chainlesschain 0.166.129 → 0.166.131

package/src/lib/usage-pricing-context.js

@@ -50,6 +50,25 @@ export function projectCacheCreationUsage(usage = {}) {
   const hasFlat =
     Object.hasOwn(usage, "cacheCreation5mTokens") ||
     Object.hasOwn(usage, "cacheCreation1hTokens");
+  const hasOpenAI =
+    Object.hasOwn(usage, "cacheCreation30mTokens") ||
+    Object.hasOwn(usage, "cacheCreation12hTokens");
+  if (hasOpenAI) {
+    const thirty = usage.cacheCreation30mTokens;
+    const twelve = usage.cacheCreation12hTokens;
+    const total =
+      usage.cache_creation_input_tokens ?? usage.cacheCreationTokens;
+    if (
+      hasFlat ||
+      Object.hasOwn(usage, "cache_creation") ||
+      ![thirty, twelve, total].every(
+        (n) => Number.isSafeInteger(n) && n >= 0,
+      ) ||
+      thirty + twelve !== total
+    )
+      return { cacheCreationInvalid: true };
+    return { cacheCreation30mTokens: thirty, cacheCreation12hTokens: twelve };
+  }
   if (!Object.hasOwn(usage, "cache_creation") && !hasFlat) return {};
   if (
     Object.hasOwn(usage, "cache_creation") &&
@@ -150,9 +169,17 @@ export function mergeUsagePricingBucket(entry, usage) {
   const cache = projectCacheCreationUsage(usage);
   const cacheEvidence = cache.cacheCreationInvalid
     ? "invalid"
-    : cache.cacheCreation5mTokens != null
-      ? "split"
-      : "missing";
+    : cache.cacheCreation30mTokens != null
+      ? "openai-split"
+      : cache.cacheCreation5mTokens != null
+        ? "split"
+        : "missing";
+  const cacheFields =
+    cacheEvidence === "openai-split"
+      ? ["cacheCreation30mTokens", "cacheCreation12hTokens"]
+      : cacheEvidence === "split"
+        ? ["cacheCreation5mTokens", "cacheCreation1hTokens"]
+        : [];
   const serviceTier = metadata.service_tier || "standard";
   const regionalProcessing = metadata.regional_processing === true;
   entry.pricingBuckets ||= [];
@@ -176,17 +203,9 @@ export function mergeUsagePricingBucket(entry, usage) {
       regionalProcessing,
       requestInputTokens: promptTokens,
       ...(pricingContextInvalid ? { pricingContextInvalid: true } : {}),
-      ...(provider === "anthropic"
-        ? {
-            cacheEvidence,
-            ...(cacheEvidence === "split"
-              ? { cacheCreation5mTokens: 0, cacheCreation1hTokens: 0 }
-              : {}),
-            ...(cacheEvidence === "invalid"
-              ? { cacheCreationInvalid: true }
-              : {}),
-          }
-        : {}),
+      cacheEvidence,
+      ...Object.fromEntries(cacheFields.map((key) => [key, 0])),
+      ...(cacheEvidence === "invalid" ? { cacheCreationInvalid: true } : {}),
     };
     entry.pricingBuckets.push(bucket);
   }
@@ -197,9 +216,7 @@ export function mergeUsagePricingBucket(entry, usage) {
     "cacheCreationTokens",
     "totalTokens",
     "calls",
-    ...(cacheEvidence === "split"
-      ? ["cacheCreation5mTokens", "cacheCreation1hTokens"]
-      : []),
+    ...cacheFields,
   ]) {
     const value = cache[key] ?? usage[key] ?? (key === "calls" ? 1 : 0);
     if (

package/src/repl/agent-repl.js

@@ -167,7 +167,14 @@ import {
 import { formatBackgroundTasks } from "./tasks-status.js";
 import { expandFileRefsAsync } from "../runtime/file-ref-expander.js";
 import { prepareVisionTurn, resolveVisionLlm } from "../lib/image-input.js";
-import { composeSystemPrompt } from "../runtime/system-prompt.js";
+import {
+  composeSystemPrompt,
+  hostProjectMemoryMode,
+} from "../runtime/system-prompt.js";
+import {
+  createCompactionHostContextRefresher,
+  refreshCompactionHostContext,
+} from "../runtime/compaction-host-context.js";
 import { installPipeSafety } from "../runtime/pipe-safety.js";
 import { installOutputBackpressure } from "../runtime/output-backpressure.js";
 import {
@@ -4212,7 +4219,10 @@ async function startAgentReplInWorkspaceOwned(
       {
         systemPrompt: options.systemPrompt,
         appendSystemPrompt: options.appendSystemPrompt,
-        projectMemory: _leanNoProjectMemory ? false : undefined,
+        cwd: process.cwd(),
+        projectMemory: _leanNoProjectMemory
+          ? false
+          : hostProjectMemoryMode(options.projectMemory),
         onInstructionsLoaded: (loaded) => {
           _loadedReplInstructions = loaded;
         },
@@ -4870,6 +4880,18 @@ async function startAgentReplInWorkspaceOwned(
   // any canonical/legacy replay is appended. Later live switches refresh only
   // entry 0 from the active base prompt; they never re-scan old session systems.
   _registerHostSystemMessages();
+  const _projectContextRefresher = createCompactionHostContextRefresher({
+    messages,
+    render: () => {
+      _replBaseSystem = _buildReplBaseSystem();
+      return _activeOutputStyle?.body
+        ? `${_replBaseSystem}\n\n${_activeOutputStyle.body}`
+        : _replBaseSystem;
+    },
+    onUpdated: () => _refreshHostSystemMessages(),
+  });
+  const _refreshProjectContext = () =>
+    refreshCompactionHostContext(_projectContextRefresher, messages);
 
   let _startupResumeCommitted = false;
   // Load resumed session messages
@@ -7448,6 +7470,13 @@ async function startAgentReplInWorkspaceOwned(
         return;
       }
 
+      try {
+        _refreshProjectContext();
+      } catch (error) {
+        logger.error(error.message);
+        prompt();
+        return;
+      }
       const expectedMessages = [...messages];
       if (_compressor && messages.length > 3) {
         let result;
@@ -9817,6 +9846,7 @@ async function startAgentReplInWorkspaceOwned(
       }
       const activeMcpRuntime = _activateMcpHostRuntime();
       const activeRawMcpClient = activeMcpRuntime.rawClient || undefined;
+      _refreshProjectContext();
       const {
         content: response,
         usageEvents,
@@ -9939,6 +9969,7 @@ async function startAgentReplInWorkspaceOwned(
         mcpClient: activeRawMcpClient,
         mcpHostClient: activeMcpRuntime.runtime.client,
         extraToolDefinitions: _adhocMcp?.extraToolDefinitions,
+        mcpToolCatalog: _adhocMcp?.mcpToolCatalog || null,
         externalToolExecutors: _adhocMcp?.externalToolExecutors,
         externalToolDescriptors: _adhocMcp?.externalToolDescriptors,
         // The recovery controller is required even when this legacy/ephemeral
@@ -10174,6 +10205,7 @@ async function startAgentReplInWorkspaceOwned(
         _compressor.shouldAutoCompact(messages)
       ) {
         try {
+          _refreshProjectContext();
           const expectedMessages = [...messages];
           const {
             messages: compacted,

package/src/runtime/agent-core.js

@@ -216,6 +216,19 @@ import {
   buildToolAttribution,
 } from "../lib/agent-tool-admission.js";
 import { captureAgentExecutionPolicy } from "../lib/agent-execution-policy.js";
+import { ephemeralWorktreeConsumerRefusal } from "../lib/ephemeral-worktree-scope.js";
+import {
+  COMPACTION_CONTEXT_REFRESH_ERROR,
+  refreshCompactionHostContext,
+} from "./compaction-host-context.js";
+import {
+  assertMcpCatalogBinding,
+  captureMcpToolCatalog,
+  mergeMcpToolCatalog,
+  projectMcpToolCatalog,
+  readMcpToolCatalog,
+  restrictMcpToolCatalog,
+} from "../lib/mcp-tool-catalog-authority.js";
 import {
   evaluateUnattendedToolAction,
   evaluateUnattendedGitAction,
@@ -4040,6 +4053,8 @@ export async function executeTool(name, args, context = {}) {
       externalToolDescriptors: context.externalToolDescriptors || null,
       externalToolExecutors: context.externalToolExecutors || null,
       mcpClient: context.mcpClient || null,
+      mcpToolCatalog: context.mcpToolCatalog || null,
+      mcpCatalogBinding: context.mcpCatalogBinding || null,
       mcpHostClient: context.mcpHostClient || context.mcpClient || null,
       mcpCallLedger: context.mcpCallLedger || null,
       mcpConflictScheduler: context.mcpConflictScheduler || null,
@@ -5656,6 +5671,8 @@ async function executeToolInner(
     externalToolExecutors,
     extraToolDefinitions = null,
     mcpClient,
+    mcpToolCatalog = null,
+    mcpCatalogBinding = null,
     mcpHostClient = mcpClient,
     mcpCallLedger = null,
     mcpConflictScheduler = null,
@@ -6221,6 +6238,10 @@ async function executeToolInner(
       // Bound the declared run_shell data once. Approval and dispatch never
       // observe later mutation of the caller-owned tool arguments.
       args = Object.isFrozen(args) ? args : snapshotShellExecutionArgs(args);
+      if (args.run_in_background === true) {
+        const refusal = ephemeralWorktreeConsumerRefusal("Background shell");
+        if (refusal) return attachDescriptor(refusal);
+      }
       if (unattendedActionPolicy?.unattended === true) {
         const unattendedVerdict = evaluateUnattendedShellAction(args.command, {
           ...unattendedActionPolicy,
@@ -7888,6 +7909,8 @@ async function executeToolInner(
           // filtered by the resolved contract's mcpServers allow-list.
           mcpClient,
           mcpHostClient,
+          mcpToolCatalog,
+          mcpCatalogBinding,
           mcpCallLedger,
           mcpConflictScheduler,
           mcpDispatchAdmission,
@@ -8243,6 +8266,14 @@ async function executeToolInner(
     }
 
     case "schedule": {
+      if (
+        ["wakeup", "cron", "monitor"].includes(
+          String(args.action || "").toLowerCase(),
+        )
+      ) {
+        const refusal = ephemeralWorktreeConsumerRefusal("Deferred schedule");
+        if (refusal) return attachDescriptor(refusal);
+      }
       try {
         const { AgentScheduleStore } = await import(
           "../lib/agent-schedule-store.js"
@@ -8992,6 +9023,16 @@ async function executeToolInner(
         });
       }
 
+      if (match.isolation === true) {
+        const refusal = ephemeralWorktreeConsumerRefusal(
+          "Isolated skill child",
+        );
+        if (refusal) {
+          skillExecutionLease?.release?.();
+          return attachDescriptor(refusal);
+        }
+      }
+
       const selectedSkillDigest =
         match.executionIdentity?.contentDigest ||
         `sha256:${createHash("sha256").update(admittedSkillBody).digest("hex")}`;
@@ -9676,6 +9717,11 @@ async function executeToolInner(
       // MCP tool schemas from the registry attached at setup time. Read-only,
       // local — same risk class as list_skills, so no approval gate.
       if (localToolExecutor?.kind === "tool-search") {
+        try {
+          assertMcpCatalogBinding(mcpCatalogBinding, name);
+        } catch (error) {
+          return attachDescriptor({ error: error.message, code: error.code });
+        }
         return attachDescriptor(
           executeToolSearch(localToolExecutor.registry, args || {}, {
             allowedToolNames: effectiveAllowedToolNames,
@@ -9722,6 +9768,11 @@ async function executeToolInner(
       }
 
       if (localToolExecutor?.kind === "mcp") {
+        try {
+          assertMcpCatalogBinding(mcpCatalogBinding, name);
+        } catch (error) {
+          return attachDescriptor({ error: error.message, code: error.code });
+        }
         if (!mcpClient || typeof mcpClient.callTool !== "function") {
           return attachDescriptor({
             error: `MCP client is unavailable for tool: ${name}`,
@@ -9757,6 +9808,18 @@ async function executeToolInner(
         }
 
         const schedulerScopes = mcpLedgerScopes(mcpWireInput);
+        const catalogDispatchAdmission = mcpCatalogBinding
+          ? (metadata, dispatch) => {
+              assertMcpCatalogBinding(mcpCatalogBinding, name);
+              const admittedDispatch = () => {
+                assertMcpCatalogBinding(mcpCatalogBinding, name);
+                return dispatch();
+              };
+              return mcpDispatchAdmission
+                ? mcpDispatchAdmission(metadata, admittedDispatch)
+                : admittedDispatch();
+            }
+          : mcpDispatchAdmission;
         const ledgerEffectContract = mcpLedgerEffectContract(
           localToolDescriptor,
           hostToolPolicy,
@@ -9869,16 +9932,17 @@ async function executeToolInner(
 
           let pendingResult;
           try {
+            assertMcpCatalogBinding(mcpCatalogBinding, name);
             const callArguments = [
               localToolExecutor.serverName,
               localToolExecutor.toolName,
               mcpWireInput,
             ];
-            if (signal || mcpDispatchAdmission || workflowEffectId) {
+            if (signal || catalogDispatchAdmission || workflowEffectId) {
               callArguments.push({
                 ...(signal ? { signal } : {}),
-                ...(mcpDispatchAdmission
-                  ? { dispatchAdmission: mcpDispatchAdmission }
+                ...(catalogDispatchAdmission
+                  ? { dispatchAdmission: catalogDispatchAdmission }
                   : {}),
                 ...(workflowEffectId
                   ? {
@@ -11164,6 +11228,13 @@ async function _executeSpawnSubAgent(args, ctx) {
     };
   }
 
+  const wantsBackground =
+    args.background === true || effectiveContract?.background === true;
+  if (wantsBackground) {
+    const refusal = ephemeralWorktreeConsumerRefusal("Background sub-agent");
+    if (refusal) return refusal;
+  }
+
   // Filter the parent loop's live MCP plumbing + settings hooks down to what the
   // child may inherit. Default `[]` → null → the spawn passes nothing, so a plain
   // sub-agent is byte-identical to before.
@@ -11262,6 +11333,9 @@ async function _executeSpawnSubAgent(args, ctx) {
 
   // A child can never regain a tool omitted from the parent's effective schema.
   // `[]` remains deny-all all the way into the child's execution-time fence.
+  let requestedMcpTools = Array.isArray(allowedTools)
+    ? Object.freeze([...allowedTools])
+    : null;
   if (Array.isArray(ctx.effectiveAllowedToolNames)) {
     const parentCeiling = new Set(ctx.effectiveAllowedToolNames);
     const requested = Array.isArray(allowedTools)
@@ -11302,6 +11376,7 @@ async function _executeSpawnSubAgent(args, ctx) {
       const perm = resolvePermissionMode(effectiveContract.permissionMode);
       if (perm.readOnly) {
         allowedTools = resolveEnabledTools({ allowedTools, readOnly: true });
+        requestedMcpTools = allowedTools;
       }
       // autopilot ⟺ bypassPermissions — the only mode whose headless confirmer
       // ALLOWS. Threading a deny confirmer would needlessly disable the child's
@@ -11326,6 +11401,29 @@ async function _executeSpawnSubAgent(args, ctx) {
     }
   }
 
+  let childMcpCatalog = null;
+  if (
+    ctx.mcpToolCatalog &&
+    !(Array.isArray(mcpAllow) && mcpAllow.length === 0)
+  ) {
+    try {
+      const { createInheritedMcpToolCatalog } = await import(
+        "../lib/subagent-inheritance.js"
+      );
+      childMcpCatalog = createInheritedMcpToolCatalog(
+        ctx,
+        mcpAllow,
+        requestedMcpTools,
+        allowedTools,
+      );
+      inheritedMcp = readMcpToolCatalog(childMcpCatalog);
+    } catch (error) {
+      return {
+        error: `spawn_sub_agent: live MCP inheritance failed closed (${error.message}).`,
+      };
+    }
+  }
+
   // Build a structured parent handoff if the caller did not provide explicit
   // An explicit `contextMode: fresh` contract suppresses this inheritance (the
   // child starts clean); `fork` / unset keep deterministic auto-inheritance.
@@ -11589,6 +11687,7 @@ async function _executeSpawnSubAgent(args, ctx) {
   const subCtx = SubAgentContext.create({
     role,
     task,
+    signal: ctx.signal || null,
     parentId: parentSessionId,
     // Hook-envelope tracing: the child loop stamps its own runId as trace_id
     // and THIS run's id as parent_id on every settings-hook payload it fires.
@@ -11659,6 +11758,7 @@ async function _executeSpawnSubAgent(args, ctx) {
     ...(inheritedMcp
       ? {
           extraToolDefinitions: inheritedMcp.extraToolDefinitions,
+          mcpToolCatalog: childMcpCatalog,
           externalToolDescriptors: inheritedMcp.externalToolDescriptors,
           externalToolExecutors: inheritedMcp.externalToolExecutors,
           mcpClient: inheritedMcp.mcpClient,
@@ -11788,8 +11888,6 @@ async function _executeSpawnSubAgent(args, ctx) {
   // detached without the caller passing it. `effectiveContract.background`
   // already folds in `args.background`; the explicit OR keeps the path
   // byte-identical if contract resolution was skipped (effectiveContract null).
-  const wantsBackground =
-    args.background === true || effectiveContract?.background === true;
   if (wantsBackground && ctx.backgroundSubAgents instanceof Map) {
     // Cancel with the parent: forward the loop's abort signal so killing the
     // run doesn't orphan a detached child mid-LLM-call.
@@ -13581,6 +13679,31 @@ const _CHECKPOINT_READ_ONLY = new Set([
   "search_sessions",
 ]);
 
+function isCheckpointReadOnly(toolContext, toolName, toolArgs) {
+  if (_CHECKPOINT_READ_ONLY.has(toolName)) return true;
+  if (
+    toolName !== "git" ||
+    toolContext.externalToolExecutors?.git ||
+    !isReadOnlyGitCommand(toolArgs?.command)
+  )
+    return false;
+  const command = normalizeGitCommand(toolArgs.command);
+  if (gitToolInputError(command)) return false;
+  // Read commands can explicitly write output or invoke external drivers.
+  // Keep their recovery snapshot, including abbreviated long options.
+  const args = tokenizeShellWords(command).slice(1);
+  const separator = args.indexOf("--");
+  return !(separator < 0 ? args : args.slice(0, separator)).some((arg) => {
+    const option = arg.split("=", 1)[0];
+    return (
+      option.startsWith("--") &&
+      ["--output", "--ext-diff", "--textconv"].some((flag) =>
+        flag.startsWith(option),
+      )
+    );
+  });
+}
+
 // Rolling cap on auto-checkpoints per agent session — the engine prunes the
 // oldest beyond this so a long run can't accumulate unbounded refs.
 const MAX_AUTO_CHECKPOINTS_PER_SESSION = 100;
@@ -13603,7 +13726,7 @@ function _loadCheckpointStore() {
  */
 async function _autoCheckpointBeforeTool(toolContext, toolName, toolArgs) {
   if (!toolContext?.autoCheckpoint) return null;
-  if (_CHECKPOINT_READ_ONLY.has(toolName)) return null;
+  if (isCheckpointReadOnly(toolContext, toolName, toolArgs)) return null;
   const cwd = toolContext.cwd || process.cwd();
   try {
     const store = await _loadCheckpointStore();
@@ -14690,6 +14813,20 @@ export async function* agentLoop(messages, options) {
     ...options,
     ...executionPolicy,
   };
+  if (options.mcpToolCatalog != null) {
+    captureMcpToolCatalog(options.mcpToolCatalog);
+    // Host publication is the only live extension path. Do not let unrelated
+    // caller-owned startup arrays acquire new authority during a refresh.
+    options.extraToolDefinitions = Object.freeze([
+      ...(options.extraToolDefinitions || []),
+    ]);
+    options.externalToolDescriptors = Object.freeze({
+      ...options.externalToolDescriptors,
+    });
+    options.externalToolExecutors = Object.freeze({
+      ...options.externalToolExecutors,
+    });
+  }
   const configuredChatFn = options.chatFn;
   const evolutionIngress =
     options.evolutionIngress == null
@@ -14832,19 +14969,36 @@ export async function* agentLoop(messages, options) {
     );
   }
 
-  const effectiveToolOptions = hermeticExecution
+  const mcpToolCatalog = hermeticExecution
+    ? null
+    : captureMcpToolCatalog(options.mcpToolCatalog);
+  const loopMcpCatalog = mcpToolCatalog
+    ? projectMcpToolCatalog(mcpToolCatalog, (snapshot) =>
+        restrictMcpToolCatalog(
+          snapshot,
+          getEffectiveToolDefinitions(
+            mergeMcpToolCatalog(options, snapshot, mcpToolCatalog),
+          ).map((tool) => tool.function.name),
+        ),
+      )
+    : null;
+  let currentMcpSnapshot = readMcpToolCatalog(loopMcpCatalog);
+  let effectiveToolOptions = hermeticExecution
     ? {
         ...options,
         hostManagedToolPolicy: null,
         hostManagedToolPolicyAuthority: null,
         extraToolDefinitions: [],
       }
-    : options;
-  const effectiveAllowedToolNames = Object.freeze(
+    : currentMcpSnapshot
+      ? mergeMcpToolCatalog(options, currentMcpSnapshot, mcpToolCatalog)
+      : options;
+  let effectiveAllowedToolNames = Object.freeze(
     getEffectiveToolDefinitions(effectiveToolOptions).map(
       (tool) => tool.function.name,
     ),
   );
+  const startupToolNames = new Set(effectiveAllowedToolNames);
   if (
     fileMutationScope &&
     effectiveAllowedToolNames.some(
@@ -14926,6 +15080,10 @@ export async function* agentLoop(messages, options) {
       ? null
       : options.extraToolDefinitions || null,
     mcpClient: hermeticExecution ? null : options.mcpClient || null,
+    mcpToolCatalog: loopMcpCatalog,
+    mcpCatalogBinding: loopMcpCatalog
+      ? { authority: loopMcpCatalog, snapshot: currentMcpSnapshot }
+      : null,
     mcpHostClient: hermeticExecution
       ? null
       : options.mcpHostClient || options.mcpClient || null,
@@ -15242,6 +15400,39 @@ export async function* agentLoop(messages, options) {
   let lastTaskProgressIntervention = null;
 
   while (budget.hasRemaining()) {
+    if (loopMcpCatalog) {
+      currentMcpSnapshot = readMcpToolCatalog(loopMcpCatalog);
+      effectiveToolOptions = mergeMcpToolCatalog(
+        options,
+        currentMcpSnapshot,
+        mcpToolCatalog,
+      );
+      effectiveAllowedToolNames = Object.freeze(
+        getEffectiveToolDefinitions(effectiveToolOptions)
+          .map((tool) => tool.function.name)
+          .filter(
+            (name) =>
+              startupToolNames.has(name) ||
+              currentMcpSnapshot.identities.has(name),
+          ),
+      );
+      effectiveToolOptions = {
+        ...effectiveToolOptions,
+        enabledToolNames: effectiveAllowedToolNames,
+        exactToolNames: true,
+      };
+      Object.assign(toolContext, {
+        extraToolDefinitions: effectiveToolOptions.extraToolDefinitions,
+        externalToolDescriptors: effectiveToolOptions.externalToolDescriptors,
+        externalToolExecutors: effectiveToolOptions.externalToolExecutors,
+        mcpClient: effectiveToolOptions.mcpClient,
+        effectiveAllowedToolNames,
+        mcpCatalogBinding: {
+          authority: loopMcpCatalog,
+          snapshot: currentMcpSnapshot,
+        },
+      });
+    }
     // Yield only between complete tool batches. Keep all completed tool results
     // and settle child usage before the host accepts queued user steering.
     if (options.shouldYieldToUser?.() === true) {
@@ -15408,6 +15599,7 @@ export async function* agentLoop(messages, options) {
     // its full tool_call→tool_result cycle before we loop, so `messages` has no
     // dangling call; `preserveToolPairs` then guarantees compaction never
     // orphans a tool result. Best-effort — a failure never aborts the run.
+    let compactionHostContextRefreshed = false;
     if (
       !independentReviewContext?.active &&
       options.autoCompact !== false &&
@@ -15428,7 +15620,7 @@ export async function* agentLoop(messages, options) {
           // micro-compact may change the working input, but the durable CAS must
           // still compare against the transcript state that existed before any
           // in-memory compaction happened.
-          const authorityExpectedMessages = [...messages];
+          let authorityExpectedMessages = [...messages];
           let workingMessages = messages;
           let microStats = null;
           // Cheap surgical pre-pass (Claude-Code microcompact parity): build a
@@ -15491,6 +15683,22 @@ export async function* agentLoop(messages, options) {
               reason: preCompactReason,
             };
           }
+          if (!hermeticExecution && options.refreshCompactionContext != null) {
+            // Hooks may update project files. Preserve the original transcript
+            // comparison before replacing only the host-owned live system base.
+            if (!_sameMessageSnapshot(messages, authorityExpectedMessages)) {
+              throw _compactionSettlementError(
+                COMPACTION_CONTEXT_REFRESH_ERROR,
+                "Session messages changed before project context refresh",
+              );
+            }
+            workingMessages = refreshCompactionHostContext(
+              options.refreshCompactionContext,
+              workingMessages,
+            );
+            authorityExpectedMessages = [...messages];
+            compactionHostContextRefreshed = true;
+          }
           // Auto-pin (OPT-IN): when enabled, the original task (first user turn)
           // is pinned so compaction can't drop it. Off by default → no predicate
           // is passed and compaction is byte-identical to before.
@@ -15790,6 +15998,7 @@ export async function* agentLoop(messages, options) {
           }
         }
       } catch (_e) {
+        if (_e?.code === COMPACTION_CONTEXT_REFRESH_ERROR) throw _e;
         if (isAbortError(_e) || signal?.aborted) throw _e;
         if (isFormalBudgetError(_e)) throw _e;
         if (_e?.runtimeLedgerPersistence === true) throw _e;
@@ -15923,6 +16132,12 @@ export async function* agentLoop(messages, options) {
       }
     }
 
+    if (compactionHostContextRefreshed) {
+      // A source file can change while the summary provider is running, or
+      // while a failed summary is falling back to the original transcript.
+      refreshCompactionHostContext(options.refreshCompactionContext, messages);
+    }
+
     // Deliver background sub-agent results that settled since the last turn:
     // inject them as user-role context so THIS LLM call sees them. (There is
     // no open tool_call to attach a late result to — the spawn call already
@@ -17279,6 +17494,7 @@ export async function* agentLoop(messages, options) {
       try {
         managedCheckpointHandle = beginManagedToolCheckpoint({
           enabled: toolContext.managedCheckpoint === true,
+          readOnly: isCheckpointReadOnly(toolContext, toolName, toolArgs),
           broker,
           workspaceRoot: toolContext.cwd || process.cwd(),
           stateDir: toolContext.managedCheckpointStateDir || undefined,

package/src/runtime/compaction-host-context.js

@@ -0,0 +1,72 @@
+import { getDurableSystemMessageProvenance } from "../lib/session-message-provenance.js";
+import { markCompactionHostBase } from "../lib/compaction-host-provenance.js";
+
+export const COMPACTION_CONTEXT_REFRESH_ERROR =
+  "CC_COMPACTION_CONTEXT_REFRESH_FAILED";
+
+/** Refresh only the base system message owned by this live host. */
+export function createCompactionHostContextRefresher({
+  messages,
+  render,
+  onUpdated,
+}) {
+  return (candidate = messages) => {
+    const current = messages[0];
+    if (
+      !current ||
+      current.role !== "system" ||
+      getDurableSystemMessageProvenance(current)
+    )
+      throw new Error("Live host base context is unavailable");
+    if (!Array.isArray(candidate) || !candidate.includes(current))
+      throw new Error(
+        "Compaction candidate does not contain the live host base context",
+      );
+    const content = render();
+    if (content && typeof content.then === "function") {
+      Promise.resolve(content).catch(() => {});
+      throw new TypeError("Host context rendering must be synchronous");
+    }
+    if (typeof content !== "string" || !content.trim())
+      throw new TypeError(
+        "Host context rendering must return a non-empty string",
+      );
+    if (messages[0] !== current)
+      throw new Error("Host base context changed during rendering");
+    if (content === current.content) {
+      markCompactionHostBase(current);
+      return candidate;
+    }
+    const replacement = markCompactionHostBase({ ...current, content });
+    const projected = candidate.map((message) =>
+      message === current ? replacement : message,
+    );
+    messages[0] = replacement;
+    onUpdated?.(replacement);
+    return candidate === messages ? messages : projected;
+  };
+}
+
+/** A failed refresh must not fall through to a model with obsolete rules. */
+export function refreshCompactionHostContext(refresh, messages) {
+  if (refresh == null) return messages;
+  try {
+    if (typeof refresh !== "function")
+      throw new TypeError("Invalid host context refresher");
+    const result = refresh(messages);
+    if (result && typeof result.then === "function") {
+      Promise.resolve(result).catch(() => {});
+      throw new TypeError("Host context refresh must be synchronous");
+    }
+    if (!Array.isArray(result))
+      throw new TypeError("Host context refresh must return messages");
+    return result;
+  } catch (cause) {
+    const error = new Error(
+      "Current project context could not be refreshed before continuing",
+      { cause },
+    );
+    error.code = COMPACTION_CONTEXT_REFRESH_ERROR;
+    throw error;
+  }
+}