chainlesschain 0.165.5 → 0.165.8

package/src/runtime/agent-core.js

@@ -136,6 +136,7 @@ import {
 } from "../harness/structured-handoff.js";
 import { isMcpRpcError } from "../harness/mcp-client.js";
 import { projectCanonicalResumeMessages } from "../lib/session-message-provenance.js";
+import { releaseOldLiveSessionResults } from "../lib/session-runtime-retention.js";
 import {
   pathMatchesOpenedFileIdentitySync,
   sameOpenedFileIdentity,
@@ -515,6 +516,45 @@ export const _gitProcessDeps = {
   run: gitProcessRunner,
 };
 
+function canonicalGitMetadataPath(value) {
+  const resolved = path.resolve(String(value || "").trim());
+  try {
+    const real = fs.realpathSync.native(resolved);
+    return process.platform === "win32" ? real.toLowerCase() : real;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Distinguish the primary checkout from a linked worktree using Git's own
+ * metadata paths. Unknown/non-repository locations are deliberately not
+ * treated as linked worktrees.
+ */
+export function classifyGitCheckout(cwd) {
+  const query = (argument) => {
+    const result = _gitProcessDeps.run(
+      "git",
+      ["rev-parse", "--path-format=absolute", argument],
+      {
+        cwd,
+        encoding: "utf8",
+        timeout: 10000,
+        windowsHide: true,
+        origin: "agent-core:git-checkout-authority",
+        policy: "allow",
+        scope: "agent-core",
+      },
+    );
+    if (result?.error || result?.status !== 0) return null;
+    return canonicalGitMetadataPath(result.stdout);
+  };
+  const gitDirectory = query("--git-dir");
+  const commonDirectory = query("--git-common-dir");
+  if (!gitDirectory || !commonDirectory) return "unknown";
+  return gitDirectory === commonDirectory ? "primary" : "linked";
+}
+
 function _killTask(task) {
   const child = task?.child;
   if (!child || child.killed || task?.status !== "running") return false;
@@ -918,6 +958,8 @@ async function requestInteractivePermission(
         args && typeof args === "object" ? Object.keys(args).sort() : [],
       reason: confirmArgs?.reason || null,
       cwd,
+      trace_id: context.hookTraceId || null,
+      parent_id: context.hookParentId || null,
     },
     { failClosed: true },
   );
@@ -3252,25 +3294,35 @@ export async function executeTool(name, args, context = {}) {
   // command unguarded in auto mode — including `reset --hard`, `clean -fd`,
   // `restore .`, `push --force`, `branch -D`, `rebase`, `reflog expire` —
   // which irrecoverably discard work. An explicit settings `allow`/confirmed
-  // `ask` (ruleAllowed) pre-authorizes; headless without a confirmer fails
-  // closed. Plan mode already blocks non-read-only git below.
+  // A confirmed `ask` pre-authorizes. A static `allow` only pre-authorizes a
+  // linked worktree; primary/unknown checkout identity still needs a live
+  // confirmation. Plan mode already blocks non-read-only git below.
   if (
     name === "git" &&
-    !ruleAllowed &&
     !planManager.isActive() &&
     isDangerousGitCommand(args?.command)
   ) {
-    const ok = await requestInteractivePermission(name, args, context, cwd, {
-      tool: name,
-      args,
-      rule: null,
-      reason: `destructive git command: git ${normalizeGitCommand(args.command)}`,
-    });
-    if (!ok) {
-      return {
-        error: `[Destructive Git] "git ${normalizeGitCommand(args.command)}" discards work irrecoverably and requires confirmation — denied. Add a settings allow rule to pre-authorize.`,
-        policy: { decision: "ask", via: "destructive-git" },
-      };
+    const checkout = classifyGitCheckout(args?.cwd || cwd);
+    const settingsAskWasConfirmed =
+      settingsVerdict.decision === "ask" && ruleAllowed;
+    const linkedWorktreeWasAllowed = checkout === "linked" && ruleAllowed;
+    if (!settingsAskWasConfirmed && !linkedWorktreeWasAllowed) {
+      const ok = await requestInteractivePermission(name, args, context, cwd, {
+        tool: name,
+        args,
+        rule: null,
+        reason: `destructive git command in ${checkout} checkout: git ${normalizeGitCommand(args.command)}`,
+      });
+      if (!ok) {
+        return {
+          error: `[Destructive Git] "git ${normalizeGitCommand(args.command)}" targets the ${checkout} checkout, discards work irrecoverably, and requires live confirmation — denied.`,
+          policy: {
+            decision: "ask",
+            via: "destructive-git",
+            checkout,
+          },
+        };
+      }
     }
   }
 
@@ -3508,6 +3560,8 @@ export async function executeTool(name, args, context = {}) {
         input_keys:
           args && typeof args === "object" ? Object.keys(args).sort() : [],
         cwd,
+        trace_id: context.hookTraceId || null,
+        parent_id: context.hookParentId || null,
       },
       { failClosed: true },
     );
@@ -3659,6 +3713,7 @@ export async function executeTool(name, args, context = {}) {
       subAgentDepth: context.subAgentDepth || 0,
       subAgentBudget: context.subAgentBudget || null,
       sessionBudget: context.sessionBudget || null,
+      hostResourceBudget: context.hostResourceBudget || null,
       // Effective contract of THIS loop (parent ceiling for a nested spawn) +
       // the MCP tool definitions this loop exposes (inheritable by a spawn).
       subAgentContract: context.subAgentContract || null,
@@ -3675,6 +3730,15 @@ export async function executeTool(name, args, context = {}) {
       managedCheckpoint: context.managedCheckpoint === true,
       fileMutationScope: context.fileMutationScope || null,
       hermeticExecution: context.hermeticExecution === true,
+      browserEvidenceBinding: context.browserEvidenceBinding || null,
+      browserOriginGrants: context.browserOriginGrants || null,
+      browserExpectedGrantRevisions:
+        context.browserExpectedGrantRevisions || null,
+      browserReplaySourceEnvelope: context.browserReplaySourceEnvelope || null,
+      browserReplayAllowSideEffects:
+        context.browserReplayAllowSideEffects === true,
+      browserReplayAllowCredentials:
+        context.browserReplayAllowCredentials === true,
     });
   } catch (err) {
     if (
@@ -4756,9 +4820,9 @@ async function filterSkillsByCwd(skills, cwd) {
   }
 }
 
-async function promoteBrowserScreenshot(
+async function promoteBrowserGeneratedArtifact(
   filePath,
-  { sessionId = null, title = "Browser screenshot" } = {},
+  { sessionId = null, title, kind, failureLabel } = {},
 ) {
   if (!filePath) return { artifact: null, error: null };
   try {
@@ -4767,7 +4831,7 @@ async function promoteBrowserScreenshot(
     const entry = new ArtifactStore().publish({
       filePath,
       title,
-      kind: "screenshot",
+      kind,
       sessionId: sessionId ? String(sessionId) : null,
     });
     return { artifact: publicArtifactMetadata(entry), error: null };
@@ -4778,7 +4842,7 @@ async function promoteBrowserScreenshot(
         : "";
     return {
       artifact: null,
-      error: `browser screenshot artifact publication failed${code ? ` (${code})` : ""}`,
+      error: `${failureLabel} artifact publication failed${code ? ` (${code})` : ""}`,
     };
   } finally {
     try {
@@ -4789,6 +4853,155 @@ async function promoteBrowserScreenshot(
   }
 }
 
+async function promoteBrowserScreenshot(
+  filePath,
+  { sessionId = null, title = "Browser screenshot" } = {},
+) {
+  return promoteBrowserGeneratedArtifact(filePath, {
+    sessionId,
+    title,
+    kind: "screenshot",
+    failureLabel: "browser screenshot",
+  });
+}
+
+async function promoteBrowserDownload(
+  filePath,
+  { sessionId = null, title = "Browser download" } = {},
+) {
+  return promoteBrowserGeneratedArtifact(filePath, {
+    sessionId,
+    title,
+    kind: "data",
+    failureLabel: "browser download",
+  });
+}
+
+async function publishBrowserEvidence(envelope, sessionId) {
+  if (!envelope?.envelopeDigest) return { artifact: null, error: null };
+  try {
+    const { ArtifactStore, publicArtifactMetadata } =
+      await import("../lib/artifact-store.js");
+    const {
+      browserEvidenceDigest,
+      canonicalBrowserEvidenceJson,
+      verifyBrowserEvidenceEnvelope,
+    } = await import("../lib/browser-evidence.js");
+    verifyBrowserEvidenceEnvelope(envelope);
+    if (!sessionId || String(sessionId) !== envelope.binding.session.id) {
+      throw new Error("browser evidence is not bound to the active session");
+    }
+    const data = `${canonicalBrowserEvidenceJson(envelope)}\n`;
+    const expectedFileDigest = browserEvidenceDigest(data).slice(
+      "sha256:".length,
+    );
+    const expectedLineage = {
+      schema: envelope.schema,
+      sessionId: envelope.binding.session.id,
+      sessionRevision: envelope.binding.session.revision,
+      diffDigest: envelope.binding.diff.digest,
+      testRunId: envelope.binding.testRun.id,
+    };
+    const store = new ArtifactStore();
+    const published = store.publishDataOnce({
+      data,
+      fileName: "browser-evidence-envelope.json",
+      title: `Browser evidence ${envelope.binding.session.id}@${envelope.binding.session.revision}`,
+      kind: "data",
+      mime: "application/json",
+      sessionId: String(sessionId),
+      immutable: true,
+      recordDigest: envelope.envelopeDigest,
+      lineage: expectedLineage,
+    });
+    const entry = published.entry;
+    const integrity = store.verifyIntegrity(entry);
+    if (
+      !integrity.ok ||
+      entry.sessionId !== String(sessionId) ||
+      entry.immutable !== true ||
+      entry.recordDigest !== envelope.envelopeDigest ||
+      entry.sha256 !== expectedFileDigest ||
+      canonicalBrowserEvidenceJson(entry.lineage) !==
+        canonicalBrowserEvidenceJson(expectedLineage)
+    ) {
+      throw new Error("persisted evidence authority failed verification");
+    }
+    return {
+      artifact: publicArtifactMetadata(entry),
+      error: null,
+    };
+  } catch (error) {
+    const code =
+      typeof error?.code === "string"
+        ? error.code.replace(/[^A-Z0-9_-]/giu, "").slice(0, 40)
+        : "";
+    return {
+      artifact: null,
+      error: `browser evidence artifact publication failed${code ? ` (${code})` : ""}`,
+    };
+  }
+}
+
+async function resolveBrowserUploadArtifact(artifactId, sessionId) {
+  const { ArtifactStore, publicArtifactMetadata } =
+    await import("../lib/artifact-store.js");
+  const store = new ArtifactStore();
+  return store.withIndexSnapshot((entries) => {
+    const matches = entries.filter((entry) => entry.id === artifactId);
+    if (matches.length !== 1) {
+      throw new Error(
+        matches.length === 0
+          ? "upload artifact was not found"
+          : "upload artifact authority is ambiguous",
+      );
+    }
+    const entry = matches[0];
+    if (!sessionId || entry.sessionId !== String(sessionId)) {
+      throw new Error("upload artifact is not bound to the active session");
+    }
+    if (
+      typeof entry.file !== "string" ||
+      path.basename(entry.file) !== entry.file ||
+      !(entry.file === entry.id || entry.file.startsWith(`${entry.id}.`)) ||
+      !/^[a-f0-9]{64}$/u.test(String(entry.sha256 || ""))
+    ) {
+      throw new Error("upload artifact storage authority is invalid");
+    }
+    const integrity = store.verifyIntegrity(entry);
+    if (!integrity.ok) {
+      throw new Error("upload artifact failed digest verification");
+    }
+    const storedPath = store.storedPath(entry);
+    if (fs.statSync(storedPath).size !== Number(entry.size)) {
+      throw new Error("upload artifact size authority mismatch");
+    }
+    const temporaryDirectory = fs.mkdtempSync(
+      path.join(os.tmpdir(), "cc-browser-upload-"),
+    );
+    const temporaryPath = path.join(
+      temporaryDirectory,
+      path.basename(entry.file || "upload.bin"),
+    );
+    try {
+      fs.writeFileSync(temporaryPath, fs.readFileSync(storedPath), {
+        flag: "wx",
+        mode: 0o600,
+        flush: true,
+      });
+    } catch (error) {
+      fs.rmSync(temporaryDirectory, { recursive: true, force: true });
+      throw error;
+    }
+    return {
+      path: temporaryPath,
+      metadata: publicArtifactMetadata(entry),
+      cleanup: () =>
+        fs.rmSync(temporaryDirectory, { recursive: true, force: true }),
+    };
+  });
+}
+
 const MCP_LEDGER_EFFECTS = new Set(["read", "unknown", "write", "destructive"]);
 
 /**
@@ -5053,10 +5266,17 @@ async function executeToolInner(
     onToolCallSettlement = null,
     backgroundUsageFailureState = null,
     toolAdmission = null,
+    hostResourceBudget = null,
     unattendedActionPolicy = null,
     managedCheckpoint = false,
     fileMutationScope = null,
     hermeticExecution = false,
+    browserEvidenceBinding = null,
+    browserOriginGrants = null,
+    browserExpectedGrantRevisions = null,
+    browserReplaySourceEnvelope = null,
+    browserReplayAllowSideEffects = false,
+    browserReplayAllowCredentials = false,
     // Hook-envelope tracing: this run's trace id, threaded into child loops
     // (spawn_sub_agent / isolated run_skill) as their parent_id.
     hookTraceId = null,
@@ -6775,6 +6995,7 @@ async function executeToolInner(
           subAgentDepth,
           subAgentBudget,
           sessionBudget,
+          hostResourceBudget,
           subAgentContract,
           settingsHooks,
           // Immutable parent execution authority. The child may only tighten
@@ -6839,6 +7060,7 @@ async function executeToolInner(
           maxBytes: args.maxBytes,
           timeout: args.timeout,
           config: webFetchConfig,
+          hostResourceBudget,
         });
         return attachDescriptor(result);
       } catch (err) {
@@ -6866,6 +7088,7 @@ async function executeToolInner(
           maxResults: args.maxResults,
           timeout: args.timeout,
           config: webSearchConfig,
+          hostResourceBudget,
         });
         return attachDescriptor(result);
       } catch (err) {
@@ -7331,6 +7554,14 @@ async function executeToolInner(
           tab: args.tab != null ? Number(args.tab) : undefined,
           continueOnError: args.continue_on_error === true,
           sessionId: sessionId ? String(sessionId) : null,
+          evidenceBinding: browserEvidenceBinding,
+          originGrants: browserOriginGrants,
+          expectedGrantRevisions: browserExpectedGrantRevisions,
+          replaySourceEnvelope: browserReplaySourceEnvelope,
+          replayAllowSideEffects: browserReplayAllowSideEffects,
+          replayAllowCredentials: browserReplayAllowCredentials,
+          resolveUploadArtifact: (artifactId) =>
+            resolveBrowserUploadArtifact(artifactId, sessionId),
         });
         if (!result.ok && result.error) {
           // Nothing ran (validation / attach failure) — surface as an error.
@@ -7363,8 +7594,45 @@ async function executeToolInner(
               step.detail = promoted.error;
             }
           }
+          if (originalStep.downloadPath) {
+            const promoted = await promoteBrowserDownload(
+              originalStep.downloadPath,
+              {
+                sessionId,
+                title: `Browser download ${i + 1} — ${originalStep.downloadSuggestedName || "file"}`,
+              },
+            );
+            delete step.downloadPath;
+            delete step.downloadRef;
+            if (promoted.artifact) {
+              step.downloadArtifact = promoted.artifact;
+              step.downloadRef = promoted.artifact.id;
+              step.detail = `download artifact: ${promoted.artifact.id}`;
+            } else {
+              step.downloadArtifactError = promoted.error;
+              step.detail = promoted.error;
+            }
+          }
           safeResult.steps.push(step);
         }
+        if (result.evidence) {
+          const publishedEvidence = await publishBrowserEvidence(
+            result.evidence,
+            sessionId,
+          );
+          safeResult.evidence = result.evidence;
+          if (publishedEvidence.artifact) {
+            safeResult.evidenceArtifact = publishedEvidence.artifact;
+            safeResult.evidenceRef = publishedEvidence.artifact.id;
+          } else {
+            safeResult.evidenceArtifactError = publishedEvidence.error;
+            safeResult.evidencePublicationFailed = true;
+            safeResult.ok = false;
+            safeResult.retrySafe = false;
+            safeResult.recovery =
+              "Browser actions may have completed, but canonical evidence publication failed; do not retry side effects automatically.";
+          }
+        }
         return attachDescriptor(safeResult);
       } catch (err) {
         return attachDescriptor({
@@ -7797,6 +8065,7 @@ async function executeToolInner(
               ? { workflowEffectId: workflowChildEffectId }
               : {}),
             ...(sessionBudget ? { sessionBudget } : {}),
+            ...(hostResourceBudget ? { hostResourceBudget } : {}),
             ...(permissionRules ? { permissionRules } : {}),
             ...(hostManagedToolPolicy
               ? {
@@ -9612,6 +9881,10 @@ async function _executeSpawnSubAgent(args, ctx) {
   const subLlmOptions = {
     ...parentLlm,
     model: mdModel || parentLlm.model || undefined,
+    // Preserve the host's optional event channel across every nesting level.
+    // It is observational only: child hooks/tools must never depend on a
+    // headless consumer being connected.
+    ...(interaction ? { interaction } : {}),
     // Contract `effort` is a compute hint (reasoning level), not authority —
     // forwarded to the child loop; harmless if the provider ignores it.
     ...(effectiveContract?.effort ? { effort: effectiveContract.effort } : {}),
@@ -9819,7 +10092,21 @@ async function _executeSpawnSubAgent(args, ctx) {
     // single total-sub-agent pool (breadth cap spans the whole tree).
     subAgentBudget: ctx.subAgentBudget || null,
     ...(ctx.sessionBudget ? { sessionBudget: ctx.sessionBudget } : {}),
+    ...(ctx.hostResourceBudget
+      ? { hostResourceBudget: ctx.hostResourceBudget }
+      : {}),
     onUsage,
+    ...(interaction && typeof interaction.emit === "function"
+      ? {
+          onProgress: (progress) =>
+            emit("sub-agent.progress", {
+              event_type: progress?.type || "unknown",
+              tool: progress?.tool || null,
+              iteration_count: progress?.iterationCount || 0,
+              token_count: progress?.tokenCount || 0,
+            }),
+        }
+      : {}),
     ...(ctx.strictUsageTelemetry === true
       ? {
           strictUsageTelemetry: true,
@@ -12571,6 +12858,7 @@ async function _settleAutomaticCompaction({
   compacted,
   stats,
   options,
+  trigger = "auto",
 }) {
   if (!_sameMessageSnapshot(messages, liveExpectedMessages)) {
     throw _compactionSettlementError(
@@ -12590,7 +12878,7 @@ async function _settleAutomaticCompaction({
     settlement = options.onCompaction(stats, compacted, {
       expectedMessages: authorityExpectedMessages,
       liveExpectedMessages,
-      trigger: "auto",
+      trigger,
     });
   } else if (options.sessionId && options.persistCompaction !== false) {
     const store = await import("../harness/jsonl-session-store.js");
@@ -12605,7 +12893,7 @@ async function _settleAutomaticCompaction({
         options.sessionId,
         {
           ...stats,
-          trigger: "auto",
+          trigger,
           messages: projectCanonicalResumeMessages(compacted, { strict: true }),
         },
         authorityExpectedMessages,
@@ -12728,6 +13016,9 @@ export async function* agentLoop(messages, options) {
   const { IterationBudget, WarningLevel } =
     await import("../lib/iteration-budget.js");
   const budget = options.iterationBudget || new IterationBudget();
+  const { HostResourceBudget } = await import("../lib/host-resource-budget.js");
+  const hostResourceBudget =
+    options.hostResourceBudget || new HostResourceBudget();
   const signal = options.signal || null;
   const workflowEffectId = _normalizeWorkflowEffectId(options.workflowEffectId);
   // Optional OpenTelemetry recorder (TelemetryRecorder). When present, the loop
@@ -12941,6 +13232,10 @@ export async function* agentLoop(messages, options) {
     // CLI root does not create one yet; when supplied, every nested child sees
     // the same object and cannot reset concurrency/spawn/depth totals.
     sessionBudget: options.sessionBudget || null,
+    // Share bounded WebFetch cache and renderer/tool/event admission across
+    // the main loop and every nested subagent. A host can tighten these limits
+    // by supplying its own budget; otherwise the conservative defaults apply.
+    hostResourceBudget,
     // This loop's EFFECTIVE subagent contract (set when this loop IS a spawned
     // sub-agent). Threaded so a nested spawn_sub_agent sees it as the parent
     // ceiling (tighten-only). null at the top level (no ceiling).
@@ -13180,6 +13475,53 @@ export async function* agentLoop(messages, options) {
       };
     }
 
+    // Release result bodies that have left the recent display window before
+    // every provider admission, independent of the semantic-compaction token
+    // threshold. Settlement persists a bounded resume checkpoint before the
+    // live array changes; the earlier hash-chained result events remain the
+    // durable evidence for audit/recovery.
+    if (options.runtimeResultRetention !== false && messages.length > 32) {
+      const retentionConfig =
+        options.runtimeResultRetention &&
+        typeof options.runtimeResultRetention === "object"
+          ? options.runtimeResultRetention
+          : options.runtimeResultRetentionOptions;
+      const retained = releaseOldLiveSessionResults(messages, retentionConfig);
+      if (
+        retained.stats.released > 0 &&
+        !_sameMessageSnapshot(retained.messages, messages)
+      ) {
+        const authorityExpectedMessages = [...messages];
+        const liveExpectedMessages = [...messages];
+        try {
+          await _settleAutomaticCompaction({
+            messages,
+            liveExpectedMessages,
+            authorityExpectedMessages,
+            compacted: retained.messages,
+            stats: retained.stats,
+            options,
+            trigger: "runtime-retention",
+          });
+          yield {
+            type: "session-runtime-retention",
+            runId,
+            stats: retained.stats,
+          };
+        } catch (error) {
+          yield {
+            type: "session-runtime-retention-degraded",
+            runId,
+            reason:
+              error?.code === "SESSION_REVISION_STALE"
+                ? "session_messages_changed_during_retention"
+                : "canonical_retention_settlement_failed",
+            code: error?.code || "CC_SESSION_RETENTION_SETTLEMENT_FAILED",
+          };
+        }
+      }
+    }
+
     // Headless auto-compaction (Claude-Code `--print` parity). Keeps long
     // `-p` / `--resume` runs under the model's context window instead of
     // growing until the provider rejects the request. Opt-out with

package/src/runtime/bootstrap.js

@@ -13,6 +13,12 @@
  */
 
 import { logger } from "../lib/logger.js";
+import { join } from "node:path";
+import {
+  ensureDir as ensurePrivateDir,
+  ensureHomeDir,
+  resolveConfigDataRoot,
+} from "../lib/paths.js";
 
 let _context = null;
 
@@ -40,19 +46,37 @@ export async function bootstrap(options = {}) {
     // Stage 1: Environment
     if (options.verbose) logger.verbose("Stage 1: Detecting environment...");
     const coreEnv = await import("@chainlesschain/core-env");
-    ctx.env = {
-      runtime: coreEnv.getRuntimeInfo(),
-      userDataPath: coreEnv.getUserDataPath(),
-      configDir: coreEnv.getConfigDir(),
-      dataDir: coreEnv.getDataDir(),
-      logsDir: coreEnv.getLogsDir(),
-    };
-
-    // Ensure directories exist
-    coreEnv.ensureDir(ctx.env.userDataPath);
-    coreEnv.ensureDir(ctx.env.configDir);
-    coreEnv.ensureDir(ctx.env.dataDir);
-    coreEnv.ensureDir(ctx.env.logsDir);
+    const configRoot = resolveConfigDataRoot();
+    if (configRoot.source === "claude") {
+      // core-env intentionally knows only native roots. Keep its runtime
+      // metadata but make all CLI runtime config/data state follow the
+      // validated CLAUDE_CONFIG_DIR root rather than silently splitting it
+      // into the platform-default user-data directory.
+      ctx.env = {
+        runtime: coreEnv.getRuntimeInfo(),
+        userDataPath: configRoot.path,
+        configDir: configRoot.path,
+        dataDir: join(configRoot.path, "data"),
+        logsDir: join(configRoot.path, "logs"),
+      };
+      ensureHomeDir();
+      ensurePrivateDir(ctx.env.dataDir);
+      ensurePrivateDir(ctx.env.logsDir);
+    } else {
+      ctx.env = {
+        runtime: coreEnv.getRuntimeInfo(),
+        userDataPath: coreEnv.getUserDataPath(),
+        configDir: coreEnv.getConfigDir(),
+        dataDir: coreEnv.getDataDir(),
+        logsDir: coreEnv.getLogsDir(),
+      };
+
+      // Ensure directories exist
+      coreEnv.ensureDir(ctx.env.userDataPath);
+      coreEnv.ensureDir(ctx.env.configDir);
+      coreEnv.ensureDir(ctx.env.dataDir);
+      coreEnv.ensureDir(ctx.env.logsDir);
+    }
 
     // Stage 2-3: Logger (shared-logger optional, CLI logger always works)
     if (options.verbose) logger.verbose("Stage 2-3: Logger ready");