chainlesschain 0.166.103 → 0.166.104

package/src/runtime/headless-runner.js

@@ -57,6 +57,7 @@ import {
   appendAuthorityEvent as jsonlAppendAuthorityEvent,
   readEvents as jsonlReadEvents,
   readVerifiedEvents as jsonlReadVerifiedEvents,
+  readVerifiedProjection as jsonlReadVerifiedProjection,
   findLatestEvent as jsonlFindLatestEvent,
   rebuildMessages as jsonlRebuildMessages,
   sessionExists as jsonlSessionExists,
@@ -137,7 +138,9 @@ import executionBroker from "../lib/process-execution-broker/index.js";
 import { extractPluginUsageAttribution } from "../lib/plugin-usage-attribution.js";
 import { formatManagedCheckpointEvent } from "../lib/managed-checkpoint-render.js";
 import {
+  normalizeSessionBudgetRootConfig,
   openProductionSessionBudgetRoot,
+  readProductionSessionBudget,
   sessionBudgetAdmissionError,
 } from "../lib/session-budget-production-root.js";
 import {
@@ -288,6 +291,74 @@ export function resolveHeadlessSkillDecisionOptions(options = {}) {
   });
 }
 
+function createDecisionUsageRecoveryProjection() {
+  const started = new Map();
+  const seenCallIds = new Set();
+  let blocked = false;
+  return {
+    accept(event) {
+      if (blocked) return;
+      const data = event?.data;
+      const callId = data?.callId;
+      const isDecision =
+        typeof data?.operationId === "string" &&
+        data.operationId.startsWith("decision:");
+      if (event?.type === "model_usage_started" && isDecision) {
+        if (typeof callId !== "string" || !callId || seenCallIds.has(callId)) {
+          blocked = true;
+          return;
+        }
+        let boundary;
+        try {
+          boundary = projectRuntimeUsageBoundary(data, "started");
+        } catch {
+          blocked = true;
+          return;
+        }
+        seenCallIds.add(callId);
+        started.set(callId, boundary);
+      } else if (
+        event?.type === "model_usage_unknown" &&
+        (isDecision || started.has(callId))
+      ) {
+        blocked = true;
+      } else if (event?.type === "token_usage" && started.has(callId)) {
+        let settlement;
+        try {
+          settlement = projectRuntimeTokenUsage(data);
+        } catch {
+          blocked = true;
+          return;
+        }
+        const boundary = started.get(callId);
+        if (
+          settlement.callId !== boundary.callId ||
+          settlement.operationId !== boundary.operationId ||
+          settlement.provider !== boundary.provider ||
+          settlement.model !== boundary.model ||
+          settlement.source !== boundary.source
+        ) {
+          blocked = true;
+          return;
+        }
+        started.delete(callId);
+      }
+    },
+    finish() {
+      return blocked || started.size > 0;
+    },
+  };
+}
+
+function hasUnreconciledDecisionUsage(events) {
+  if (!Array.isArray(events)) return true;
+  const projection = createDecisionUsageRecoveryProjection();
+  for (const event of events) {
+    projection.accept(event);
+  }
+  return projection.finish();
+}
+
 /**
  * Resolve a --permission-mode string into the session-policy tier + a
  * non-interactive confirmer + whether to clamp tools to the read-only set.
@@ -500,6 +571,7 @@ export function applyForkSession(opts = {}, store = {}) {
  */
 const HEADLESS_SESSION_RESOLUTION = Symbol("headlessSessionResolution");
 const HEADLESS_SESSION_HOST_LEASE = Symbol("headlessSessionHostLease");
+const HEADLESS_CANONICAL_ADMISSION = Symbol("headlessCanonicalAdmission");
 const HEADLESS_HOOK_EVENT_CLEANUP = Symbol("headlessHookEventCleanup");
 const HOST_EVENT_BACKLOG_CODE = "CC_HOST_EVENT_BACKLOG_EXHAUSTED";
 const HOST_EVENT_BACKLOG_ERROR =
@@ -528,6 +600,7 @@ async function withHeadlessSessionHostLease(options, deps, task) {
   let lease = null;
   let budgetRoot = null;
   let scopedOptions = options;
+  let preflightAdmission;
   try {
     // Session authority/lease/budget setup can lazily initialize AppConfig and
     // DatabaseManager. Those legacy diagnostics use console.info (stdout), and
@@ -589,13 +662,101 @@ async function withHeadlessSessionHostLease(options, deps, task) {
               : lease.signal,
           }
         : options;
+      const canReadCanonical =
+        !hasInjectedSessionStore ||
+        typeof deps.readVerifiedEvents === "function";
+      if (
+        authoritySessionId &&
+        !canReadCanonical &&
+        (deps.sessionBudgetStore || options.sessionBudgetRoot?.enabled) &&
+        (resolution.resumeId ||
+          deps.sessionExists?.(authoritySessionId) !== false)
+      ) {
+        throw Object.assign(
+          new Error("budgeted resume requires verified session events"),
+          { code: "CC_SESSION_BUDGET_JSONL_REQUIRED" },
+        );
+      }
+      if (authoritySessionId && canReadCanonical) {
+        preflightAdmission = readSessionHostResumeState(authoritySessionId, {
+          sessionHasPersistedEvidence:
+            deps.sessionHasPersistedEvidence ||
+            (!hasInjectedSessionStore
+              ? jsonlSessionHasPersistedEvidence
+              : undefined),
+          sessionExists: deps.sessionExists || jsonlSessionExists,
+          readVerifiedEvents:
+            deps.readVerifiedEvents || jsonlReadVerifiedEvents,
+        });
+      }
+      if (preflightAdmission && !preflightAdmission.snapshot.verified) {
+        // The inner runner reports the canonical failure without opening or
+        // mutating a budget sidecar for an unverified transcript.
+        return;
+      }
+      const sidecar =
+        authoritySessionId &&
+        (process.platform === "linux" || deps.sessionBudgetStore)
+          ? readProductionSessionBudget(authoritySessionId, {
+              store: deps.sessionBudgetStore,
+            })
+          : null;
+      if (!preflightAdmission && !hasInjectedSessionStore && sidecar) {
+        throw Object.assign(
+          new Error("budget sidecar has no canonical JSONL session"),
+          { code: "CC_SESSION_BUDGET_JSONL_REQUIRED" },
+        );
+      }
+      let effectiveBudgetConfig = options.sessionBudgetRoot;
+      if (preflightAdmission) {
+        const canonicalConfig = preflightAdmission.sessionBudgetRoot;
+        const requestedConfig = options.sessionBudgetRoot?.enabled
+          ? normalizeSessionBudgetRootConfig(options.sessionBudgetRoot)
+          : null;
+        if (canonicalConfig?.enabled) {
+          if (!sidecar) {
+            throw Object.assign(
+              new Error(
+                "budgeted session is missing its durable budget sidecar",
+              ),
+              { code: "CC_SESSION_BUDGET_SIDECAR_REQUIRED" },
+            );
+          }
+          if (requestedConfig) {
+            if (
+              JSON.stringify(requestedConfig) !==
+              JSON.stringify(canonicalConfig)
+            ) {
+              throw Object.assign(
+                new Error(
+                  "session budget does not match its JSONL declaration",
+                ),
+                { code: "CC_SESSION_BUDGET_CONFIG_MISMATCH" },
+              );
+            }
+          } else {
+            effectiveBudgetConfig = canonicalConfig;
+          }
+        } else if (requestedConfig || sidecar) {
+          throw Object.assign(
+            new Error(
+              "existing session has no canonical JSONL budget declaration",
+            ),
+            { code: "CC_SESSION_BUDGET_JSONL_REQUIRED" },
+          );
+        }
+      }
+      scopedOptions = {
+        ...scopedOptions,
+        sessionBudgetRoot: effectiveBudgetConfig,
+      };
       budgetRoot = openProductionSessionBudgetRoot(
         authoritySessionId,
-        options.sessionBudgetRoot,
+        effectiveBudgetConfig,
         {
           persist: resolution.persist,
           signal: scopedOptions.signal || null,
-          table: options.sessionBudgetRoot?.table,
+          table: effectiveBudgetConfig?.table || options.priceTable,
           open: deps.openSessionBudget,
           store: deps.sessionBudgetStore,
           registry: deps.sessionBudgetRegistry,
@@ -609,6 +770,7 @@ async function withHeadlessSessionHostLease(options, deps, task) {
       ...deps,
       [HEADLESS_SESSION_RESOLUTION]: resolution,
       [HEADLESS_SESSION_HOST_LEASE]: lease,
+      [HEADLESS_CANONICAL_ADMISSION]: preflightAdmission,
     });
   } finally {
     // Cleanup can touch the same lazy stores. Keep late diagnostics out of a
@@ -939,18 +1101,20 @@ async function runAgentHeadlessInWorkspace(
     !hasInjectedSessionStore || typeof deps.readVerifiedEvents === "function";
   const canonicalAdmissionId = resumeId || (persist ? sessionId : null);
   const canonicalAdmission =
-    canonicalAdmissionId && canReadCanonicalResume
-      ? readSessionHostResumeState(canonicalAdmissionId, {
-          sessionHasPersistedEvidence:
-            deps.sessionHasPersistedEvidence ||
-            (!hasInjectedSessionStore
-              ? jsonlSessionHasPersistedEvidence
-              : undefined),
-          sessionExists: deps.sessionExists || jsonlSessionExists,
-          readVerifiedEvents:
-            deps.readVerifiedEvents || jsonlReadVerifiedEvents,
-        })
-      : null;
+    deps[HEADLESS_CANONICAL_ADMISSION] !== undefined
+      ? deps[HEADLESS_CANONICAL_ADMISSION]
+      : canonicalAdmissionId && canReadCanonicalResume
+        ? readSessionHostResumeState(canonicalAdmissionId, {
+            sessionHasPersistedEvidence:
+              deps.sessionHasPersistedEvidence ||
+              (!hasInjectedSessionStore
+                ? jsonlSessionHasPersistedEvidence
+                : undefined),
+            sessionExists: deps.sessionExists || jsonlSessionExists,
+            readVerifiedEvents:
+              deps.readVerifiedEvents || jsonlReadVerifiedEvents,
+          })
+        : null;
   if (canonicalAdmission && !canonicalAdmission.snapshot.verified) {
     const message =
       "CC_SESSION_HOST_SNAPSHOT_UNVERIFIED: canonical JSONL session is not " +
@@ -2012,6 +2176,9 @@ async function runAgentHeadlessInWorkspace(
           provider,
           model,
           observabilityScope: options.observabilityScope,
+          ...(options.sessionBudgetRoot?.enabled === true
+            ? { sessionBudgetRoot: options.sessionBudgetRoot }
+            : {}),
           executionLocation: captureAmbientExecutionLocation({
             provider,
             model,
@@ -2458,13 +2625,35 @@ async function runAgentHeadlessInWorkspace(
   const skillDecisionOptions = resolveHeadlessSkillDecisionOptions(options);
   let skillDecisionRuntime = null;
   if (skillDecisionOptions.mode !== "off") {
-    const previousUnknownDecisionUsage = store.findLatestEvent(
-      sessionId,
-      "model_usage_unknown",
-      (event) =>
-        typeof event?.data?.operationId === "string" &&
-        event.data.operationId.startsWith("decision:"),
-    );
+    let previousUnreconciledDecisionUsage;
+    if (
+      !hasInjectedSessionStore ||
+      typeof deps.readVerifiedEvents === "function"
+    ) {
+      try {
+        previousUnreconciledDecisionUsage = hasInjectedSessionStore
+          ? hasUnreconciledDecisionUsage(store.readVerifiedEvents(sessionId))
+          : jsonlReadVerifiedProjection(
+              sessionId,
+              createDecisionUsageRecoveryProjection,
+            );
+      } catch {
+        // Without a verified settlement, a resumed provider call could be paid twice.
+        previousUnreconciledDecisionUsage = true;
+      }
+    } else {
+      // Legacy injected stores cannot prove a prior call was settled. Their
+      // explicit no-session answer still permits a fresh test/embedding run.
+      previousUnreconciledDecisionUsage =
+        store.sessionExists(sessionId) ||
+        store.findLatestEvent(
+          sessionId,
+          "model_usage_unknown",
+          (event) =>
+            typeof event?.data?.operationId === "string" &&
+            event.data.operationId.startsWith("decision:"),
+        ) != null;
+    }
     const decisionProvider =
       deps.decisionProvider ||
       createDecisionProvider({
@@ -2487,11 +2676,12 @@ async function runAgentHeadlessInWorkspace(
         options.decisionTenantId || evolutionIngress?.tenantId || "cli-local",
       sessionId,
       provider: decisionProvider,
+      evolutionIngress,
       persist: persistDecisionEvent,
       observe: (observation) =>
         persistDecisionEvent("skill_decision_observation", observation),
       sessionBudget: options.sessionBudget || null,
-      initialUsageUnknown: previousUnknownDecisionUsage != null,
+      initialUsageUnknown: previousUnreconciledDecisionUsage,
       timeoutMs: skillDecisionOptions.timeoutMs,
     });
   }

package/src/runtime/headless-stream.js

@@ -151,7 +151,9 @@ import {
 } from "../lib/session-host-snapshot.js";
 import { acquireSessionHostLease } from "../lib/session-host-lease.js";
 import {
+  normalizeSessionBudgetRootConfig,
   openProductionSessionBudgetRoot,
+  readProductionSessionBudget,
   sessionBudgetAdmissionError,
 } from "../lib/session-budget-production-root.js";
 import {
@@ -1441,6 +1443,7 @@ async function withStreamSessionHostLease(options, deps, streamCleanup, task) {
   let lease = null;
   let budgetRoot = null;
   let onLeaseAbort = null;
+  let taskStarted = false;
   try {
     if (persist && typeof acquireHostLease === "function") {
       lease = acquireHostLease(sessionId, { hostKind: "headless-stream" });
@@ -1461,13 +1464,109 @@ async function withStreamSessionHostLease(options, deps, streamCleanup, task) {
             : lease.signal,
         }
       : options;
+    const canReadCanonical =
+      !hasInjectedSessionStore ||
+      typeof deps.readVerifiedEvents === "function" ||
+      typeof deps.readVerifiedProjection === "function";
+    const budgetStore = deps.sessionBudgetStore;
+    const sidecar =
+      persist && (process.platform === "linux" || budgetStore)
+        ? readProductionSessionBudget(sessionId, { store: budgetStore })
+        : null;
+    const needsBudgetAdmission =
+      persist &&
+      (!hasInjectedSessionStore ||
+        options.sessionBudgetRoot?.enabled === true ||
+        Boolean(budgetStore) ||
+        Boolean(deps.openSessionBudget) ||
+        Boolean(sidecar));
+    let effectiveBudgetConfig = options.sessionBudgetRoot;
+    if (needsBudgetAdmission) {
+      const existing = (
+        deps.sessionHasPersistedEvidence ||
+        deps.sessionExists ||
+        jsonlSessionHasPersistedEvidence
+      )(sessionId);
+      if (typeof existing !== "boolean") {
+        throw Object.assign(
+          new Error("stream session existence must be checked synchronously"),
+          { code: "CC_SESSION_BUDGET_JSONL_REQUIRED" },
+        );
+      }
+      if (existing && !canReadCanonical) {
+        throw Object.assign(
+          new Error("budgeted stream resume requires verified session events"),
+          { code: "CC_SESSION_BUDGET_JSONL_REQUIRED" },
+        );
+      }
+      const canonical = existing
+        ? readSessionHostResumeState(sessionId, {
+            sessionExists: () => true,
+            readVerifiedEvents:
+              deps.readVerifiedEvents || jsonlReadVerifiedEvents,
+            ...(!hasInjectedSessionStore || deps.readVerifiedProjection
+              ? {
+                  readVerifiedProjection:
+                    deps.readVerifiedProjection || jsonlReadVerifiedProjection,
+                }
+              : {}),
+          })
+        : null;
+      if (canonical && !isVerifiedSessionHostSnapshot(canonical.snapshot)) {
+        throw Object.assign(
+          new Error("canonical stream session could not be verified"),
+          { code: "CC_SESSION_HOST_SNAPSHOT_UNVERIFIED" },
+        );
+      }
+      if (!canonical && sidecar) {
+        throw Object.assign(
+          new Error("budget sidecar has no canonical JSONL session"),
+          { code: "CC_SESSION_BUDGET_JSONL_REQUIRED" },
+        );
+      }
+      if (canonical) {
+        const declared = canonical.sessionBudgetRoot;
+        const requested = options.sessionBudgetRoot?.enabled
+          ? normalizeSessionBudgetRootConfig(options.sessionBudgetRoot)
+          : null;
+        if (declared?.enabled) {
+          if (!sidecar) {
+            throw Object.assign(
+              new Error(
+                "budgeted stream session is missing its budget sidecar",
+              ),
+              { code: "CC_SESSION_BUDGET_SIDECAR_REQUIRED" },
+            );
+          }
+          if (
+            requested &&
+            JSON.stringify(requested) !== JSON.stringify(declared)
+          ) {
+            throw Object.assign(
+              new Error("stream budget does not match its JSONL declaration"),
+              { code: "CC_SESSION_BUDGET_CONFIG_MISMATCH" },
+            );
+          }
+          effectiveBudgetConfig = declared;
+        } else if (requested || sidecar) {
+          throw Object.assign(
+            new Error("existing stream has no canonical budget declaration"),
+            { code: "CC_SESSION_BUDGET_JSONL_REQUIRED" },
+          );
+        }
+      }
+    }
+    scopedOptions = {
+      ...scopedOptions,
+      sessionBudgetRoot: effectiveBudgetConfig,
+    };
     budgetRoot = openProductionSessionBudgetRoot(
       persist ? sessionId : null,
-      options.sessionBudgetRoot,
+      effectiveBudgetConfig,
       {
         persist,
         signal: scopedOptions.signal || null,
-        table: options.sessionBudgetRoot?.table,
+        table: effectiveBudgetConfig?.table,
         open: deps.openSessionBudget,
         store: deps.sessionBudgetStore,
         registry: deps.sessionBudgetRegistry,
@@ -1476,11 +1575,40 @@ async function withStreamSessionHostLease(options, deps, streamCleanup, task) {
     if (budgetRoot.enabled) {
       scopedOptions = { ...scopedOptions, ...budgetRoot.options };
     }
+    taskStarted = true;
     return await task(scopedOptions, {
       ...deps,
       [STREAM_SESSION_ID]: sessionId,
       [STREAM_SESSION_HOST_LEASE]: lease,
     });
+  } catch (error) {
+    // Admission can write a lease or take the Linux budget-sidecar read lock
+    // before the workspace runner installs its persistence boundary. Preserve
+    // the lock's filesystem cause, but never reclassify an executing task.
+    if (taskStarted) throw error;
+    const persistence = projectSessionPersistenceFailure(
+      createSessionPersistenceFailure(error, {
+        sessionId,
+        operation: "session-start",
+      }),
+      { phase: "before-model" },
+    );
+    if (!persistence) throw error;
+    deps.writeOut(
+      `${JSON.stringify({
+        type: "result",
+        subtype: "error_persistence",
+        is_error: true,
+        code: persistence.code,
+        error: "Canonical stream admission failed",
+        session_id: sessionId,
+        persistence,
+      })}\n`,
+    );
+    deps.writeErr(
+      `${persistence.code}: canonical stream admission was refused\n`,
+    );
+    return { exitCode: 1, turns: 0, persistence };
   } finally {
     budgetRoot?.close?.();
     if (lease?.signal && onLeaseAbort) {
@@ -1914,7 +2042,29 @@ async function runAgentHeadlessStreamInWorkspace(
           };
         }
       }
-    } catch {
+    } catch (error) {
+      const persistence = projectSessionPersistenceFailure(
+        createSessionPersistenceFailure(error, {
+          sessionId,
+          operation: "session-start",
+        }),
+        { phase: "before-model" },
+      );
+      if (persistence) {
+        emit({
+          type: "result",
+          subtype: "error_persistence",
+          is_error: true,
+          code: persistence.code,
+          error: "Canonical stream session preparation failed",
+          session_id: sessionId,
+          persistence,
+        });
+        writeErr(
+          `${persistence.code}: canonical stream preparation was refused\n`,
+        );
+        return { exitCode: 1, turns: 0, persistence };
+      }
       const code = "CC_SESSION_HOST_SNAPSHOT_UNVERIFIED";
       emit({
         type: "result",
@@ -1986,8 +2136,9 @@ async function runAgentHeadlessStreamInWorkspace(
       const { loadHooks, projectHookTrustNotice, attachAuthorityErrors } =
         await import("../lib/settings-hooks.cjs");
       const loaded = loadHooks({ cwd, settingsFile: options.settingsFile });
-      const { mergePluginHooks } =
-        await import("../lib/plugin-runtime/hooks.js");
+      const { mergePluginHooks } = await import(
+        "../lib/plugin-runtime/hooks.js"
+      );
       const effectiveHooks = mergePluginHooks(
         attachAuthorityErrors(loaded.hooks, loaded.authorityErrors),
         { cwd },
@@ -2069,8 +2220,9 @@ async function runAgentHeadlessStreamInWorkspace(
     });
 
   if (managedSettings) {
-    const { assertManagedPermissionMode } =
-      await import("../lib/settings-loader.cjs");
+    const { assertManagedPermissionMode } = await import(
+      "../lib/settings-loader.cjs"
+    );
     assertManagedPermissionMode(options.permissionMode, managedSettings);
   }
   const perm = resolvePermissionMode(options.permissionMode);
@@ -2909,8 +3061,9 @@ async function runAgentHeadlessStreamInWorkspace(
     : null;
   if (!instructionExcludes) {
     try {
-      const { readStringArraySetting } =
-        await import("../lib/settings-loader.cjs");
+      const { readStringArraySetting } = await import(
+        "../lib/settings-loader.cjs"
+      );
       const fromSettings = readStringArraySetting("instructionExcludes", {
         cwd,
         settingsFile: options.settingsFile,
@@ -2975,8 +3128,9 @@ async function runAgentHeadlessStreamInWorkspace(
   // Best-effort; no-op when project memory is off or no hook is registered.
   if (settingsHooks && _loadedInstructions) {
     try {
-      const { runInstructionsLoadedHooks } =
-        await import("../lib/settings-hook-events.js");
+      const { runInstructionsLoadedHooks } = await import(
+        "../lib/settings-hook-events.js"
+      );
       const ctx = (
         await runInstructionsLoadedHooks(settingsHooks, {
           files: _loadedInstructions.files,
@@ -3018,8 +3172,9 @@ async function runAgentHeadlessStreamInWorkspace(
   // settings.json SessionStart hooks → inject session context once (observe-only).
   if (settingsHooks) {
     try {
-      const { runSessionStartHooks } =
-        await import("../lib/settings-hook-events.js");
+      const { runSessionStartHooks } = await import(
+        "../lib/settings-hook-events.js"
+      );
       const ctx = (
         await runSessionStartHooks(settingsHooks, {
           source: "startup",
@@ -3069,6 +3224,9 @@ async function runAgentHeadlessStreamInWorkspace(
             provider,
             model,
             observabilityScope: options.observabilityScope,
+            ...(options.sessionBudgetRoot?.enabled === true
+              ? { sessionBudgetRoot: options.sessionBudgetRoot }
+              : {}),
             executionLocation: captureAmbientExecutionLocation({
               provider,
               model,
@@ -3453,8 +3611,9 @@ async function runAgentHeadlessStreamInWorkspace(
   // the single-prompt runner + the REPL /add-dir path. Best-effort.
   if (hostMcp?.mcpClient && additionalDirectories.length > 0) {
     try {
-      const { notifyMcpRootsChanged, workspaceRootDirs } =
-        await import("../repl/add-dir.js");
+      const { notifyMcpRootsChanged, workspaceRootDirs } = await import(
+        "../repl/add-dir.js"
+      );
       notifyMcpRootsChanged(
         [hostMcp.mcpClient],
         workspaceRootDirs(options.cwd || process.cwd(), additionalDirectories),
@@ -4376,15 +4535,17 @@ async function runAgentHeadlessStreamInWorkspace(
             return compactionCallId;
           },
         };
-        const { resolveCliContextMemoryCutover } =
-          await import("../lib/context-memory-kernel/authority.js");
+        const { resolveCliContextMemoryCutover } = await import(
+          "../lib/context-memory-kernel/authority.js"
+        );
         const cutover = resolveCliContextMemoryCutover({
           env: options.contextMemoryEnv || process.env,
           scopeKey: `cli:session:${sessionId}`,
         });
         if (cutover.canonical) {
-          const { compactLiveMessagesCanonical } =
-            await import("../lib/context-memory-kernel/live-compaction.js");
+          const { compactLiveMessagesCanonical } = await import(
+            "../lib/context-memory-kernel/live-compaction.js"
+          );
           const canonical = await compactLiveMessagesCanonical(messages, {
             compressor: {
               maxTokens: Math.max(
@@ -4472,8 +4633,9 @@ async function runAgentHeadlessStreamInWorkspace(
       } catch (error) {
         if (isAbortError(error) || options.signal?.aborted) throw error;
         if (error?.runtimeLedgerPersistence === true) throw error;
-        const { getRejectedCompactionUsage } =
-          await import("../lib/context-memory-kernel/live-compaction.js");
+        const { getRejectedCompactionUsage } = await import(
+          "../lib/context-memory-kernel/live-compaction.js"
+        );
         const rejectedUsage = getRejectedCompactionUsage(error);
         if (
           rejectedUsage &&
@@ -4901,8 +5063,9 @@ async function runAgentHeadlessStreamInWorkspace(
       // session can honour the user's standing preferences ("越用越聪明"
       // flywheel). Best-effort — a learning ledger must never break the chat.
       try {
-        const { appendFeedback } =
-          await import("../lib/pdh-feedback-ledger.js");
+        const { appendFeedback } = await import(
+          "../lib/pdh-feedback-ledger.js"
+        );
         appendFeedback({ sessionId, turnId, kind, comment });
       } catch {
         /* persistence is best-effort */
@@ -5074,8 +5237,9 @@ async function runAgentHeadlessStreamInWorkspace(
     // settings.json UserPromptSubmit hooks. block → skip this turn; context → inject.
     if (settingsHooks) {
       try {
-        const { runUserPromptSubmitHooks } =
-          await import("../lib/settings-hook-events.js");
+        const { runUserPromptSubmitHooks } = await import(
+          "../lib/settings-hook-events.js"
+        );
         const ups = await runUserPromptSubmitHooks(settingsHooks, {
           prompt: userContent,
           cwd,