chainlesschain 0.165.6 → 0.165.8

package/src/commands/git.js

@@ -15,12 +15,51 @@ import {
   gitInit,
   isGitRepo,
 } from "../lib/git-integration.js";
+import {
+  parseGitLabMergeRequestReference,
+  renderGitLabMergeRequestFooter,
+} from "../lib/gitlab-mr-worktree.js";
 
 export function registerGitCommand(program) {
   const git = program
     .command("git")
     .description("Git integration for knowledge base versioning");
 
+  git
+    .command("gitlab-mr <reference>")
+    .description("Render a local GitLab MR/worktree footer (no network I/O)")
+    .option("--worktree <path>", "Worktree path to include in the footer")
+    .option("--host <host>", "Default GitLab host for project!iid shorthand")
+    .option("--json", "Output the normalized local display model as JSON")
+    .action((reference, options) => {
+      try {
+        const mr = parseGitLabMergeRequestReference(reference, {
+          defaultHost: options.host,
+        });
+        if (options.json) {
+          console.log(
+            JSON.stringify(
+              {
+                ...mr,
+                ...(options.worktree ? { worktreePath: options.worktree } : {}),
+              },
+              null,
+              2,
+            ),
+          );
+          return;
+        }
+        logger.log(
+          renderGitLabMergeRequestFooter(mr, {
+            worktreePath: options.worktree,
+          }),
+        );
+      } catch (error) {
+        logger.error(`GitLab MR footer failed: ${error.message}`);
+        process.exitCode = 1;
+      }
+    });
+
   // git status
   git
     .command("status")

package/src/commands/plugin.js

@@ -282,6 +282,7 @@ async function buildRegistrySetSelection(
         const resolvedToken = resolveRegistryToken(url, { token, config });
         const resolved = await fetchRegistry(url, {
           token: resolvedToken,
+          config,
           managedPolicy,
           allowInsecure,
           offline,
@@ -408,13 +409,15 @@ async function materializeRegistrySelection(
     inspected.ref !== (marketplacePreflight.package?.ref || null) ||
     (inspected.sourceType === "archive" &&
       inspected.archiveSpec.sha256 !==
-        marketplacePreflight.package?.archiveSha256)
+        marketplacePreflight.package?.archiveSha256) ||
+    (inspected.sourceType === "command" &&
+      inspected.commandSpec.mode !== marketplacePreflight.package?.mode)
   ) {
     throw new Error(
       "registry candidate preflight revision changed before source fetch",
     );
   }
-  if (resolved.sourceType !== "archive") return resolved;
+  if (!["archive", "command"].includes(resolved.sourceType)) return resolved;
   const config = await loadOptionalPluginConfig();
   const materialized = await resolveRegistryEntrySource(url, resolved.entry, {
     registryResolutionAuthority: resolved.registryResolutionAuthority,
@@ -447,6 +450,7 @@ function catalogAuthorityFromPreflight(
   impact = null,
   remoteArtifactEvidence = null,
   archiveSource = null,
+  commandSource = null,
 ) {
   return {
     catalogDigest: preflight.catalogDigest,
@@ -501,6 +505,7 @@ function catalogAuthorityFromPreflight(
     ...(impact ? { updateImpactDigest: impact.impactDigest } : {}),
     ...(remoteArtifactEvidence ? { remoteArtifactEvidence } : {}),
     ...(archiveSource ? { archiveSource } : {}),
+    ...(commandSource ? { commandSource } : {}),
   };
 }
 
@@ -1671,6 +1676,7 @@ export function registerPluginCommand(program) {
       let remoteArtifactRequest = null;
       let remoteArtifacts = null;
       let archiveSourceAuthority = null;
+      let commandSourceAuthority = null;
       let registryResolutionAuthority = null;
       const registryUrls = normalizeRegistryUrls(options.registry);
       const { isRemoteSource, resolveRemoteSource } =
@@ -1808,6 +1814,7 @@ export function registerPluginCommand(program) {
           );
           installSource = resolved.source;
           archiveSourceAuthority = resolved.archiveAuthority || null;
+          commandSourceAuthority = resolved.commandAuthority || null;
           registryResolutionAuthority =
             resolved.registryResolutionAuthority || registryResolutionAuthority;
           expectedIdentity = {
@@ -1838,6 +1845,7 @@ export function registerPluginCommand(program) {
               marketplaceImpact,
               null,
               archiveSourceAuthority,
+              commandSourceAuthority,
             ),
           };
           if (resolved.fromCache) {
@@ -1891,6 +1899,7 @@ export function registerPluginCommand(program) {
               marketplaceImpact,
               remoteArtifacts.authority,
               archiveSourceAuthority,
+              commandSourceAuthority,
             );
           }
         }
@@ -2138,6 +2147,7 @@ export function registerPluginCommand(program) {
           options.registry,
           {
             token,
+            config,
             allowInsecure: options.allowInsecureRegistry === true,
             offline: options.offline === true,
             expectedSha256: registryDigestPins.get(options.registry),
@@ -2279,6 +2289,7 @@ export function registerPluginCommand(program) {
             });
             const resolved = await fetchRegistry(url, {
               token,
+              config,
               allowInsecure: options.allowInsecureRegistry === true,
               offline: options.offline === true,
               expectedSha256: registryDigestPins.get(url),
@@ -3433,6 +3444,7 @@ export function registerPluginCommand(program) {
       let remoteArtifactRequest = null;
       let remoteArtifacts = null;
       let archiveSourceAuthority = null;
+      let commandSourceAuthority = null;
       let registryResolutionAuthority = null;
       const registryUrls = normalizeRegistryUrls(options.registry);
       const { isRemoteSource, resolveRemoteSource } =
@@ -3586,6 +3598,7 @@ export function registerPluginCommand(program) {
           );
           installSource = resolved.source;
           archiveSourceAuthority = resolved.archiveAuthority || null;
+          commandSourceAuthority = resolved.commandAuthority || null;
           registryResolutionAuthority =
             resolved.registryResolutionAuthority || registryResolutionAuthority;
           expectedIdentity = {
@@ -3616,6 +3629,7 @@ export function registerPluginCommand(program) {
               marketplaceImpact,
               null,
               archiveSourceAuthority,
+              commandSourceAuthority,
             ),
           };
           if (resolved.fromCache && !options.json) {
@@ -3669,6 +3683,7 @@ export function registerPluginCommand(program) {
               marketplaceImpact,
               remoteArtifacts.authority,
               archiveSourceAuthority,
+              commandSourceAuthority,
             );
           }
         }

package/src/commands/session-group.js

@@ -0,0 +1,131 @@
+import { logger } from "../lib/logger.js";
+import { SessionWorkbenchStore } from "../lib/session-workbench-store.js";
+
+function output(value, options) {
+  if (options.json) {
+    logger.log(JSON.stringify(value, null, 2));
+    return;
+  }
+  logger.log(
+    `${value.items.length} groups; revision ${value.revision}; generation ${value.generation}`,
+  );
+}
+
+function store() {
+  return new SessionWorkbenchStore();
+}
+
+function expected(options) {
+  return typeof options.expectedRevision === "string"
+    ? options.expectedRevision.trim()
+    : "";
+}
+
+export function registerSessionGroupCommands(session) {
+  const group = session
+    .command("group")
+    .description("CLI-owned durable session groups and atomic batch moves");
+
+  group
+    .command("list")
+    .description("Read the current group revision and assignments")
+    .option("--json", "Output as JSON")
+    .action((options) => output(store().projection(), options));
+
+  group
+    .command("create <name>")
+    .description("Create a session group using exact revision CAS")
+    .requiredOption(
+      "--expected-revision <sha256>",
+      "Exact group revision rendered by session projection",
+    )
+    .option("--order <n>", "Insert at a zero-based group order")
+    .option("--json", "Output as JSON")
+    .action((name, options) =>
+      output(
+        store().createGroup({
+          name,
+          order: options.order == null ? null : Number(options.order),
+          expectedRevision: expected(options),
+        }),
+        options,
+      ),
+    );
+
+  group
+    .command("rename <group-id> <name>")
+    .description("Rename a session group using exact revision CAS")
+    .requiredOption(
+      "--expected-revision <sha256>",
+      "Exact group revision rendered by session projection",
+    )
+    .option("--json", "Output as JSON")
+    .action((groupId, name, options) =>
+      output(
+        store().renameGroup({
+          groupId,
+          name,
+          expectedRevision: expected(options),
+        }),
+        options,
+      ),
+    );
+
+  group
+    .command("delete <group-id>")
+    .description("Delete a group and atomically ungroup its sessions")
+    .requiredOption(
+      "--expected-revision <sha256>",
+      "Exact group revision rendered by session projection",
+    )
+    .option("--json", "Output as JSON")
+    .action((groupId, options) =>
+      output(
+        store().deleteGroup({
+          groupId,
+          expectedRevision: expected(options),
+        }),
+        options,
+      ),
+    );
+
+  group
+    .command("order <group-id> <order>")
+    .description("Move a group to a zero-based order using exact revision CAS")
+    .requiredOption(
+      "--expected-revision <sha256>",
+      "Exact group revision rendered by session projection",
+    )
+    .option("--json", "Output as JSON")
+    .action((groupId, order, options) =>
+      output(
+        store().setGroupOrder({
+          groupId,
+          order: Number(order),
+          expectedRevision: expected(options),
+        }),
+        options,
+      ),
+    );
+
+  group
+    .command("move <group-id> <session-ids...>")
+    .description(
+      "Atomically move selected canonical sessions; use ungrouped as the target",
+    )
+    .requiredOption(
+      "--expected-revision <sha256>",
+      "Exact group revision rendered by session projection",
+    )
+    .option("--json", "Output as JSON")
+    .action((groupId, sessionIds, options) =>
+      output(
+        store().moveSessions({
+          groupId,
+          sessionIds,
+          expectedRevision: expected(options),
+        }),
+        options,
+      ),
+    );
+}

package/src/commands/session-location.js

@@ -61,6 +61,11 @@ import {
   verifyExecutionLocationResultApplySourceGit,
 } from "../lib/execution-location-result-apply.js";
 import { executionBroker } from "../lib/process-execution-broker/index.js";
+import {
+  projectExecutionLocationTargetSigtermProbe,
+  projectExecutionLocationTargetPreflight,
+  runExecutionLocationTargetResourceProbe,
+} from "../lib/execution-location-target-preflight.js";
 import {
   sameFileStatIdentity,
   samePathHandleFileIdentity,
@@ -1134,6 +1139,17 @@ function runPreviewAction(action, deps = {}) {
   }
 }
 
+async function runAsyncAction(action, options = {}) {
+  try {
+    const projection = await action();
+    writeProjection(projection, options);
+    return projection.allowed === false ? 2 : 0;
+  } catch (error) {
+    process.stderr.write(`Execution location failed: ${error.message}\n`);
+    return 1;
+  }
+}
+
 export function registerSessionLocationSubcommands(session, deps = {}) {
   const location = session
     .command("location")
@@ -1152,6 +1168,38 @@ export function registerSessionLocationSubcommands(session, deps = {}) {
       );
     });
 
+  location
+    .command("target-preflight", { hidden: true })
+    .description("Verify target-local runner fences and resource limits")
+    .option("--json", "Machine-readable JSON output")
+    .action((options) => {
+      process.exitCode = runAction(
+        () => projectExecutionLocationTargetPreflight({}, deps),
+        options,
+      );
+    });
+
+  location
+    .command("resource-probe <kind>", { hidden: true })
+    .description("Exercise a target-local cpu or memory enforcement boundary")
+    .action((kind) => {
+      process.exitCode = runAction(
+        () => runExecutionLocationTargetResourceProbe(kind),
+        {},
+      );
+    });
+
+  location
+    .command("sigterm-drain-probe", { hidden: true })
+    .description("Exercise the target-local SIGTERM drain transition")
+    .option("--json", "Machine-readable JSON output")
+    .action(async (options) => {
+      process.exitCode = await runAsyncAction(
+        () => projectExecutionLocationTargetSigtermProbe({}, deps),
+        options,
+      );
+    });
+
   location
     .command("show <id>")
     .description("Show the execution location anchored by session_start")

package/src/commands/session.js

@@ -69,6 +69,7 @@ import { registerSessionObservabilitySubcommand } from "./session-observability.
 import { registerSessionLocationSubcommands } from "./session-location.js";
 import { registerSessionBudgetCommands } from "./session-budget.js";
 import { registerSessionMessageCommands } from "./session-message.js";
+import { registerSessionGroupCommands } from "./session-group.js";
 
 export const _deps = {
   execFileSync: (...args) => executionBroker.execFileSync(...args),
@@ -228,6 +229,7 @@ export function registerSessionCommand(program) {
   registerSessionLocationSubcommands(session);
   registerSessionBudgetCommands(session);
   registerSessionMessageCommands(session);
+  registerSessionGroupCommands(session);
 
   // session list
   session
@@ -324,6 +326,7 @@ export function registerSessionCommand(program) {
         let workflow = [];
         let dynamicWorkflow = [];
         let sessionMessageFabric = null;
+        let sessionWorkbench = null;
         let artifacts = [];
         let prLinks = {};
 
@@ -472,6 +475,13 @@ export function registerSessionCommand(program) {
         } catch (error) {
           sourceErrors.sessionMessageFabric = error?.message || String(error);
         }
+        try {
+          const { SessionWorkbenchStore } =
+            await import("../lib/session-workbench-store.js");
+          sessionWorkbench = new SessionWorkbenchStore().projection();
+        } catch (error) {
+          sourceErrors.sessionWorkbench = error?.message || String(error);
+        }
 
         const { buildSessionProjection } =
           await import("../lib/session-projection.js");
@@ -485,6 +495,7 @@ export function registerSessionCommand(program) {
           artifacts,
           prLinks,
           sessionMessageFabric,
+          sessionWorkbench,
           sourceErrors,
         });
         if (options.json) {

package/src/commands/sync-providers.js

@@ -188,7 +188,10 @@ async function _runProvider(providerId, opts = {}) {
   try {
     vault = await openCliVault();
   } catch (err) {
-    if (err.code === "BETTER_SQLITE3_MISSING") {
+    if (
+      err?.code === "BETTER_SQLITE3_MISSING" ||
+      String(err?.code || "").startsWith("CLI_VAULT_")
+    ) {
       console.error(chalk.red(`✗ ${err.message}`));
       process.exitCode = 2;
       return;

package/src/commands/update.js

@@ -91,6 +91,7 @@ export async function selfUpdateCli(targetVersion) {
         ...invocations.npm.prefixArgs,
         "install",
         "-g",
+        "--include=optional",
         `chainlesschain@${targetVersion}`,
       ],
       "update:npm-install",

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.165.8",
+      "cliVersions": ["0.165.7", "0.165.8"],
+      "date": "2026-08-23",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.165.8: release-gate home isolation",
+          "body": "> `chainlesschain` **0.165.7 -> 0.165.8** (source candidate; not yet\n> published, 2026-08-23).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.59**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Agent SDK release-gate isolation**: the real-CLI SDK test now keeps its\n  simulated operating-system home separate from `CHAINLESSCHAIN_HOME`, while\n  retaining separate workspace and rollback-resistant security-anchor roots.\n  This exercises the production fail-closed layout without asking the CLI to\n  repair owner-only permissions on a broad user-home directory.\n- **Candidate continuity**: exact SHA `350fb4ce71` passed the complete Linux,\n  Windows, and macOS `CLI CI` (`32612516841`) and `CLI Strict Sandbox`\n  (`32612516696`) matrices. Its immutable `v-npm-0-165-7` release run\n  (`32613795671`) stopped in the Agent SDK test before package, dry-run, or npm\n  publish jobs; `0.165.7` was therefore never published and the fix advances\n  to a new immutable version/tag rather than moving the existing tag.\n- **Release status**: publication requires this candidate's exact commit to\n  pass the complete Linux, Windows, and macOS `CLI CI` and `CLI Strict Sandbox`\n  matrices. Tag, provenance, registry readback, and publication evidence must\n  be recorded only after those exact-SHA gates succeed."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.165.7",
+      "cliVersions": ["0.165.6", "0.165.7"],
+      "date": "2026-08-23",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.165.7: merged-session and evidence stability",
+          "body": "> `chainlesschain` **0.165.6 -> 0.165.7** (unpublished immutable-tag candidate,\n> 2026-08-23; superseded by `0.165.8` after a pre-package release-gate failure).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.59**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Durable session stability**: bound headless event backlogs, scoped session\n  sidecars, routed Claude project storage through canonical path authority,\n  and prevented Windows append-writer starvation under concurrent session\n  activity.\n- **Execution-location convergence**: local and remote replicas now bootstrap\n  isolated target state, preserve replica identity and witnesses, forward\n  staged input through the target supervisor, and retain CPU-limit evidence.\n- **Browser evidence reliability**: two-origin browser evidence installs its\n  complete driver and aggregate dependency closure, preserves detached\n  baselines, stabilizes Windows tabs, and retries bounded profile cleanup.\n- **Merged test-contract repair**: real-spawn fixtures keep workspace and\n  application data as siblings, while path-module mocks inherit the production\n  API before overriding isolated test roots. The bundled offline changelog is\n  regenerated from this canonical record.\n- **Release status**: publication requires this candidate's exact commit to\n  pass the complete Linux, Windows, and macOS `CLI CI` and `CLI Strict Sandbox`\n  matrices. Tag, provenance, registry readback, and publication evidence must\n  be recorded only after those exact-SHA gates succeed."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.165.6",
@@ -10,7 +36,7 @@
       "sections": [
         {
           "heading": "Added - cc CLI 0.165.6: safer remote sessions and governed plugin sources",
-          "body": "> `chainlesschain` **0.165.5 -> 0.165.6** (candidate; not yet published,\n> 2026-08-21).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.59**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Remote Control safe defaults**: direct sessions bind to loopback by\n  default. Trusted-LAN exposure requires explicit command authority, preserves\n  the selected bind address, fails closed on relay/direct fallback, and keeps\n  IDE pairing surfaces from presenting loopback endpoints as phone-ready QR\n  links.\n- **Governed plugin source identity**: managed Marketplace policy now evaluates\n  canonical Git, registry, file, alias, ref, path, host, port, principal, and\n  registry-resolution identities before target I/O or process spawn. Clone\n  execution is isolated from ambient Git/SSH configuration, and cache\n  provenance remains bound to the approved source and registry document.\n- **Digest-pinned Marketplace archives**: registry install and update can\n  materialize same-origin, catalog-bound `tgz`/`tar.gz` sources only after\n  candidate preflight. SHA-256 verification and bounded extraction reject\n  traversal, links, special entries, case collisions, and expansion bombs;\n  archive and extracted-payload digest authority are revalidated for offline\n  cache replay. Dynamic command and headers-helper sources remain disabled by\n  product policy.\n- **Cross-platform policy enforcement**: Windows runner temporary roots are\n  canonicalized without probing caller-controlled targets. Other existing 8.3\n  spellings resolve to their long-path authority, while unresolved or forged\n  aliases remain rejected. Linux, Windows, and macOS Marketplace campaigns\n  exercise air-gapped cache, proxy, PAC, and private-registry boundaries.\n- **Durable session and MCP lifecycle**: cross-session messaging, bounded\n  long-running live state, MCP reconnect subscription recovery, lifecycle\n  compatibility, and structured headless observability now share explicit\n  identity, cleanup, and backpressure contracts.\n- **Focused terminal ergonomics**: the `concise` output style and persisted\n  `classic`/`readline` keybinding flavor extend interactive use without\n  changing existing default behavior.\n- **Release status**: publication requires the final candidate commit to pass\n  the complete Linux, Windows, and macOS `CLI CI` and `CLI Strict Sandbox`\n  matrices. The immutable npm tag, provenance, and registry readback will be\n  recorded only after those exact-SHA gates succeed."
+          "body": "> `chainlesschain` **0.165.5 -> 0.165.6** (published from exact SHA\n> `ef4324349f272f5ec6af9a6ab80110e814122dae`, 2026-08-21).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.59**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Remote Control safe defaults**: direct sessions bind to loopback by\n  default. Trusted-LAN exposure requires explicit command authority, preserves\n  the selected bind address, fails closed on relay/direct fallback, and keeps\n  IDE pairing surfaces from presenting loopback endpoints as phone-ready QR\n  links.\n- **Governed plugin source identity**: managed Marketplace policy now evaluates\n  canonical Git, registry, file, alias, ref, path, host, port, principal, and\n  registry-resolution identities before target I/O or process spawn. Clone\n  execution is isolated from ambient Git/SSH configuration, and cache\n  provenance remains bound to the approved source and registry document.\n- **Digest-pinned Marketplace archives**: registry install and update can\n  materialize same-origin, catalog-bound `tgz`/`tar.gz` sources only after\n  candidate preflight. SHA-256 verification and bounded extraction reject\n  traversal, links, special entries, case collisions, and expansion bombs;\n  archive and extracted-payload digest authority are revalidated for offline\n  cache replay. Dynamic command and headers-helper sources remain disabled by\n  product policy.\n- **Cross-platform policy enforcement**: Windows runner temporary roots are\n  canonicalized without probing caller-controlled targets. Other existing 8.3\n  spellings resolve to their long-path authority, while unresolved or forged\n  aliases remain rejected. Linux, Windows, and macOS Marketplace campaigns\n  exercise air-gapped cache, proxy, PAC, and private-registry boundaries.\n- **Durable session and MCP lifecycle**: cross-session messaging, bounded\n  long-running live state, MCP reconnect subscription recovery, lifecycle\n  compatibility, and structured headless observability now share explicit\n  identity, cleanup, and backpressure contracts.\n- **Focused terminal ergonomics**: the `concise` output style and persisted\n  `classic`/`readline` keybinding flavor extend interactive use without\n  changing existing default behavior.\n- **Published release evidence**: immutable tag `v-npm-0-165-6`, three-OS\n  `CLI CI` (`32483224738`), `CLI Strict Sandbox` (`32483224517`), npm release\n  (`32486454203`), and independent registry/provenance readback\n  (`32488130856`) all bind exact SHA `ef4324349f`. npm reports\n  `latest=0.165.6`; the public tarball SHA-1 is\n  `d0dc65bdf34d0afe8e8db4492a1ddc72d63ee260`."
         }
       ]
     },

package/src/gateways/ws/ws-agent-handler.js

@@ -69,6 +69,7 @@ import {
   recordSessionBudgetUsage,
   rejectSessionBudgetUsageUnknown,
 } from "../../lib/session-budget-usage.js";
+import { HostResourceBudget } from "../../lib/host-resource-budget.js";
 
 const CANONICAL_WS_TURN_QUEUES = new Map();
 const CANONICAL_WS_CLAIM_CAS_ATTEMPTS = 4;
@@ -163,6 +164,7 @@ export class WSAgentHandler {
     canonicalSessionStore,
     sessionHostLease = null,
     sessionBudgetRoot = null,
+    hostResourceBudget = null,
   }) {
     this.session = session;
     this.interaction = interaction;
@@ -173,6 +175,9 @@ export class WSAgentHandler {
     this._sessionHostLease = sessionHostLease;
     this._sessionBudgetRoot = sessionBudgetRoot;
     this._sessionBudget = sessionBudgetRoot?.budget || null;
+    // session-protocol keeps one handler alive across reconnects and incoming
+    // requests, making this authority session-scoped rather than turn-scoped.
+    this._hostResourceBudget = hostResourceBudget || new HostResourceBudget();
     this._onSessionHostLeaseAbort = null;
     if (sessionHostLease?.signal) {
       this._onSessionHostLeaseAbort = () => {
@@ -642,7 +647,8 @@ export class WSAgentHandler {
         model: session.model,
         baseUrl: session.baseUrl,
         apiKey: session.apiKey,
-        signal: signal || this._sessionBudgetSignal || this._sessionHostLease?.signal,
+        signal:
+          signal || this._sessionBudgetSignal || this._sessionHostLease?.signal,
         onlyIfNeeded: true,
         preserveCompletedExchange: true,
         llmQuery: this._compactionLlmQuery,
@@ -1152,11 +1158,10 @@ export class WSAgentHandler {
           strictUsageTelemetry =
             this._resolveCanonicalUsageProtocol() === "call-ledger";
           if (strictUsageTelemetry) this._assertUsageLedgerWritable();
-          const compacted =
-            await this._compactCanonicalHistoryBeforeClaim(
-              requestId,
-              turnSignal,
-            );
+          const compacted = await this._compactCanonicalHistoryBeforeClaim(
+            requestId,
+            turnSignal,
+          );
           if (!compacted) return;
         }
         canonicalTurn ||= this._claimCanonicalTurn(userMessage, requestId);
@@ -1240,6 +1245,7 @@ export class WSAgentHandler {
         cwd: session.projectRoot,
         sessionId: session.id,
         planManager: session.planManager,
+        hostResourceBudget: this._hostResourceBudget,
         enabledToolNames: session.enabledToolNames || null,
         hostManagedToolPolicy: session.hostManagedToolPolicy || null,
         extraToolDefinitions: session.externalToolDefinitions || [],
@@ -1507,7 +1513,10 @@ export class WSAgentHandler {
                 this._persistCanonicalUsageBoundary(event, "unknown");
               }
               if (this._markSessionBudgetUsageUnknown(event)) {
-                rejectSessionBudgetUsageUnknown(event, "WebSocket provider call");
+                rejectSessionBudgetUsageUnknown(
+                  event,
+                  "WebSocket provider call",
+                );
               }
               break;
 
@@ -1624,9 +1633,9 @@ export class WSAgentHandler {
           ? surfacedError?.code || "CC_SESSION_BUDGET_EXHAUSTED"
           : isAbortError(err)
             ? "CC_WS_TURN_INTERRUPTED"
-          : err?.code === "CC_WS_EMPTY_ASSISTANT_RESPONSE"
-            ? "CC_WS_EMPTY_ASSISTANT_RESPONSE"
-            : "CC_WS_TURN_FAILED";
+            : err?.code === "CC_WS_EMPTY_ASSISTANT_RESPONSE"
+              ? "CC_WS_EMPTY_ASSISTANT_RESPONSE"
+              : "CC_WS_TURN_FAILED";
         try {
           this._settleCanonicalFailure(canonicalTurn, failureCode);
         } catch (settlementError) {
@@ -1917,8 +1926,7 @@ export class WSAgentHandler {
             model: session.model,
             baseUrl: session.baseUrl,
             apiKey: session.apiKey,
-            signal:
-              this._sessionBudgetSignal || this._sessionHostLease?.signal,
+            signal: this._sessionBudgetSignal || this._sessionHostLease?.signal,
             force: true,
             preserveCompletedExchange: true,
             llmQuery: this._compactionLlmQuery,