chainlesschain 0.165.4 → 0.165.6

package/src/commands/session-message.js

@@ -0,0 +1,171 @@
+import { logger } from "../lib/logger.js";
+import { SessionMessageFabric } from "../lib/session-message-fabric.js";
+
+function output(value, options = {}) {
+  if (options.json) {
+    logger.log(JSON.stringify(value, null, 2));
+    return;
+  }
+  if (Array.isArray(value)) {
+    if (value.length === 0) {
+      logger.log("No session messages.");
+      return;
+    }
+    for (const item of value) logger.log(JSON.stringify(item));
+    return;
+  }
+  logger.log(JSON.stringify(value, null, 2));
+}
+
+function numericOption(value) {
+  if (value == null) return null;
+  const number = Number(value);
+  return Number.isSafeInteger(number) && number > 0 ? number : value;
+}
+
+function fabric() {
+  return new SessionMessageFabric();
+}
+
+export function registerSessionMessageCommands(session) {
+  const message = session
+    .command("message")
+    .description(
+      "Durable cross-session inbox, addressing, policy and receipts",
+    );
+
+  message
+    .command("register <session-id>")
+    .description("Register or reconnect a uniquely named session endpoint")
+    .option("--name <name>", "Unique @name (defaults to session id)")
+    .option("--machine <id>", "Stable machine identity", "local")
+    .option(
+      "--policy <policy>",
+      "Inbound policy: accept | hold | refuse",
+      "accept",
+    )
+    .option("--busy", "Register as busy instead of idle")
+    .option("--json", "Output as JSON")
+    .action((sessionId, options) => {
+      output(
+        fabric().register({
+          sessionId,
+          name: options.name || sessionId,
+          machineId: options.machine,
+          policy: options.policy,
+          idle: options.busy !== true,
+        }),
+        options,
+      );
+    });
+
+  message
+    .command("unregister <endpoint>")
+    .description("Retire an endpoint epoch without leaking its inbox to reuse")
+    .option("--json", "Output as JSON")
+    .action((endpoint, options) => {
+      output(
+        { unregistered: fabric().unregister(endpoint), endpoint },
+        options,
+      );
+    });
+
+  message
+    .command("send <from> <to> <body...>")
+    .description("Send one bounded, idempotent message and print its receipt")
+    .option("--subject <text>", "Optional bounded subject")
+    .option("--message-id <id>", "Stable idempotency key")
+    .option("--sequence <n>", "Per sender/recipient ordering sequence")
+    .option("--ttl-ms <n>", "Message expiry in milliseconds")
+    .option(
+      "--notify-when-idle",
+      "Emit one receipt update when target becomes idle",
+    )
+    .option("--json", "Output as JSON")
+    .action((from, to, body, options) => {
+      output(
+        fabric().send({
+          from,
+          to,
+          body: body.join(" "),
+          subject: options.subject,
+          messageId: options.messageId,
+          sequence: numericOption(options.sequence),
+          ttlMs: numericOption(options.ttlMs),
+          notifyWhenIdle: options.notifyWhenIdle === true,
+        }),
+        options,
+      );
+    });
+
+  message
+    .command("inbox <endpoint>")
+    .description("Read an endpoint inbox in sender sequence order")
+    .option("--ack", "Acknowledge and release returned live message bodies")
+    .option("--json", "Output as JSON")
+    .action((endpoint, options) => {
+      output(fabric().inbox(endpoint, { acknowledge: options.ack }), options);
+    });
+
+  message
+    .command("receipts <endpoint>")
+    .description("List durable delivered/refused/full/expired receipts")
+    .option("--json", "Output as JSON")
+    .action((endpoint, options) => {
+      output(fabric().receipts(endpoint), options);
+    });
+
+  message
+    .command("policy <endpoint> <policy>")
+    .description("Set accept, hold or refuse with optional revision CAS")
+    .option("--expected-revision <n>", "Reject a stale rendered policy action")
+    .option("--json", "Output as JSON")
+    .action((endpoint, policy, options) => {
+      output(
+        fabric().setPolicy(endpoint, policy, {
+          expectedRevision: numericOption(options.expectedRevision),
+        }),
+        options,
+      );
+    });
+
+  message
+    .command("idle <endpoint> <state>")
+    .description("Set idle/busy and deliver notify_when_idle exactly once")
+    .option("--expected-revision <n>", "Reject a stale rendered idle action")
+    .option("--json", "Output as JSON")
+    .action((endpoint, state, options) => {
+      const normalized = String(state).trim().toLowerCase();
+      if (!["idle", "busy", "true", "false"].includes(normalized)) {
+        const error = new Error("state must be idle, busy, true or false");
+        error.code = "SESSION_MESSAGE_INVALID_ARGUMENT";
+        throw error;
+      }
+      output(
+        fabric().setIdle(endpoint, ["idle", "true"].includes(normalized), {
+          expectedRevision: numericOption(options.expectedRevision),
+        }),
+        options,
+      );
+    });
+
+  for (const action of ["disconnect", "reconnect"]) {
+    message
+      .command(`${action} <endpoint>`)
+      .description(
+        action === "disconnect"
+          ? "Mark transport offline while retaining its durable inbox"
+          : "Mark a durable endpoint transport online again",
+      )
+      .option("--json", "Output as JSON")
+      .action((endpoint, options) => {
+        output({ endpoint, [action]: fabric()[action](endpoint) }, options);
+      });
+  }
+
+  message
+    .command("status")
+    .description("Emit the bounded CLI-owned message projection")
+    .option("--json", "Output as JSON")
+    .action((options) => output(fabric().projection(), options));
+}

package/src/commands/session.js

@@ -68,6 +68,7 @@ import { registerSessionShowSubcommand } from "./session-show.js";
 import { registerSessionObservabilitySubcommand } from "./session-observability.js";
 import { registerSessionLocationSubcommands } from "./session-location.js";
 import { registerSessionBudgetCommands } from "./session-budget.js";
+import { registerSessionMessageCommands } from "./session-message.js";
 
 export const _deps = {
   execFileSync: (...args) => executionBroker.execFileSync(...args),
@@ -104,9 +105,8 @@ function _sessionEpoch(ts) {
  * @returns {{statusBar:string, autoMerge:{allow:boolean,reason:string,unmet:string[]}, lines:string[]}}
  */
 export async function renderPrStatus(signals = {}, opts = {}) {
-  const { strictAutoMergeDecision, describePrStatusBar } = await import(
-    "../lib/pr-automation-policy.js"
-  );
+  const { strictAutoMergeDecision, describePrStatusBar } =
+    await import("../lib/pr-automation-policy.js");
   const autoMerge = strictAutoMergeDecision({
     enabled: opts.enabled === true,
     hasOpenPr: signals.hasOpenPr,
@@ -227,6 +227,7 @@ export function registerSessionCommand(program) {
   registerSessionMcpRecoveryCommands(session);
   registerSessionLocationSubcommands(session);
   registerSessionBudgetCommands(session);
+  registerSessionMessageCommands(session);
 
   // session list
   session
@@ -321,6 +322,8 @@ export function registerSessionCommand(program) {
         let remote = [];
         let team = [];
         let workflow = [];
+        let dynamicWorkflow = [];
+        let sessionMessageFabric = null;
         let artifacts = [];
         let prLinks = {};
 
@@ -350,25 +353,22 @@ export function registerSessionCommand(program) {
           sourceErrors.local = error?.message || String(error);
         }
         try {
-          const { listBackgroundAgents } = await import(
-            "../lib/background-agent-supervisor.js"
-          );
+          const { listBackgroundAgents } =
+            await import("../lib/background-agent-supervisor.js");
           background = listBackgroundAgents({ all: true });
         } catch (error) {
           sourceErrors.background = error?.message || String(error);
         }
         try {
-          const { readRemoteControlStates } = await import(
-            "../lib/remote-control.js"
-          );
+          const { readRemoteControlStates } =
+            await import("../lib/remote-control.js");
           remote = readRemoteControlStates();
         } catch (error) {
           sourceErrors.remote = error?.message || String(error);
         }
         try {
-          const { listCollaborationRuns } = await import(
-            "../lib/collaboration-run-store.js"
-          );
+          const { listCollaborationRuns } =
+            await import("../lib/collaboration-run-store.js");
           team = listCollaborationRuns({ limit }).filter(
             (run) => run?.kind === "team",
           );
@@ -388,14 +388,29 @@ export function registerSessionCommand(program) {
         } catch (error) {
           sourceErrors.workflow = error?.message || String(error);
         }
+        try {
+          const { listDynamicWorkflowWorkbenchStates } =
+            await import("../lib/dynamic-workflow-runtime.js");
+          const discovered = listDynamicWorkflowWorkbenchStates(projectRoot, {
+            limit,
+          });
+          dynamicWorkflow = discovered.runs.map((item) => ({
+            ...item,
+            cwd: projectRoot,
+          }));
+          if (discovered.invalidCount > 0) {
+            sourceErrors.dynamicWorkflow = `${discovered.invalidCount} durable workflow state file(s) failed validation`;
+          }
+        } catch (error) {
+          sourceErrors.dynamicWorkflow = error?.message || String(error);
+        }
         try {
           // A file checkpoint is advertised only after the existing CLI git
           // engine proves that the exact worktree is supported. Copy-mode
           // checkpoints need explicit paths and therefore cannot truthfully be
           // offered as a one-click session action.
-          const { isCheckpointAvailable } = await import(
-            "../lib/checkpoint-store.js"
-          );
+          const { isCheckpointAvailable } =
+            await import("../lib/checkpoint-store.js");
           const capability = new Map();
           const decorate = (items, pathFor, sessionFor) =>
             items.map((item) => {
@@ -438,9 +453,8 @@ export function registerSessionCommand(program) {
           // checkpoint action unavailable with its explicit reason.
         }
         try {
-          const { ArtifactStore, publicArtifactMetadata } = await import(
-            "../lib/artifact-store.js"
-          );
+          const { ArtifactStore, publicArtifactMetadata } =
+            await import("../lib/artifact-store.js");
           artifacts = new ArtifactStore().list().map(publicArtifactMetadata);
         } catch {
           // Summaries are optional; absence never removes a session.
@@ -451,18 +465,26 @@ export function registerSessionCommand(program) {
         } catch {
           // Summaries are optional; absence never removes a session.
         }
+        try {
+          const { SessionMessageFabric } =
+            await import("../lib/session-message-fabric.js");
+          sessionMessageFabric = new SessionMessageFabric().projection();
+        } catch (error) {
+          sourceErrors.sessionMessageFabric = error?.message || String(error);
+        }
 
-        const { buildSessionProjection } = await import(
-          "../lib/session-projection.js"
-        );
+        const { buildSessionProjection } =
+          await import("../lib/session-projection.js");
         const projection = buildSessionProjection({
           local,
           background,
           remote,
           team,
           workflow,
+          dynamicWorkflow,
           artifacts,
           prLinks,
+          sessionMessageFabric,
           sourceErrors,
         });
         if (options.json) {
@@ -478,9 +500,8 @@ export function registerSessionCommand(program) {
           }
         }
       } catch (error) {
-        const { disconnectedSessionProjection } = await import(
-          "../lib/session-projection.js"
-        );
+        const { disconnectedSessionProjection } =
+          await import("../lib/session-projection.js");
         if (options.json) {
           jsonPayload = JSON.stringify(
             disconnectedSessionProjection(error?.message || String(error)),
@@ -530,9 +551,8 @@ export function registerSessionCommand(program) {
         } else {
           // Live path: resolve the session's linked PR and fetch via gh.
           const { getPrLinks } = await import("../lib/pr-link-ledger.js");
-          const { getLastSessionId } = await import(
-            "../harness/jsonl-session-store.js"
-          );
+          const { getLastSessionId } =
+            await import("../harness/jsonl-session-store.js");
           const sid = !id || id === "last" ? getLastSessionId() : id;
           const links = sid ? getPrLinks(sid) : [];
           if (links.length === 0) {
@@ -610,9 +630,8 @@ export function registerSessionCommand(program) {
         // (single / non-TTY / Ctrl-C). Same helper as `cc agent --resume`.
         if (!id) {
           ctx = await bootstrap({ verbose: program.opts().verbose });
-          const { pickRecentSession } = await import(
-            "../lib/session-picker.js"
-          );
+          const { pickRecentSession } =
+            await import("../lib/session-picker.js");
           const picked = await pickRecentSession(ctx);
           if (!picked.id) {
             logger.error(
@@ -642,9 +661,8 @@ export function registerSessionCommand(program) {
         if (jsonlId) {
           // Tamper gate: a broken hash chain means the transcript was edited
           // outside the store — never silently rebuild it as trusted context.
-          const { verifySession } = await import(
-            "../harness/jsonl-session-store.js"
-          );
+          const { verifySession } =
+            await import("../harness/jsonl-session-store.js");
           const trust = verifySession(jsonlId);
           if (["missing", "conflict"].includes(trust.status)) {
             logger.error(
@@ -757,9 +775,8 @@ export function registerSessionCommand(program) {
           );
         }
         if (sid) {
-          const { renderAgentSessionMarkdown } = await import(
-            "../lib/agent-session-export.js"
-          );
+          const { renderAgentSessionMarkdown } =
+            await import("../lib/agent-session-export.js");
           markdown = renderAgentSessionMarkdown(sid, store.readEvents(sid), {
             exportedAt: new Date().toISOString(),
           });
@@ -1012,9 +1029,8 @@ export function registerSessionCommand(program) {
         }
         let result;
         if (jsonlId) {
-          const { renameSession } = await import(
-            "../harness/jsonl-session-store.js"
-          );
+          const { renameSession } =
+            await import("../harness/jsonl-session-store.js");
           result = renameSession(jsonlId, normalized);
         } else {
           ctx = await bootstrap({ verbose: program.opts().verbose });
@@ -1053,9 +1069,8 @@ export function registerSessionCommand(program) {
     .option("--json", "Output as JSON")
     .action(async (options) => {
       try {
-        const { pruneJsonlSessions } = await import(
-          "../harness/jsonl-session-store.js"
-        );
+        const { pruneJsonlSessions } =
+          await import("../harness/jsonl-session-store.js");
         const result = pruneJsonlSessions({
           olderThanDays: Number(options.olderThan),
           keep: options.keep != null ? Number(options.keep) : undefined,
@@ -1433,9 +1448,8 @@ export function registerSessionCommand(program) {
     .option("--json", "Output as JSON")
     .action(async (id, options) => {
       try {
-        const { getApprovalGate } = await import(
-          "../lib/session-core-singletons.js"
-        );
+        const { getApprovalGate } =
+          await import("../lib/session-core-singletons.js");
         const gate = await getApprovalGate();
         if (options.set) {
           gate.setSessionPolicy(id, options.set);
@@ -1471,9 +1485,8 @@ export function registerSessionCommand(program) {
     .option("--json", "Output as JSON")
     .action(async (options) => {
       try {
-        const { getSessionManager } = await import(
-          "../lib/session-core-singletons.js"
-        );
+        const { getSessionManager } =
+          await import("../lib/session-core-singletons.js");
         const mgr = getSessionManager();
         const live = mgr.list({
           agentId: options.agent,
@@ -1517,9 +1530,8 @@ export function registerSessionCommand(program) {
     .argument("<id>", "Session ID")
     .action(async (id) => {
       try {
-        const { getSessionManager } = await import(
-          "../lib/session-core-singletons.js"
-        );
+        const { getSessionManager } =
+          await import("../lib/session-core-singletons.js");
         const mgr = getSessionManager();
         if (!mgr.has(id)) {
           logger.error(`Session ${id} is not active in this process`);
@@ -1544,9 +1556,8 @@ export function registerSessionCommand(program) {
     .argument("<id>", "Session ID")
     .action(async (id) => {
       try {
-        const { getSessionManager } = await import(
-          "../lib/session-core-singletons.js"
-        );
+        const { getSessionManager } =
+          await import("../lib/session-core-singletons.js");
         const mgr = getSessionManager();
         const ok = await mgr.resume(id);
         if (!ok) {
@@ -1575,14 +1586,12 @@ export function registerSessionCommand(program) {
     .option("--agent-id <id>", "Agent id for scope=agent")
     .action(async (id, options) => {
       try {
-        const { getSessionManager } = await import(
-          "../lib/session-core-singletons.js"
-        );
+        const { getSessionManager } =
+          await import("../lib/session-core-singletons.js");
         if (options.consolidate) {
           try {
-            const { consolidateJsonlSession } = await import(
-              "../lib/session-consolidator.js"
-            );
+            const { consolidateJsonlSession } =
+              await import("../lib/session-consolidator.js");
             const res = await consolidateJsonlSession(id, {
               scope: options.scope,
               scopeId: options.scopeId || null,
@@ -1801,9 +1810,8 @@ export function registerSessionCommand(program) {
           );
           process.exit(1);
         }
-        const { sessionUsage, allSessionsUsage } = await import(
-          "../lib/session-usage.js"
-        );
+        const { sessionUsage, allSessionsUsage } =
+          await import("../lib/session-usage.js");
         const result = id
           ? sessionUsage(id)
           : allSessionsUsage({ limit: parseInt(options.limit, 10) || 1000 });
@@ -1876,9 +1884,8 @@ export function registerSessionCommand(program) {
     .option("--json", "Machine-readable JSON output")
     .action(async (id) => {
       try {
-        const { getVerifiedSessionObservabilityAuthority } = await import(
-          "../harness/jsonl-session-store.js"
-        );
+        const { getVerifiedSessionObservabilityAuthority } =
+          await import("../harness/jsonl-session-store.js");
         const authority = getVerifiedSessionObservabilityAuthority(id);
         console.log(
           JSON.stringify(
@@ -2316,9 +2323,8 @@ async function mirrorPruneSessions() {
  * (`session.mirror.encryption`). Requires both to be configured.
  */
 async function mirrorRotateKey() {
-  const { createMirror, createMirrorCipher, rotateMirrorKey } = await import(
-    "../harness/session-mirror.js"
-  );
+  const { createMirror, createMirrorCipher, rotateMirrorKey } =
+    await import("../harness/session-mirror.js");
   const { cfg } = await loadConfiguredMirror();
   if (!cfg || !cfg.kind || cfg.kind === "none") {
     return { target: null };

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.165.6",
+      "cliVersions": ["0.165.5", "0.165.6"],
+      "date": "2026-08-21",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.165.6: safer remote sessions and governed plugin sources",
+          "body": "> `chainlesschain` **0.165.5 -> 0.165.6** (candidate; not yet published,\n> 2026-08-21).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.59**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Remote Control safe defaults**: direct sessions bind to loopback by\n  default. Trusted-LAN exposure requires explicit command authority, preserves\n  the selected bind address, fails closed on relay/direct fallback, and keeps\n  IDE pairing surfaces from presenting loopback endpoints as phone-ready QR\n  links.\n- **Governed plugin source identity**: managed Marketplace policy now evaluates\n  canonical Git, registry, file, alias, ref, path, host, port, principal, and\n  registry-resolution identities before target I/O or process spawn. Clone\n  execution is isolated from ambient Git/SSH configuration, and cache\n  provenance remains bound to the approved source and registry document.\n- **Digest-pinned Marketplace archives**: registry install and update can\n  materialize same-origin, catalog-bound `tgz`/`tar.gz` sources only after\n  candidate preflight. SHA-256 verification and bounded extraction reject\n  traversal, links, special entries, case collisions, and expansion bombs;\n  archive and extracted-payload digest authority are revalidated for offline\n  cache replay. Dynamic command and headers-helper sources remain disabled by\n  product policy.\n- **Cross-platform policy enforcement**: Windows runner temporary roots are\n  canonicalized without probing caller-controlled targets. Other existing 8.3\n  spellings resolve to their long-path authority, while unresolved or forged\n  aliases remain rejected. Linux, Windows, and macOS Marketplace campaigns\n  exercise air-gapped cache, proxy, PAC, and private-registry boundaries.\n- **Durable session and MCP lifecycle**: cross-session messaging, bounded\n  long-running live state, MCP reconnect subscription recovery, lifecycle\n  compatibility, and structured headless observability now share explicit\n  identity, cleanup, and backpressure contracts.\n- **Focused terminal ergonomics**: the `concise` output style and persisted\n  `classic`/`readline` keybinding flavor extend interactive use without\n  changing existing default behavior.\n- **Release status**: publication requires the final candidate commit to pass\n  the complete Linux, Windows, and macOS `CLI CI` and `CLI Strict Sandbox`\n  matrices. The immutable npm tag, provenance, and registry readback will be\n  recorded only after those exact-SHA gates succeed."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.165.5",
+      "cliVersions": ["0.165.4", "0.165.5"],
+      "date": "2026-08-21",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.165.5: governed recovery and native add-on policy",
+          "body": "> `chainlesschain` **0.165.4 -> 0.165.5** (published from exact SHA\n> `11aef634aa3ab88994698eca0ce2f5cfa65faf48`, 2026-08-21).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.59**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Recoverable Artifact workflows**: inspect and settle orphaned Artifact\n  writes through a bounded CLI-owned recovery projection, retain exact\n  access/deletion evidence, and surface workbench state without letting IDE\n  clients derive storage mutations.\n- **Durable workflow recovery**: plan and resume interrupted workflow stages\n  through persisted authority and checkpoint evidence, with tighter session\n  and execution-location projections for CLI, WebSocket, and IDE consumers.\n- **Native MCP add-on policy**: admit only supported native loader shapes and\n  validated executable/package identities. Unsupported or ambiguous native\n  add-ons now return typed fail-closed rejections instead of crossing the\n  strict process boundary.\n- **Release gates**: add cross-host Marketplace, accessibility,\n  execution-location, context/permission, and live-provider campaigns while\n  keeping CI dependency installation clean and deterministic.\n- **Published release evidence**: immutable tag `v-npm-0-165-5`, three-OS\n  `CLI CI` (`32413582642`), `CLI Strict Sandbox` (`32413582490`), npm release\n  (`32428314006`), and independent registry/provenance readback\n  (`32429710720`) all bind exact SHA `11aef634aa`. npm reports\n  `latest=0.165.5`; the public tarball SHA-1 is\n  `c2cc7fb18ea572749d747de02355c6a0a5aef357`."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.165.4",
@@ -10,7 +36,7 @@
       "sections": [
         {
           "heading": "Fixed - cc CLI 0.165.4: first install without a native build toolchain",
-          "body": "> `chainlesschain` **0.165.3 -> 0.165.4** (candidate; not yet published,\n> 2026-08-20).\n> CLI release includes `@chainlesschain/personal-data-hub` **0.4.59**;\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Portable first install**: Personal Data Hub now declares\n  `better-sqlite3-multiple-ciphers` as an optional dependency. If a prebuilt\n  binary cannot be downloaded, npm may skip the failed `node-gyp` fallback\n  instead of aborting `npm install -g chainlesschain`; the CLI remains usable\n  through its bundled `sql.js` WASM fallback.\n- **No-toolchain install gate**: the Windows and Linux global-install smoke\n  deliberately disables native prebuilds and points node-gyp at a nonexistent\n  Python executable. The packed candidate must still install and both `cc` and\n  `chainlesschain` must start without `--ignore-scripts`.\n- **Release status**: this is source-level candidate evidence only. Publication\n  still requires the exact release commit to pass the complete Linux, Windows,\n  and macOS `CLI CI` and `CLI Strict Sandbox` matrices before the coordinated\n  PDH and CLI packages are published and independently read back."
+          "body": "> `chainlesschain` **0.165.3 -> 0.165.4** (published from exact SHA\n> `86abb5f65e39f0dd553040fbfce07277336dfeeb`, 2026-08-20).\n> CLI release includes `@chainlesschain/personal-data-hub` **0.4.59**;\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Portable first install**: Personal Data Hub now declares\n  `better-sqlite3-multiple-ciphers` as an optional dependency. If a prebuilt\n  binary cannot be downloaded, npm may skip the failed `node-gyp` fallback\n  instead of aborting `npm install -g chainlesschain`; the CLI remains usable\n  through its bundled `sql.js` WASM fallback.\n- **No-toolchain install gate**: the Windows and Linux global-install smoke\n  deliberately disables native prebuilds and points node-gyp at a nonexistent\n  Python executable. The packed candidate must still install and both `cc` and\n  `chainlesschain` must start without `--ignore-scripts`.\n- **Published release evidence**: immutable tag `v-npm-0-165-4`, three-OS\n  `CLI CI` (`32375466808`), `CLI Strict Sandbox` (`32375466552`), npm release\n  (`32375466545`), and independent registry readback (`32377326843`) all bind\n  exact SHA `86abb5f65e`. npm reports `latest=0.165.4`; the public tarball\n  SHA-1 is `69ad469872d4e51d1cc2af7223d81eb6fed1dc50`."
         }
       ]
     },
@@ -23,7 +49,7 @@
       "sections": [
         {
           "heading": "Fixed — cc CLI 0.165.3: durable background keeper retirement",
-          "body": "> `chainlesschain` **0.165.2 -> 0.165.3** (candidate; not yet published,\n> 2026-08-19).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.58**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Durable keeper retirement evidence**: a Worker accepts a lost keeper\n  response only when the persisted retirement record matches the exact worker\n  generation, turn attempt, process identities, start anchors, and cleanup\n  confirmation. Ambiguous or partial records continue to fail closed.\n- **Bounded keeper health probes**: Windows process-identity checks are delayed\n  until the application heartbeat is actually silent, avoiding synchronized\n  helper-process storms while preserving an exact-identity backstop before\n  cleanup.\n- **Recoverable lock publication**: a lock owned by a provably dead process can\n  be reclaimed even when that owner published its release marker but crashed\n  before removing its private staging path. Active or identity-mismatched\n  owners remain fenced.\n- **Idempotent bootstrap release**: a matching bootstrap release can be replayed\n  after READY, and the Worker retransmits it when READY is repeated. Nonce,\n  generation, attempt, wrapper PID, and runtime PID mismatches remain rejected.\n- **Release status**: immutable tag, final source SHA, workflow run IDs, npm\n  provenance, package digests, and registry readback remain intentionally\n  absent until the exact `0.165.3` candidate passes complete `CLI CI`,\n  `CLI Strict Sandbox`, and the dedicated cross-platform keeper soak, followed\n  by the npm release and independent public readback workflows."
+          "body": "> `chainlesschain` **0.165.2 -> 0.165.3** (published from exact SHA\n> `7d3eb9ea8046330e2b264bf2309337ebbbbcbacc`, 2026-08-19).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.58**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Durable keeper retirement evidence**: a Worker accepts a lost keeper\n  response only when the persisted retirement record matches the exact worker\n  generation, turn attempt, process identities, start anchors, and cleanup\n  confirmation. Ambiguous or partial records continue to fail closed.\n- **Bounded keeper health probes**: Windows process-identity checks are delayed\n  until the application heartbeat is actually silent, avoiding synchronized\n  helper-process storms while preserving an exact-identity backstop before\n  cleanup.\n- **Recoverable lock publication**: a lock owned by a provably dead process can\n  be reclaimed even when that owner published its release marker but crashed\n  before removing its private staging path. Active or identity-mismatched\n  owners remain fenced.\n- **Idempotent bootstrap release**: a matching bootstrap release can be replayed\n  after READY, and the Worker retransmits it when READY is repeated. Nonce,\n  generation, attempt, wrapper PID, and runtime PID mismatches remain rejected.\n- **Release status**: immutable tag `v-npm-0-165-3` and the public npm package\n  bind exact SHA `7d3eb9ea80`. Its push `CLI CI` (`32212502595`),\n  `CLI Strict Sandbox` (`32212502463`), and npm release (`32212502480`) passed;\n  it is now superseded by the fully read-back `0.165.4` production baseline."
         }
       ]
     },
@@ -36,7 +62,7 @@
       "sections": [
         {
           "heading": "Fixed — cc CLI 0.165.2: governed plugins and keeper handoff reliability",
-          "body": "> `chainlesschain` **0.165.1 → 0.165.2** (candidate; not yet published,\n> 2026-08-18).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.58**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Governed plugin transactions and provenance**: marketplace payload,\n  activation, install, update, transaction recovery, and provenance decisions\n  bind immutable source identities and digests. Registry cache entries are\n  content-addressed, while corrupt, stale, or mismatched recovery evidence\n  continues to fail closed.\n- **Strict plugin execution boundaries**: the remaining live plugin fixtures\n  now execute in the strict Linux sandbox, MCP security soak provisions its\n  required Bubblewrap boundary explicitly, and release fixtures exercise the\n  production activation path instead of accepting inactive coverage.\n- **Durable workflow authority**: provider requests and settlements, nested and\n  parallel tool effects, child and descendant calls, and timeout outcomes gain\n  durable identity-bound receipts so retries cannot silently reuse ambiguous\n  execution authority.\n- **Background keeper lock handoff**: an owner that durably publishes its exact\n  release marker treats the marker as the logical handoff even when another\n  contender wins physical cleanup. Wrong, corrupt, or active foreign claimants\n  remain rejected, and POSIX/Windows process identity and cleanup races retain\n  bounded fail-closed handling.\n- **Scheduler campaign continuity**: scheduled long-soak dispatches use a pinned\n  campaign identity, refuse overlapping segments, and can auto-finalize only\n  after the required cross-platform evidence window is complete.\n- **Cross-platform release stability**: generated command help stays in sync;\n  POSIX fsync-failure fixtures match the actual read mode; registry cache tests\n  follow immutable URL-plus-digest semantics; and macOS marketplace replay uses\n  isolated local scope instead of leaking state through the runner user home.\n- **Release status**: immutable tag, final source SHA, workflow run IDs, npm\n  provenance, package digests, and registry readback remain intentionally\n  absent until the final `0.165.2` merge SHA passes complete `CLI CI` and\n  `CLI Strict Sandbox` matrices on Linux, Windows, and macOS, followed by the\n  dedicated npm release and independent public readback workflows. The active\n  two-hour Keeper/reliability runs and the 72-hour scheduler campaign are not\n  claimed as completed release evidence here."
+          "body": "> `chainlesschain` **0.165.1 → 0.165.2** (published from exact SHA\n> `775d5667bc7bdcf8fed3f834d3ba2eda43526128`, 2026-08-18).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.58**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Governed plugin transactions and provenance**: marketplace payload,\n  activation, install, update, transaction recovery, and provenance decisions\n  bind immutable source identities and digests. Registry cache entries are\n  content-addressed, while corrupt, stale, or mismatched recovery evidence\n  continues to fail closed.\n- **Strict plugin execution boundaries**: the remaining live plugin fixtures\n  now execute in the strict Linux sandbox, MCP security soak provisions its\n  required Bubblewrap boundary explicitly, and release fixtures exercise the\n  production activation path instead of accepting inactive coverage.\n- **Durable workflow authority**: provider requests and settlements, nested and\n  parallel tool effects, child and descendant calls, and timeout outcomes gain\n  durable identity-bound receipts so retries cannot silently reuse ambiguous\n  execution authority.\n- **Background keeper lock handoff**: an owner that durably publishes its exact\n  release marker treats the marker as the logical handoff even when another\n  contender wins physical cleanup. Wrong, corrupt, or active foreign claimants\n  remain rejected, and POSIX/Windows process identity and cleanup races retain\n  bounded fail-closed handling.\n- **Scheduler campaign continuity**: scheduled long-soak dispatches use a pinned\n  campaign identity, refuse overlapping segments, and can auto-finalize only\n  after the required cross-platform evidence window is complete.\n- **Cross-platform release stability**: generated command help stays in sync;\n  POSIX fsync-failure fixtures match the actual read mode; registry cache tests\n  follow immutable URL-plus-digest semantics; and macOS marketplace replay uses\n  isolated local scope instead of leaking state through the runner user home.\n- **Release status**: immutable tag `v-npm-0-165-2` and the public npm package\n  bind exact SHA `775d5667bc`. Its `CLI CI` (`32110231013`),\n  `CLI Strict Sandbox` (`32110230842`), and npm release (`32114134884`) passed.\n  Later releases supersede it; the 72-hour scheduler campaign and signed native\n  distribution remain separate evidence boundaries."
         }
       ]
     },

package/src/gateways/ws/message-dispatcher.js

@@ -76,6 +76,61 @@ async function executeWithIdempotency(server, id, ws, message, stream) {
   return outcome;
 }
 
+/**
+ * Persist a schema-declared secret received over the authenticated WS
+ * connection without ever placing it in a CLI command string or process argv.
+ *
+ * `server._setSecretConfigValue` is an injection seam for focused protocol
+ * tests. Production servers lazily load the same config manager used by
+ * `cc config set-secret`, so desktop web-shell and standalone `cc ui` share
+ * one storage implementation.
+ */
+export async function handleConfigSetSecret(server, id, ws, message) {
+  const key = message?.key;
+  const value = message?.value;
+
+  if (typeof key !== "string" || !key) {
+    server._send(ws, {
+      id,
+      type: "error",
+      code: "CONFIG_SECRET_INVALID_KEY",
+      message: "A schema-declared secret key is required",
+    });
+    return;
+  }
+  if (typeof value !== "string" || value.length === 0) {
+    server._send(ws, {
+      id,
+      type: "error",
+      code: "CONFIG_SECRET_EMPTY",
+      message: "Secret input was empty; configuration was not changed",
+    });
+    return;
+  }
+
+  try {
+    const setSecretConfigValue =
+      server._setSecretConfigValue ||
+      (await import("../../lib/config-manager.js")).setSecretConfigValue;
+    const result = setSecretConfigValue(key, value, { storage: "auto" });
+    server._send(ws, {
+      id,
+      type: "config-set-secret-result",
+      success: true,
+      key,
+      storage: result.storage,
+      backend: result.backend ?? null,
+    });
+  } catch (error) {
+    server._send(ws, {
+      id,
+      type: "error",
+      code: error?.code || "CONFIG_SECRET_WRITE_FAILED",
+      message: error?.message || "Could not save configuration secret",
+    });
+  }
+}
+
 export function createWsMessageDispatcher(server) {
   return {
     async dispatch(clientId, ws, message) {
@@ -123,6 +178,8 @@ export function createWsMessageDispatcher(server) {
         "permission-rules-get": () => server._handlePermissionRulesGet(id, ws),
         "permission-rules-set": () =>
           server._handlePermissionRulesSet(id, ws, message),
+        "config-set-secret": () =>
+          handleConfigSetSecret(server, id, ws, message),
         "slash-command": () => server._handleSlashCommand(id, ws, message),
         "session-answer": () => server._handleSessionAnswer(id, ws, message),
         "remote-session-create": () =>