // offset to 0 used to REPLAY the entire new file into the follow stream;
     // resume from the current tail instead, with an explicit marker.
-    const from = Math.max(0, text.length - TRUNCATION_RESUME_TAIL_BYTES);
+    const from = Math.max(0, size - TRUNCATION_RESUME_TAIL_BYTES);
+    const tail = readBackgroundLogRange(file, from, size - from);
     return {
-      text: `\n${LOG_TRUNCATION_NOTICE}\n${text.slice(from)}`,
-      offset: text.length,
+      text: `\n${LOG_TRUNCATION_NOTICE}\n${tail.text}`,
+      offset: from + tail.bytesRead,
       truncated: true,
     };
   }
-  return { text: text.slice(offset), offset: text.length };
+  const length = Math.min(
+    size - normalizedOffset,
+    MAX_BACKGROUND_LOG_DELTA_BYTES,
+  );
+  const delta = readBackgroundLogRange(
+    file,
+    normalizedOffset,
+    length,
+    normalizedOffset + length < size,
+  );
+  return {
+    text: delta.text,
+    offset: normalizedOffset + delta.bytesRead,
+  };
 }
 
 /** Content-free JSONL authority exposed at the real background attach seam. */
@@ -390,7 +480,7 @@ async function followBackgroundAgent(id, options = {}) {
   const initial = readBackgroundAgentLog(id, { lines });
   if (initial)
     process.stdout.write(initial.endsWith("\n") ? initial : `${initial}\n`);
-  let offset = existsSync(logFile) ? readFileSync(logFile, "utf8").length : 0;
+  let offset = backgroundLogSize(logFile) ?? 0;
 
   if (options.follow === false || state.status !== "running") {
     return state;
@@ -597,7 +687,7 @@ export async function interactiveAttach(id, state, options = {}) {
   if (initial)
     process.stdout.write(initial.endsWith("\n") ? initial : `${initial}\n`);
   const logFile = logPath(id);
-  let offset = existsSync(logFile) ? readFileSync(logFile, "utf8").length : 0;
+  let offset = backgroundLogSize(logFile) ?? 0;
   logger.log(
     chalk.gray(
       `Attached to ${id} (interactive). Type a prompt to continue the session; /stop · /status · Ctrl-C detaches.`,