chainlesschain 0.165.6 → 0.165.8

package/src/repl/agent-repl.js

@@ -119,6 +119,7 @@ import {
 } from "../lib/task-model-selector.js";
 import { runnableTaskModel, hasUsableKey } from "../lib/runnable-provider.js";
 import { CLIPermanentMemory } from "../lib/permanent-memory.js";
+import { resolveClaudeProjectAutoMemory } from "../lib/claude-project-auto-memory.js";
 import { CLIAutonomousAgent, GoalStatus } from "../lib/autonomous-agent.js";
 import {
   estimateMessagesTokens,
@@ -2845,6 +2846,46 @@ export function startReplJsonlSession(
   }
 }
 
+/**
+ * Resolve the automatic-memory location at the same lifecycle boundary that
+ * opens the durable REPL session. This is intentionally exported as a narrow
+ * test seam; startAgentReplInWorkspaceOwned consumes it below rather than
+ * letting a standalone helper drift away from real session behavior.
+ */
+export function resolveReplAutomaticMemoryPlan(
+  options = {},
+  cwd = process.cwd(),
+) {
+  return resolveClaudeProjectAutoMemory({
+    cwd,
+    launchEnv: options.claudeStorageLaunchEnv || undefined,
+  });
+}
+
+/**
+ * Resolve the concrete permanent-memory backend used by the live REPL. Claude
+ * project mode is deliberately file-only: the legacy bootstrap SQLite DB is
+ * process/global state and would otherwise let project A retrieve facts that
+ * project B summarized. Legacy mode retains its historical DB behavior.
+ */
+export function resolveReplPermanentMemoryStorage(
+  options = {},
+  db = null,
+  cwd = process.cwd(),
+) {
+  const automaticMemory = resolveReplAutomaticMemoryPlan(options, cwd);
+  if (!automaticMemory.enabled) return null;
+  const dataDir = process.env.CHAINLESSCHAIN_DATA_DIR || cwd;
+  return Object.freeze({
+    db: automaticMemory.mode === "project" ? null : db,
+    memoryDir:
+      automaticMemory.mode === "project"
+        ? automaticMemory.memoryDir
+        : path.join(dataDir, "memory"),
+    automaticMemory,
+  });
+}
+
 /** Start the agentic REPL with non-overridable production bindings. */
 export async function startAgentRepl(options = {}) {
   const sessionHostLeaseScope = { lease: null };
@@ -3344,10 +3385,15 @@ async function startAgentReplInWorkspaceOwned(
   // Initialize permanent memory
   let permanentMemory = null;
   try {
-    const dataDir = process.env.CHAINLESSCHAIN_DATA_DIR || process.cwd();
-    const memoryDir = path.join(dataDir, "memory");
-    permanentMemory = new CLIPermanentMemory({ db, memoryDir });
-    permanentMemory.initialize();
+    const permanentMemoryStorage = resolveReplPermanentMemoryStorage(
+      options,
+      db,
+      process.cwd(),
+    );
+    if (permanentMemoryStorage) {
+      permanentMemory = new CLIPermanentMemory(permanentMemoryStorage);
+      permanentMemory.initialize();
+    }
   } catch (_err) {
     // Non-critical
   }
@@ -3783,7 +3829,13 @@ async function startAgentReplInWorkspaceOwned(
   try {
     const { getSessionManager } =
       await import("../lib/session-core-singletons.js");
-    _sessionMgr = getSessionManager();
+    // Keep durable lifecycle sidecars on the same launch-authoritative Claude
+    // project bucket as the JSONL transcript. Project settings may not switch
+    // this map/path after the REPL has admitted its launch environment.
+    _sessionMgr = getSessionManager({
+      launchEnv: options.claudeStorageLaunchEnv || undefined,
+      cwd: process.cwd(),
+    });
     if (sessionId) {
       if (options.sessionId && !_sessionMgr.has(sessionId)) {
         // Try unparking; no-op if nothing parked with that id
@@ -6312,6 +6364,73 @@ async function startAgentReplInWorkspaceOwned(
       return;
     }
 
+    // `/spellcheck` uses an installed local dictionary only. It never sends
+    // prompt text to a provider, and fenced code is suppressed by the adapter
+    // before the executable receives it.
+    {
+      const {
+        parseSpellcheckCommand,
+        resolveSpellcheckEnabled,
+        spellcheckText,
+      } = await import("../lib/spellcheck.js");
+      const spellcheck = parseSpellcheckCommand(trimmed);
+      if (spellcheck) {
+        let configured;
+        try {
+          const { getConfigValue } = await import("../lib/config-manager.js");
+          configured = getConfigValue("cli.spellcheck");
+        } catch {
+          configured = undefined;
+        }
+        if (spellcheck.action === "on" || spellcheck.action === "off") {
+          try {
+            const { setConfigValue } = await import("../lib/config-manager.js");
+            setConfigValue("cli.spellcheck", spellcheck.action === "on");
+          } catch {
+            // The current-session diagnostic remains useful if config storage
+            // is unavailable; don't turn a local optional feature into a
+            // REPL failure.
+          }
+          logger.info(
+            `Spellcheck: ${spellcheck.action === "on" ? "enabled" : "disabled"}.`,
+          );
+        } else if (spellcheck.action === "status") {
+          logger.info(
+            `Spellcheck: ${
+              resolveSpellcheckEnabled({
+                config: { cli: { spellcheck: configured } },
+              })
+                ? "enabled"
+                : "disabled"
+            }. ` + "Use /spellcheck <text> to check local prose.",
+          );
+        } else {
+          try {
+            const result = spellcheckText(spellcheck.text, {
+              config: { cli: { spellcheck: configured } },
+            });
+            if (!result.enabled) {
+              logger.info("Spellcheck is disabled.");
+            } else if (!result.available) {
+              logger.info(
+                "No local spellchecker found (aspell, hunspell, or ispell).",
+              );
+            } else if (result.words.length === 0) {
+              logger.info("Spellcheck: no unknown prose words.");
+            } else {
+              logger.info(
+                `Spellcheck (${result.adapter}): ${result.words.join(", ")}`,
+              );
+            }
+          } catch (error) {
+            logger.error(`/spellcheck failed: ${error.message}`);
+          }
+        }
+        prompt();
+        return;
+      }
+    }
+
     // `/tui` — fullscreen no-flicker view (Claude-Code parity). `fullscreen`
     // enters the alternate screen buffer; `default` returns to streaming
     // scrollback. No arg prints the current mode. Persisted to `cli.tuiMode`.

package/src/repl/permission-prompt.js

@@ -14,6 +14,9 @@
  *
  * @returns {string} the prompt header (no styling, no trailing "Proceed?")
  */
+import { normalizePermissionRequest } from "../lib/permission-request.js";
+import { redactSecrets } from "../lib/secret-scan.js";
+
 export function visualizePermissionText(value) {
   return String(value ?? "").replace(
     /[\u0000-\u001f\u007f-\u009f\u00ad\u034f\u061c\u115f\u1160\u17b4\u17b5\u180b-\u180f\u200b-\u200f\u202a-\u202e\u2060-\u206f\u3164\ufeff\uffa0]/gu,
@@ -27,23 +30,18 @@ export function visualizePermissionText(value) {
 }
 
 export function buildPermissionPrompt({ tool, args, rule, reason } = {}) {
-  const visibleTool = visualizePermissionText(tool);
-  const command = typeof args?.command === "string" ? args.command : "";
-  const source = args?.path ?? args?.file_path ?? args?.source ?? "";
-  const destination = args?.destination ?? args?.new_path ?? args?.to ?? "";
-  const rawDetail = command
-    ? command
-    : source && destination
-      ? `${source} -> ${destination}`
-      : source || destination;
-  const detail = rawDetail ? ` ${visualizePermissionText(rawDetail)}` : "";
+  const request = normalizePermissionRequest({ tool, args });
+  const visibleTool = visualizePermissionText(request.tool);
+  const rawDetail = request.detail;
+  const visibleDetail = visualizePermissionText(redactSecrets(rawDetail));
+  const detail = rawDetail ? ` ${visibleDetail}` : "";
   if (rule) {
-    return `[Permission] rule "${visualizePermissionText(rule)}" asks before ${visibleTool}:${detail}`;
+    return `[Permission] rule "${visualizePermissionText(redactSecrets(String(rule)))}" asks before ${visibleTool}:${detail}`;
   }
   if (reason) {
     const reasonText = String(reason);
     const missingTarget = rawDetail && !reasonText.includes(String(rawDetail));
-    return `[Permission] ${visualizePermissionText(reasonText)}${missingTarget ? `:${detail}` : ""}`;
+    return `[Permission] ${visualizePermissionText(redactSecrets(reasonText))}${missingTarget ? `:${detail}` : ""}`;
   }
   return `[Permission] confirm ${visibleTool}:${detail}`;
 }

package/src/runtime/agent-core.js

@@ -516,6 +516,45 @@ export const _gitProcessDeps = {
   run: gitProcessRunner,
 };
 
+function canonicalGitMetadataPath(value) {
+  const resolved = path.resolve(String(value || "").trim());
+  try {
+    const real = fs.realpathSync.native(resolved);
+    return process.platform === "win32" ? real.toLowerCase() : real;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Distinguish the primary checkout from a linked worktree using Git's own
+ * metadata paths. Unknown/non-repository locations are deliberately not
+ * treated as linked worktrees.
+ */
+export function classifyGitCheckout(cwd) {
+  const query = (argument) => {
+    const result = _gitProcessDeps.run(
+      "git",
+      ["rev-parse", "--path-format=absolute", argument],
+      {
+        cwd,
+        encoding: "utf8",
+        timeout: 10000,
+        windowsHide: true,
+        origin: "agent-core:git-checkout-authority",
+        policy: "allow",
+        scope: "agent-core",
+      },
+    );
+    if (result?.error || result?.status !== 0) return null;
+    return canonicalGitMetadataPath(result.stdout);
+  };
+  const gitDirectory = query("--git-dir");
+  const commonDirectory = query("--git-common-dir");
+  if (!gitDirectory || !commonDirectory) return "unknown";
+  return gitDirectory === commonDirectory ? "primary" : "linked";
+}
+
 function _killTask(task) {
   const child = task?.child;
   if (!child || child.killed || task?.status !== "running") return false;
@@ -919,6 +958,8 @@ async function requestInteractivePermission(
         args && typeof args === "object" ? Object.keys(args).sort() : [],
       reason: confirmArgs?.reason || null,
       cwd,
+      trace_id: context.hookTraceId || null,
+      parent_id: context.hookParentId || null,
     },
     { failClosed: true },
   );
@@ -3253,25 +3294,35 @@ export async function executeTool(name, args, context = {}) {
   // command unguarded in auto mode — including `reset --hard`, `clean -fd`,
   // `restore .`, `push --force`, `branch -D`, `rebase`, `reflog expire` —
   // which irrecoverably discard work. An explicit settings `allow`/confirmed
-  // `ask` (ruleAllowed) pre-authorizes; headless without a confirmer fails
-  // closed. Plan mode already blocks non-read-only git below.
+  // A confirmed `ask` pre-authorizes. A static `allow` only pre-authorizes a
+  // linked worktree; primary/unknown checkout identity still needs a live
+  // confirmation. Plan mode already blocks non-read-only git below.
   if (
     name === "git" &&
-    !ruleAllowed &&
     !planManager.isActive() &&
     isDangerousGitCommand(args?.command)
   ) {
-    const ok = await requestInteractivePermission(name, args, context, cwd, {
-      tool: name,
-      args,
-      rule: null,
-      reason: `destructive git command: git ${normalizeGitCommand(args.command)}`,
-    });
-    if (!ok) {
-      return {
-        error: `[Destructive Git] "git ${normalizeGitCommand(args.command)}" discards work irrecoverably and requires confirmation — denied. Add a settings allow rule to pre-authorize.`,
-        policy: { decision: "ask", via: "destructive-git" },
-      };
+    const checkout = classifyGitCheckout(args?.cwd || cwd);
+    const settingsAskWasConfirmed =
+      settingsVerdict.decision === "ask" && ruleAllowed;
+    const linkedWorktreeWasAllowed = checkout === "linked" && ruleAllowed;
+    if (!settingsAskWasConfirmed && !linkedWorktreeWasAllowed) {
+      const ok = await requestInteractivePermission(name, args, context, cwd, {
+        tool: name,
+        args,
+        rule: null,
+        reason: `destructive git command in ${checkout} checkout: git ${normalizeGitCommand(args.command)}`,
+      });
+      if (!ok) {
+        return {
+          error: `[Destructive Git] "git ${normalizeGitCommand(args.command)}" targets the ${checkout} checkout, discards work irrecoverably, and requires live confirmation — denied.`,
+          policy: {
+            decision: "ask",
+            via: "destructive-git",
+            checkout,
+          },
+        };
+      }
     }
   }
 
@@ -3509,6 +3560,8 @@ export async function executeTool(name, args, context = {}) {
         input_keys:
           args && typeof args === "object" ? Object.keys(args).sort() : [],
         cwd,
+        trace_id: context.hookTraceId || null,
+        parent_id: context.hookParentId || null,
       },
       { failClosed: true },
     );
@@ -3660,6 +3713,7 @@ export async function executeTool(name, args, context = {}) {
       subAgentDepth: context.subAgentDepth || 0,
       subAgentBudget: context.subAgentBudget || null,
       sessionBudget: context.sessionBudget || null,
+      hostResourceBudget: context.hostResourceBudget || null,
       // Effective contract of THIS loop (parent ceiling for a nested spawn) +
       // the MCP tool definitions this loop exposes (inheritable by a spawn).
       subAgentContract: context.subAgentContract || null,
@@ -3676,6 +3730,15 @@ export async function executeTool(name, args, context = {}) {
       managedCheckpoint: context.managedCheckpoint === true,
       fileMutationScope: context.fileMutationScope || null,
       hermeticExecution: context.hermeticExecution === true,
+      browserEvidenceBinding: context.browserEvidenceBinding || null,
+      browserOriginGrants: context.browserOriginGrants || null,
+      browserExpectedGrantRevisions:
+        context.browserExpectedGrantRevisions || null,
+      browserReplaySourceEnvelope: context.browserReplaySourceEnvelope || null,
+      browserReplayAllowSideEffects:
+        context.browserReplayAllowSideEffects === true,
+      browserReplayAllowCredentials:
+        context.browserReplayAllowCredentials === true,
     });
   } catch (err) {
     if (
@@ -4757,9 +4820,9 @@ async function filterSkillsByCwd(skills, cwd) {
   }
 }
 
-async function promoteBrowserScreenshot(
+async function promoteBrowserGeneratedArtifact(
   filePath,
-  { sessionId = null, title = "Browser screenshot" } = {},
+  { sessionId = null, title, kind, failureLabel } = {},
 ) {
   if (!filePath) return { artifact: null, error: null };
   try {
@@ -4768,7 +4831,7 @@ async function promoteBrowserScreenshot(
     const entry = new ArtifactStore().publish({
       filePath,
       title,
-      kind: "screenshot",
+      kind,
       sessionId: sessionId ? String(sessionId) : null,
     });
     return { artifact: publicArtifactMetadata(entry), error: null };
@@ -4779,7 +4842,7 @@ async function promoteBrowserScreenshot(
         : "";
     return {
       artifact: null,
-      error: `browser screenshot artifact publication failed${code ? ` (${code})` : ""}`,
+      error: `${failureLabel} artifact publication failed${code ? ` (${code})` : ""}`,
     };
   } finally {
     try {
@@ -4790,6 +4853,155 @@ async function promoteBrowserScreenshot(
   }
 }
 
+async function promoteBrowserScreenshot(
+  filePath,
+  { sessionId = null, title = "Browser screenshot" } = {},
+) {
+  return promoteBrowserGeneratedArtifact(filePath, {
+    sessionId,
+    title,
+    kind: "screenshot",
+    failureLabel: "browser screenshot",
+  });
+}
+
+async function promoteBrowserDownload(
+  filePath,
+  { sessionId = null, title = "Browser download" } = {},
+) {
+  return promoteBrowserGeneratedArtifact(filePath, {
+    sessionId,
+    title,
+    kind: "data",
+    failureLabel: "browser download",
+  });
+}
+
+async function publishBrowserEvidence(envelope, sessionId) {
+  if (!envelope?.envelopeDigest) return { artifact: null, error: null };
+  try {
+    const { ArtifactStore, publicArtifactMetadata } =
+      await import("../lib/artifact-store.js");
+    const {
+      browserEvidenceDigest,
+      canonicalBrowserEvidenceJson,
+      verifyBrowserEvidenceEnvelope,
+    } = await import("../lib/browser-evidence.js");
+    verifyBrowserEvidenceEnvelope(envelope);
+    if (!sessionId || String(sessionId) !== envelope.binding.session.id) {
+      throw new Error("browser evidence is not bound to the active session");
+    }
+    const data = `${canonicalBrowserEvidenceJson(envelope)}\n`;
+    const expectedFileDigest = browserEvidenceDigest(data).slice(
+      "sha256:".length,
+    );
+    const expectedLineage = {
+      schema: envelope.schema,
+      sessionId: envelope.binding.session.id,
+      sessionRevision: envelope.binding.session.revision,
+      diffDigest: envelope.binding.diff.digest,
+      testRunId: envelope.binding.testRun.id,
+    };
+    const store = new ArtifactStore();
+    const published = store.publishDataOnce({
+      data,
+      fileName: "browser-evidence-envelope.json",
+      title: `Browser evidence ${envelope.binding.session.id}@${envelope.binding.session.revision}`,
+      kind: "data",
+      mime: "application/json",
+      sessionId: String(sessionId),
+      immutable: true,
+      recordDigest: envelope.envelopeDigest,
+      lineage: expectedLineage,
+    });
+    const entry = published.entry;
+    const integrity = store.verifyIntegrity(entry);
+    if (
+      !integrity.ok ||
+      entry.sessionId !== String(sessionId) ||
+      entry.immutable !== true ||
+      entry.recordDigest !== envelope.envelopeDigest ||
+      entry.sha256 !== expectedFileDigest ||
+      canonicalBrowserEvidenceJson(entry.lineage) !==
+        canonicalBrowserEvidenceJson(expectedLineage)
+    ) {
+      throw new Error("persisted evidence authority failed verification");
+    }
+    return {
+      artifact: publicArtifactMetadata(entry),
+      error: null,
+    };
+  } catch (error) {
+    const code =
+      typeof error?.code === "string"
+        ? error.code.replace(/[^A-Z0-9_-]/giu, "").slice(0, 40)
+        : "";
+    return {
+      artifact: null,
+      error: `browser evidence artifact publication failed${code ? ` (${code})` : ""}`,
+    };
+  }
+}
+
+async function resolveBrowserUploadArtifact(artifactId, sessionId) {
+  const { ArtifactStore, publicArtifactMetadata } =
+    await import("../lib/artifact-store.js");
+  const store = new ArtifactStore();
+  return store.withIndexSnapshot((entries) => {
+    const matches = entries.filter((entry) => entry.id === artifactId);
+    if (matches.length !== 1) {
+      throw new Error(
+        matches.length === 0
+          ? "upload artifact was not found"
+          : "upload artifact authority is ambiguous",
+      );
+    }
+    const entry = matches[0];
+    if (!sessionId || entry.sessionId !== String(sessionId)) {
+      throw new Error("upload artifact is not bound to the active session");
+    }
+    if (
+      typeof entry.file !== "string" ||
+      path.basename(entry.file) !== entry.file ||
+      !(entry.file === entry.id || entry.file.startsWith(`${entry.id}.`)) ||
+      !/^[a-f0-9]{64}$/u.test(String(entry.sha256 || ""))
+    ) {
+      throw new Error("upload artifact storage authority is invalid");
+    }
+    const integrity = store.verifyIntegrity(entry);
+    if (!integrity.ok) {
+      throw new Error("upload artifact failed digest verification");
+    }
+    const storedPath = store.storedPath(entry);
+    if (fs.statSync(storedPath).size !== Number(entry.size)) {
+      throw new Error("upload artifact size authority mismatch");
+    }
+    const temporaryDirectory = fs.mkdtempSync(
+      path.join(os.tmpdir(), "cc-browser-upload-"),
+    );
+    const temporaryPath = path.join(
+      temporaryDirectory,
+      path.basename(entry.file || "upload.bin"),
+    );
+    try {
+      fs.writeFileSync(temporaryPath, fs.readFileSync(storedPath), {
+        flag: "wx",
+        mode: 0o600,
+        flush: true,
+      });
+    } catch (error) {
+      fs.rmSync(temporaryDirectory, { recursive: true, force: true });
+      throw error;
+    }
+    return {
+      path: temporaryPath,
+      metadata: publicArtifactMetadata(entry),
+      cleanup: () =>
+        fs.rmSync(temporaryDirectory, { recursive: true, force: true }),
+    };
+  });
+}
+
 const MCP_LEDGER_EFFECTS = new Set(["read", "unknown", "write", "destructive"]);
 
 /**
@@ -5054,10 +5266,17 @@ async function executeToolInner(
     onToolCallSettlement = null,
     backgroundUsageFailureState = null,
     toolAdmission = null,
+    hostResourceBudget = null,
     unattendedActionPolicy = null,
     managedCheckpoint = false,
     fileMutationScope = null,
     hermeticExecution = false,
+    browserEvidenceBinding = null,
+    browserOriginGrants = null,
+    browserExpectedGrantRevisions = null,
+    browserReplaySourceEnvelope = null,
+    browserReplayAllowSideEffects = false,
+    browserReplayAllowCredentials = false,
     // Hook-envelope tracing: this run's trace id, threaded into child loops
     // (spawn_sub_agent / isolated run_skill) as their parent_id.
     hookTraceId = null,
@@ -6776,6 +6995,7 @@ async function executeToolInner(
           subAgentDepth,
           subAgentBudget,
           sessionBudget,
+          hostResourceBudget,
           subAgentContract,
           settingsHooks,
           // Immutable parent execution authority. The child may only tighten
@@ -6840,6 +7060,7 @@ async function executeToolInner(
           maxBytes: args.maxBytes,
           timeout: args.timeout,
           config: webFetchConfig,
+          hostResourceBudget,
         });
         return attachDescriptor(result);
       } catch (err) {
@@ -6867,6 +7088,7 @@ async function executeToolInner(
           maxResults: args.maxResults,
           timeout: args.timeout,
           config: webSearchConfig,
+          hostResourceBudget,
         });
         return attachDescriptor(result);
       } catch (err) {
@@ -7332,6 +7554,14 @@ async function executeToolInner(
           tab: args.tab != null ? Number(args.tab) : undefined,
           continueOnError: args.continue_on_error === true,
           sessionId: sessionId ? String(sessionId) : null,
+          evidenceBinding: browserEvidenceBinding,
+          originGrants: browserOriginGrants,
+          expectedGrantRevisions: browserExpectedGrantRevisions,
+          replaySourceEnvelope: browserReplaySourceEnvelope,
+          replayAllowSideEffects: browserReplayAllowSideEffects,
+          replayAllowCredentials: browserReplayAllowCredentials,
+          resolveUploadArtifact: (artifactId) =>
+            resolveBrowserUploadArtifact(artifactId, sessionId),
         });
         if (!result.ok && result.error) {
           // Nothing ran (validation / attach failure) — surface as an error.
@@ -7364,8 +7594,45 @@ async function executeToolInner(
               step.detail = promoted.error;
             }
           }
+          if (originalStep.downloadPath) {
+            const promoted = await promoteBrowserDownload(
+              originalStep.downloadPath,
+              {
+                sessionId,
+                title: `Browser download ${i + 1} — ${originalStep.downloadSuggestedName || "file"}`,
+              },
+            );
+            delete step.downloadPath;
+            delete step.downloadRef;
+            if (promoted.artifact) {
+              step.downloadArtifact = promoted.artifact;
+              step.downloadRef = promoted.artifact.id;
+              step.detail = `download artifact: ${promoted.artifact.id}`;
+            } else {
+              step.downloadArtifactError = promoted.error;
+              step.detail = promoted.error;
+            }
+          }
           safeResult.steps.push(step);
         }
+        if (result.evidence) {
+          const publishedEvidence = await publishBrowserEvidence(
+            result.evidence,
+            sessionId,
+          );
+          safeResult.evidence = result.evidence;
+          if (publishedEvidence.artifact) {
+            safeResult.evidenceArtifact = publishedEvidence.artifact;
+            safeResult.evidenceRef = publishedEvidence.artifact.id;
+          } else {
+            safeResult.evidenceArtifactError = publishedEvidence.error;
+            safeResult.evidencePublicationFailed = true;
+            safeResult.ok = false;
+            safeResult.retrySafe = false;
+            safeResult.recovery =
+              "Browser actions may have completed, but canonical evidence publication failed; do not retry side effects automatically.";
+          }
+        }
         return attachDescriptor(safeResult);
       } catch (err) {
         return attachDescriptor({
@@ -7798,6 +8065,7 @@ async function executeToolInner(
               ? { workflowEffectId: workflowChildEffectId }
               : {}),
             ...(sessionBudget ? { sessionBudget } : {}),
+            ...(hostResourceBudget ? { hostResourceBudget } : {}),
             ...(permissionRules ? { permissionRules } : {}),
             ...(hostManagedToolPolicy
               ? {
@@ -9613,6 +9881,10 @@ async function _executeSpawnSubAgent(args, ctx) {
   const subLlmOptions = {
     ...parentLlm,
     model: mdModel || parentLlm.model || undefined,
+    // Preserve the host's optional event channel across every nesting level.
+    // It is observational only: child hooks/tools must never depend on a
+    // headless consumer being connected.
+    ...(interaction ? { interaction } : {}),
     // Contract `effort` is a compute hint (reasoning level), not authority —
     // forwarded to the child loop; harmless if the provider ignores it.
     ...(effectiveContract?.effort ? { effort: effectiveContract.effort } : {}),
@@ -9820,7 +10092,21 @@ async function _executeSpawnSubAgent(args, ctx) {
     // single total-sub-agent pool (breadth cap spans the whole tree).
     subAgentBudget: ctx.subAgentBudget || null,
     ...(ctx.sessionBudget ? { sessionBudget: ctx.sessionBudget } : {}),
+    ...(ctx.hostResourceBudget
+      ? { hostResourceBudget: ctx.hostResourceBudget }
+      : {}),
     onUsage,
+    ...(interaction && typeof interaction.emit === "function"
+      ? {
+          onProgress: (progress) =>
+            emit("sub-agent.progress", {
+              event_type: progress?.type || "unknown",
+              tool: progress?.tool || null,
+              iteration_count: progress?.iterationCount || 0,
+              token_count: progress?.tokenCount || 0,
+            }),
+        }
+      : {}),
     ...(ctx.strictUsageTelemetry === true
       ? {
           strictUsageTelemetry: true,
@@ -12730,6 +13016,9 @@ export async function* agentLoop(messages, options) {
   const { IterationBudget, WarningLevel } =
     await import("../lib/iteration-budget.js");
   const budget = options.iterationBudget || new IterationBudget();
+  const { HostResourceBudget } = await import("../lib/host-resource-budget.js");
+  const hostResourceBudget =
+    options.hostResourceBudget || new HostResourceBudget();
   const signal = options.signal || null;
   const workflowEffectId = _normalizeWorkflowEffectId(options.workflowEffectId);
   // Optional OpenTelemetry recorder (TelemetryRecorder). When present, the loop
@@ -12943,6 +13232,10 @@ export async function* agentLoop(messages, options) {
     // CLI root does not create one yet; when supplied, every nested child sees
     // the same object and cannot reset concurrency/spawn/depth totals.
     sessionBudget: options.sessionBudget || null,
+    // Share bounded WebFetch cache and renderer/tool/event admission across
+    // the main loop and every nested subagent. A host can tighten these limits
+    // by supplying its own budget; otherwise the conservative defaults apply.
+    hostResourceBudget,
     // This loop's EFFECTIVE subagent contract (set when this loop IS a spawned
     // sub-agent). Threaded so a nested spawn_sub_agent sees it as the parent
     // ceiling (tighten-only). null at the top level (no ceiling).