chainlesschain 0.166.132 → 0.166.135

package/README.md

@@ -2,11 +2,33 @@
 
 Command-line interface for installing, configuring, and managing [ChainlessChain](https://www.chainlesschain.com), including the coding agent, governed tools, sessions, memory, and IDE integrations.
 
-## Source candidate 0.166.132 (unreleased, 2026-10-30)
+## CLI 0.166.135
 
-CLI **0.166.132** keeps Kernel **0.1.11** and pairs with Open VSX **0.37.170** / JetBrains **0.4.187** source candidates. The candidate CLI stops tools from running on a truncated response and can replan once when complete usage has been recorded and budget remains. Recovery keeps the original task available even in a small context window. Filtered responses, explicitly incomplete terminal responses, and missing task context now stop with a clear failure. Resuming a session preserves task identity when the built-in adapter combines message roles; custom callbacks and unverified metadata cannot claim that identity. After asynchronous recall, the CLI rechecks the task and its position before continuing. The readContext continuation now moves the same complete user message by its exact index, preserving metadata and avoiding duplicate task identity. The original four independent-process restart cases passed locally, and 16 host-continuation tests passed; the latest full combined validation passed 456 tests across 18 files and 10 real CLI tests across 3 files, with no skips (5 output-limit, 1 resume and 4 compaction-memory-restart). Source 7f8ef64b4bd8b429f97d2e121c440143ed7ddf3b was superseded before publication after CLI CI found four failures in each Ubuntu and Windows E2E shard 4 job (147 passed each). Its 452+6 local preparation and successful Strict Sandbox (6/6) and Kernel (3/3) checks remain historical; remaining CLI and IDE jobs were canceled, and no release tag was created. The earlier 417+5 result also remains historical. A new exact-source release matrix is required. This candidate is not published, and the original broker evaluation remains unresolved. Require complete exact-source Linux/Windows/macOS CLI CI and Strict Sandbox, OIDC publication and public readback before releasing the paired IDEs. The verified public versions and installation below remain **0.166.131 / 0.37.169 / 0.4.186**; PC/mobile remain independent **v5.0.3.143**.
+This release recovers genuine OpenAI Responses JSON disconnects before accepted output, bounds stalled requests, and settles completed streaming responses without waiting for socket EOF. It preserves empty tool allowlists across resume and rejects malformed saved permission, sandbox and budget settings. HTTP/provider failures, cancellation, usage persistence and incomplete tool-call replay protections remain authoritative.
 
-## CLI 0.166.131 — current public release (2026-10-29)
+Install with `npm i -g chainlesschain@0.166.135 --registry https://registry.npmjs.org`, restart the chat host, then run `cc --version` and `cc doctor`. Paired IDE versions are Open VSX **0.37.172** and JetBrains **0.4.189**, recommending CLI **0.166.135**; Kernel stays **0.1.11**. Check the [release guide](https://docs.chainlesschain.com/chainlesschain/agent-platform-release.html) for channel publication status. Microsoft Marketplace and PC/mobile releases are outside this release scope.
+
+The preceding OpenAI native cohort accepted **39/45** tasks. Runtime regression tests and this release do not change that historical result or establish formal paid/native production admission.
+
+## CLI 0.166.133 — verified preceding release
+
+CLI **0.166.133** is published on npm. It preserves required empty OpenAI Responses reasoning summaries, applies the self-evolution switch to all model-owning `cc ui` entry points, and supports explicitly configured OpenAI-compatible local/LAN platforms through `custom`, with optional credentials and unchanged endpoint/model aliases. It also exposes canonical allowed mutation paths in provider tool schemas while retaining execution-time scope and file-identity checks. Controlled regressions and release gates do not establish live-platform task acceptance.
+
+Install with `npm i -g chainlesschain@0.166.133 --registry https://registry.npmjs.org`, restart the chat host, then run `cc --version` and `cc doctor`. Companion Open VSX **0.37.171** / JetBrains **0.4.188** are public and recommend this CLI; their original payloads match the official artifacts. Kernel stays **0.1.11**. Exact source `2eb0c5b1e048509362f9d980f94acee55c2ffa9f` passed Linux, Windows and macOS CLI CI / CLI Strict Sandbox. [OIDC publication](https://github.com/chainlesschain/chainlesschain/actions/runs/41073612529) and [independent readback](https://github.com/chainlesschain/chainlesschain/actions/runs/41075409835) verified immutable package bytes and signed provenance. Consult the [current release guide](https://docs.chainlesschain.com/chainlesschain/agent-platform-release.html) for IDE channel availability. Microsoft Marketplace and PC/mobile releases are outside this release scope.
+
+## CLI 0.166.132 — verified public baseline before this source revision
+
+Install: `npm i -g chainlesschain@0.166.132 --registry https://registry.npmjs.org`. Public Open VSX **0.37.170** and approved JetBrains **0.4.187** recommend this CLI; Kernel **0.1.11** is verified upstream. Restart the chat host, then run `cc --version` and `cc doctor`.
+
+This release stops tool execution on truncated responses and permits one replan when complete usage is recorded and budget remains. Recovery preserves the original task, including through role combination, asynchronous recall and readContext continuation. Filtered or incomplete terminal responses and missing task context stop with a clear failure. No independent IDE UI change is included.
+
+Release source: [772fcdbda85bcf91df95bfced5b476dcf4c74614](https://github.com/chainlesschain/chainlesschain/commit/772fcdbda85bcf91df95bfced5b476dcf4c74614). Exact-source [validation gates](https://github.com/chainlesschain/chainlesschain/blob/0d57ebfea919ae941a36a1f11a9ee10964722120/docs/research/cli/evidence/release132-public/gates.json), [OIDC publication run](https://github.com/chainlesschain/chainlesschain/actions/runs/40985169005), [official artifact](https://github.com/chainlesschain/chainlesschain/actions/runs/40985169005/artifacts/12946249806), [independent readback run](https://github.com/chainlesschain/chainlesschain/actions/runs/40986625203), and [public CLI readback](https://github.com/chainlesschain/chainlesschain/blob/0d57ebfea919ae941a36a1f11a9ee10964722120/docs/research/cli/evidence/release132-public/cli.json) identify this public package. [Three-package publication evidence](https://github.com/chainlesschain/chainlesschain/blob/0d57ebfea919ae941a36a1f11a9ee10964722120/docs/research/cli/evidence/release132-public/publication.json).
+
+At historical source `abbe13ad3658ff9e2e100989a4cfefc409d9261c`, the combined local suite actually ran **456 tests across 18 files + 10 real CLI tests across 3 files**, with no skips. Subsequent fixture and native-preflight repairs compared the selected runtime components byte for byte; release source `772fcdbda85bcf91df95bfced5b476dcf4c74614` did **not** repeat that combined local suite. [Component scope evidence](https://github.com/chainlesschain/chainlesschain/blob/0d57ebfea919ae941a36a1f11a9ee10964722120/docs/research/cli/evidence/release132-native-preflight-2026-10-30/review.json) and the release source's [cloud gates](https://github.com/chainlesschain/chainlesschain/blob/0d57ebfea919ae941a36a1f11a9ee10964722120/docs/research/cli/evidence/release132-public/gates.json) retain this distinction. Failed source `40753f179a3dc18760bd64a754b28a46ba718f57` and the earlier superseded `7f8ef64b4bd8b429f97d2e121c440143ed7ddf3b` remain historical; their successful checks do not transfer to this release.
+
+Automatic acceptance remains **34/45**, with **11** unfinished; **3 assisted deliveries** are recorded separately and are not added to that total. The original broker **403** and Memory cold SLO remain unresolved. Publication adds no task acceptance or paid/native admission: **NOT_PAID_READY / NOT_ADMITTED / HOLD** remain. Microsoft Marketplace remains deferred. PC/mobile **v5.0.3.143** remain independent.
+
+## CLI 0.166.131 — previous public release (2026-10-29)
 
 Install: `npm i -g chainlesschain@0.166.131 --registry https://registry.npmjs.org`. Kernel **0.1.11** was published first. Restart the chat host, then run `cc --version` and `cc doctor`. Public Open VSX **0.37.169** / JetBrains **0.4.186** both recommend CLI **0.166.131**; their downloaded packages match the official CI payloads. Microsoft Marketplace is deferred.
 
@@ -64,7 +86,7 @@ Ordinary Agent, `ask`, `chat` and `cc ui` use self-evolution only when enabled.
 
 Run `cc config set evolution.enabled true` to opt in, or `cc config set evolution.enabled false` to switch off. `cc evolution deployment enable` initializes the local signed runtime when needed; `cc evolution deployment disable` turns it off and retains deployment data. `cc evolution deployment status --json` reports the effective state. An explicit `false` also overrides inherited deployment environment variables; explicitly supplied external/managed deployments remain opt-ins when this setting is absent.
 
-The **Skill 自进化配置** page in `cc ui`, VS Code and JetBrains shares this setting. Quick Ask reads it for each new request; stop and restart an already running Agent session to apply changes. Switching off leaves ordinary chat, tool permissions and sandbox policy available. Enabled deployments still enforce their signatures and evidence validation; automatic candidate promotion remains `HOLD`. RRSI evaluation modules are part of the CLI evolution code, but this switch does not itself start a full RRSI campaign or publish learned candidates.
+The **Skill 自进化配置** page in `cc ui`, VS Code and JetBrains shares this setting. Since CLI **0.166.133**, `cc ui` Chat, Agent, Quick Ask, streaming and Personal Data Hub model requests re-read it for each new request, including existing UI sessions. Stop and restart already running terminal or IDE Agent sessions to apply changes there. Switching off leaves ordinary chat, tool permissions and sandbox policy available. Enabled deployments still enforce their signatures and evidence validation; automatic candidate promotion remains `HOLD`. RRSI evaluation modules are part of the CLI evolution code, but this switch does not itself start a full RRSI campaign or publish learned candidates.
 
 Install this release with `npm i -g chainlesschain@0.166.127 --registry https://registry.npmjs.org`. Paired public IDE versions are Open VSX / VS Code **0.37.165** and JetBrains **0.4.182**. Their exact-source release gates and public archive readback passed; Microsoft Marketplace remains unpublished. Child package pins are unchanged. The preceding **0.166.126** JSON recovery-summary repair addresses host-truncated retained context; the same error code can also report other invalid original evidence. Exact-source Linux, Windows and macOS CLI CI and Strict Sandbox passed; GitHub Actions OIDC publication and public package readback are complete. Mobile and PC release [`v5.0.3.142`](https://github.com/chainlesschain/chainlesschain/releases/tag/v5.0.3.142) is public from frozen source `c9881a2b710cf49f0ad3d63673e0998ecc608514`; automatic promotion remains `HOLD`.
 
@@ -239,7 +261,7 @@ Explicit Linux durable permissions require administrator provisioning. Cross-pro
 Install the CLI version published by this release:
 
 ```bash
-npm install -g chainlesschain@0.166.121 --registry https://registry.npmjs.org
+npm install -g chainlesschain@0.166.132 --registry https://registry.npmjs.org
 chainlesschain setup
 ```
 
@@ -2412,19 +2434,23 @@ Configuration is stored at `~/.chainlesschain/config.json`. The CLI creates and
 
 ### Supported LLM Providers
 
-| Provider                   | Default Model          | API Key Required |
-| -------------------------- | ---------------------- | ---------------- |
-| Ollama (Local)             | qwen2.5:7b             | No               |
-| OpenAI                     | gpt-4o                 | Yes              |
-| Anthropic                  | claude-opus-4-6        | Yes              |
-| DeepSeek                   | deepseek-chat          | Yes              |
-| DashScope (Alibaba)        | qwen-turbo             | Yes              |
-| Google Gemini              | gemini-2.0-flash       | Yes              |
-| Mistral AI                 | mistral-large-latest   | Yes              |
-| Volcengine (火山引擎/豆包) | doubao-seed-1-6-251015 | Yes              |
-| Kimi (月之暗面)            | moonshot-v1-auto       | Yes              |
-| MiniMax (海螺AI)           | MiniMax-Text-01        | Yes              |
-| Custom                     | —                      | Yes              |
+| Provider                   | Default Model          | API Key Required   |
+| -------------------------- | ---------------------- | ------------------ |
+| Ollama (Local)             | qwen2.5:7b             | No                 |
+| OpenAI                     | gpt-4o                 | Yes                |
+| Anthropic                  | claude-opus-4-6        | Yes                |
+| DeepSeek                   | deepseek-chat          | Yes                |
+| DashScope (Alibaba)        | qwen-turbo             | Yes                |
+| Google Gemini              | gemini-2.0-flash       | Yes                |
+| Mistral AI                 | mistral-large-latest   | Yes                |
+| Volcengine (火山引擎/豆包) | doubao-seed-1-6-251015 | Yes                |
+| Kimi (月之暗面)            | moonshot-v1-auto       | Yes                |
+| MiniMax (海螺AI)           | MiniMax-Text-01        | Yes                |
+| Custom (OpenAI-compatible) | Set explicitly         | Platform-dependent |
+
+Use `provider: "custom"` for local or LAN model platforms exposing OpenAI-compatible Chat Completions, including LM Studio, vLLM, Xinference, LocalAI, and model-routing gateways. Set the platform's API base URL (for example `http://localhost:1234/v1` or a LAN gateway's documented base path) and exact model name. Supply its API key when required; keyless endpoints are also supported. Chat, Agent, streaming, and connection tests keep that endpoint and model instead of selecting Ollama or a cloud provider.
+
+Self-evolution is optional. With `evolution.enabled: false`, `cc ui` Chat, Agent, Quick Ask, streaming, and Personal Data Hub analysis do not require an Evolution deployment certificate. Existing sessions read the setting again on subsequent requests. Enabled deployments still require valid authentication.
 
 ## File Structure
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chainlesschain",
-  "version": "0.166.132",
+  "version": "0.166.135",
   "description": "CLI for ChainlessChain - install, configure, and manage your personal AI management system",
   "type": "module",
   "bin": {

package/src/assets/linux-subreaper/linux-arm64/manifest.json

@@ -6,5 +6,5 @@
   "imageDigest": "sha256:6395a47a5bd9b038303e94a5e93754258c8480dab64635460f973eb93dc6f4d8",
   "bytes": 778808,
   "linkage": "static",
-  "commit": "772fcdbda85bcf91df95bfced5b476dcf4c74614"
+  "commit": "82aa6d703a8695721a7ccf0793a435853bc2bbf2"
 }

package/src/assets/linux-subreaper/linux-x64/manifest.json

@@ -6,5 +6,5 @@
   "imageDigest": "sha256:f162e55ad3f3f72f8a52e9d7f12b5b8db44506c2ca66a14d7d62d5cd4f12498e",
   "bytes": 934160,
   "linkage": "static",
-  "commit": "772fcdbda85bcf91df95bfced5b476dcf4c74614"
+  "commit": "82aa6d703a8695721a7ccf0793a435853bc2bbf2"
 }

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.135",
+      "cliVersions": ["0.166.135"],
+      "date": "2026-10-31",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.135: Responses disconnect recovery and launch policy preservation (candidate, 2026-10-31)",
+          "body": "- Recover genuine pre-output OpenAI Responses JSON disconnects with the existing bounded retry policy, distinct physical request IDs and synchronous usage settlement. Bound stalled headers and JSON reads, preserve HTTP/provider verdicts and caller cancellation, and keep workflow effects and incomplete tool streams non-replayable.\n- Settle completed Responses events without waiting for socket EOF. A hung reader cancellation no longer blocks timeout settlement; already queued transport aborts and user cancellation remain authoritative.\n- Select newly generated context handoffs before ordinary conversation so a full conversation partition cannot evict its summary. Retain the same input budget, data-only trust and oversized-summary rejection.\n- Preserve an explicit empty tool allowlist through saved launch argv and the CLI parser. Reject malformed persisted permission modes, sandbox modes and budgets instead of silently restoring weaker defaults.\n- Strengthen generic regression guidance for delegated lifecycle ownership, race controls, persisted history projections and a final response within the iteration budget. Add same-handle metadata-race and approval-cancellation controls without changing historical model candidates.\n- Give independent IDE cleanup a separate bounded deadline after the model task ends. The previous `verify-26` trace actually contains `error_max_turns` at 20/20; cleanup had obscured that result with an expired-deadline error. Historical OpenAI acceptance remains 39/45 and is not reclassified by these fixes.\n- Prepare companion Open VSX 0.37.172 and JetBrains 0.4.189 for CLI 0.166.135. Required child npm packages retain their published versions; publication must follow the exact-source multi-platform gates and upstream readback."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.133",
+      "cliVersions": ["0.166.133"],
+      "date": "2026-10-30",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.133: scoped mutation schemas and model platform compatibility (candidate, 2026-10-30)",
+          "body": "- Expose canonical allowed mutation paths in provider tool schemas for scoped write/edit calls. Explain that absolute paths returned by read tools are not valid mutation arguments in that run; execution-time permission, scope and file-identity checks remain authoritative.\n- Preserve the required `summary` array on Responses reasoning items, including empty summaries and replayed older sessions, so tool continuations do not fail with `Missing required parameter: input[n].summary`.\n- Apply the current self-evolution setting to ordinary `cc ui` Chat, Agent, streaming and Personal Data Hub analysis, skills and resolver requests. Disabled requests do not require a deployment certificate; enabled deployments retain authentication checks. Existing UI sessions re-read the setting for subsequent requests.\n- Support explicitly configured `custom` OpenAI-compatible local and LAN platforms across Chat, Agent, streaming and connection probes. Keep the platform's API base path and model alias, allow platform-specific or absent credentials, and do not relabel localhost endpoints as Ollama or fall back to an unrelated cloud account.\n- Validate the model-platform and self-evolution fixes with over 400 focused regression tests, including the actual Chat-session creation path and disabled resolver model/embedding transports. Platform compatibility uses controlled test endpoints; the reported user's live platform was not contacted.\n- Validate the generic schema contract: the new provider-wire suite passed **10/10 tests**; the combined related suites passed **34 tests**, with **1 existing Windows skip**. Local test results do not establish new real-model task success or change the historical **34/45** automatic acceptance total.\n- Prepare candidate pairing Open VSX **0.37.171** / JetBrains **0.4.188** for CLI **0.166.133**. Kernel **0.1.11** and unchanged child packages retain their versions; no independent IDE UI or client release is included.\n- Release requirements: verified public child packages, exact-source multi-OS release gates, CLI OIDC publication and public readback before IDE publication and readback. Consult versioned publication evidence for actual availability. Microsoft Marketplace remains deferred; **0.166.132 / 0.37.170 / 0.4.187** is the preceding verified public pairing."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.132",

package/src/gateways/ws/llm-chat-protocol.js

@@ -121,7 +121,7 @@ export async function handleLlmChat(server, id, ws, message) {
     return;
   }
 
-  if (creds.provider !== "ollama" && !creds.apiKey) {
+  if (!["ollama", "custom"].includes(creds.provider) && !creds.apiKey) {
     const envHint = BUILT_IN_PROVIDERS[creds.provider]?.apiKeyEnv;
     send({
       type: `${topic}.result`,

package/src/gateways/ws/personal-data-hub-protocol.js

@@ -25,6 +25,7 @@ import {
 import { importPdh } from "../../lib/pdh-load-error.js";
 import { getAIChatWizard } from "../../lib/personal-data-hub-aichat-wizard.js";
 import { runDedicatedBatchCollectors } from "../../lib/pdh-dedicated-batch-collectors.js";
+import { resolveServerEvolutionFactory } from "../../lib/evolution/optional-ui-model-turn.js";
 import {
   existsSync,
   unlinkSync,
@@ -150,8 +151,9 @@ export async function _tryAdbAutoPullInputPath(hub, name, options) {
     return options || {};
   }
   try {
-    const { createHostAdbBridge } =
-      await import("../../lib/host-adb-bridge.js");
+    const { createHostAdbBridge } = await import(
+      "../../lib/host-adb-bridge.js"
+    );
     const bridge = createHostAdbBridge();
     const content = await bridge.invoke("snapshot.read", {
       fileName: `${name}.json`,
@@ -192,9 +194,15 @@ async function withHub(fn, loadHub = getHub) {
   }
 }
 
-function governedHubLoader(factory) {
+async function governedHubLoader(server) {
+  const factory = await resolveServerEvolutionFactory(server);
   if (typeof factory === "function")
     return () => getGovernedAnalysisHub(factory);
+  if (
+    factory === null &&
+    typeof server?.resolveEvolutionCompositionFactory === "function"
+  )
+    return () => getGovernedAnalysisHub(null, { evolutionDisabled: true });
   const error = new Error(
     "Personal Data Hub model egress requires an authenticated evolution composition factory",
   );
@@ -215,11 +223,13 @@ function validateEntityReference(entityType, entityId) {
 
 export const PERSONAL_DATA_HUB_HANDLERS = {
   "personal-data-hub.ask": async (msg, context = {}) => {
-    const factory = context.server?.evolutionCompositionFactory;
-    return withHub(async (hub) => {
-      if (!hub.engine) throw new Error("Analysis engine unavailable");
-      return await hub.engine.ask(msg.question, msg.options || {});
-    }, governedHubLoader(factory));
+    return withHub(
+      async (hub) => {
+        if (!hub.engine) throw new Error("Analysis engine unavailable");
+        return await hub.engine.ask(msg.question, msg.options || {});
+      },
+      await governedHubLoader(context.server),
+    );
   },
 
   // Path Y: prompt context only, no LLM call. Lets web-shell / mobile host
@@ -668,7 +678,14 @@ export const PERSONAL_DATA_HUB_HANDLERS = {
   "personal-data-hub.resolver-drain": async (msg, context = {}) =>
     withHub(async (hub) => {
       if (!hub.entityResolver) throw new Error("EntityResolver not wired");
-      const factory = context.server?.evolutionCompositionFactory;
+      const factory = await resolveServerEvolutionFactory(context.server);
+      if (
+        factory === null &&
+        typeof context.server?.resolveEvolutionCompositionFactory === "function"
+      )
+        return await hub.drainResolver({ limit: msg.limit || 50 }, null, {
+          evolutionDisabled: true,
+        });
       return await hub.drainResolver({ limit: msg.limit || 50 }, factory);
     }),
 
@@ -691,10 +708,9 @@ export const PERSONAL_DATA_HUB_HANDLERS = {
     withHub((hub) => hub.analysisSkillNames || []),
 
   "personal-data-hub.run-skill": async (msg, context = {}) => {
-    const factory = context.server?.evolutionCompositionFactory;
     return withHub(
       async (hub) => await hub.runSkill(msg.name, msg.options || {}),
-      governedHubLoader(factory),
+      await governedHubLoader(context.server),
     );
   },
 

package/src/gateways/ws/session-core-protocol.js

@@ -19,12 +19,14 @@ function fail(code, message) {
 }
 
 async function canonicalMemoryService(scopeKey) {
-  const { resolveCliContextMemoryCutover } =
-    await import("../../lib/context-memory-kernel/authority.js");
+  const { resolveCliContextMemoryCutover } = await import(
+    "../../lib/context-memory-kernel/authority.js"
+  );
   const decision = resolveCliContextMemoryCutover({ scopeKey });
   if (!decision.canonical) return null;
-  const { createCliCanonicalMemoryService } =
-    await import("../../lib/context-memory-kernel/memory-service.js");
+  const { createCliCanonicalMemoryService } = await import(
+    "../../lib/context-memory-kernel/memory-service.js"
+  );
   return createCliCanonicalMemoryService();
 }
 
@@ -104,8 +106,9 @@ async function sessionsEnd(message) {
   let consolidated = null;
   if (message.consolidate) {
     try {
-      const { consolidateJsonlSession } =
-        await import("../../lib/session-consolidator.js");
+      const { consolidateJsonlSession } = await import(
+        "../../lib/session-consolidator.js"
+      );
       consolidated = await consolidateJsonlSession(message.sessionId, {
         scope: message.scope || "session",
         scopeId: message.scopeId || null,
@@ -249,8 +252,9 @@ async function memoryDelete(message) {
 async function memoryConsolidate(message) {
   if (!message.sessionId) return fail("BAD_REQUEST", "sessionId required");
   try {
-    const { consolidateJsonlSession } =
-      await import("../../lib/session-consolidator.js");
+    const { consolidateJsonlSession } = await import(
+      "../../lib/session-consolidator.js"
+    );
     const result = await consolidateJsonlSession(message.sessionId, {
       scope: message.scope || "session",
       scopeId: message.scopeId || null,
@@ -321,16 +325,17 @@ async function streamRun(message, sender, signal, context) {
   const { buildProviderSource } = await import("../../lib/provider-stream.js");
   const { createStreamRouter } = await loadSingletons();
   const router = createStreamRouter();
-  const { prepareGovernedModelTurn, governModelTokenSource } =
-    await import("../../lib/evolution/governed-model-turn.js");
-  const turn = await prepareGovernedModelTurn(
-    context?.server?.evolutionCompositionFactory ?? null,
-    {
-      mode: "ws-stream",
-      messages: [{ role: "user", content: message.prompt }],
-      signal,
-    },
+  const { governModelTokenSource } = await import(
+    "../../lib/evolution/governed-model-turn.js"
   );
+  const { prepareServerUiModelTurn } = await import(
+    "../../lib/evolution/optional-ui-model-turn.js"
+  );
+  const turn = await prepareServerUiModelTurn(context?.server, {
+    mode: "ws-stream",
+    messages: [{ role: "user", content: message.prompt }],
+    signal,
+  });
   const source = governModelTokenSource(
     buildProviderSource(provider, {
       model: message.model,

package/src/gateways/ws/session-protocol.js

@@ -31,6 +31,7 @@ import {
 } from "../../lib/session-budget-production-root.js";
 import { mergePricing } from "../../lib/llm-pricing.js";
 import { ensureCanonicalSessionTranscript } from "../../lib/session-transcript-migration.js";
+import { prepareServerUiModelTurn } from "../../lib/evolution/optional-ui-model-turn.js";
 
 const PAYLOAD_DIGEST = /^sha256:[0-9a-f]{64}$/;
 const RAW_AUTHORITY_HASH = /^[0-9a-f]{64}$/;
@@ -505,8 +506,9 @@ function sameSessionBudgetConfig(left, right) {
 
 async function _isPhase5EnvelopesEnabled() {
   try {
-    const { getBetaFlags } =
-      await import("../../lib/session-core-singletons.js");
+    const { getBetaFlags } = await import(
+      "../../lib/session-core-singletons.js"
+    );
     const flags = await getBetaFlags();
     return flags.isEnabled(PHASE5_ENVELOPE_FLAG);
   } catch (_e) {
@@ -532,8 +534,9 @@ async function ensureSessionHandler(
     throw error;
   }
 
-  const { WebSocketInteractionAdapter } =
-    await import("../../lib/interaction-adapter.js");
+  const { WebSocketInteractionAdapter } = await import(
+    "../../lib/interaction-adapter.js"
+  );
   const enablePhase5Envelopes = await _isPhase5EnvelopesEnabled();
   const stateSnapshot =
     typeof server.sessionManager.getSessionStateSnapshot === "function"
@@ -605,6 +608,8 @@ async function ensureSessionHandler(
       session,
       interaction: session.interaction,
       evolutionCompositionFactory: server.evolutionCompositionFactory ?? null,
+      prepareUiModelTurn: (context) =>
+        prepareServerUiModelTurn(server, context),
     });
   } else {
     const { WSAgentHandler } = await import("./ws-agent-handler.js");
@@ -661,6 +666,10 @@ async function ensureSessionHandler(
         sessionHostLease,
         sessionBudgetRoot,
         evolutionCompositionFactory: server.evolutionCompositionFactory,
+        resolveEvolutionCompositionFactory:
+          typeof server.resolveEvolutionCompositionFactory === "function"
+            ? () => server.resolveEvolutionCompositionFactory()
+            : null,
         skillOutcomeIndex: server.skillOutcomeIndex,
         skillVectorAuthority: server.skillVectorAuthority,
         ...server.runtimeAdmissionDependencies,
@@ -1733,8 +1742,9 @@ export async function handleSubAgentList(server, id, ws, message) {
   const sessionId = message?.sessionId || null;
 
   try {
-    const { SubAgentRegistry } =
-      await import("../../lib/sub-agent-registry.js");
+    const { SubAgentRegistry } = await import(
+      "../../lib/sub-agent-registry.js"
+    );
     const registry = SubAgentRegistry.getInstance();
 
     let payload;
@@ -1796,8 +1806,9 @@ export async function handleSubAgentGet(server, id, ws, message) {
   }
 
   try {
-    const { SubAgentRegistry } =
-      await import("../../lib/sub-agent-registry.js");
+    const { SubAgentRegistry } = await import(
+      "../../lib/sub-agent-registry.js"
+    );
     const snapshot = SubAgentRegistry.getInstance().getById(subAgentId);
 
     if (!snapshot) {

package/src/gateways/ws/ws-agent-handler.js

@@ -183,6 +183,7 @@ export class WSAgentHandler {
     sessionBudgetRoot = null,
     hostResourceBudget = null,
     evolutionCompositionFactory = null,
+    resolveEvolutionCompositionFactory = null,
     skillOutcomeIndex = null,
     skillVectorAuthority = null,
     skillRuntimeAdmission = null,
@@ -265,6 +266,15 @@ export class WSAgentHandler {
       throw new TypeError("evolutionCompositionFactory must be a function");
     }
     this._evolutionCompositionFactory = evolutionCompositionFactory;
+    if (
+      resolveEvolutionCompositionFactory !== null &&
+      typeof resolveEvolutionCompositionFactory !== "function"
+    )
+      throw new TypeError(
+        "resolveEvolutionCompositionFactory must be a function",
+      );
+    this._resolveEvolutionCompositionFactory =
+      resolveEvolutionCompositionFactory;
     this._skillOutcomeIndex =
       skillOutcomeIndex === null
         ? null
@@ -337,6 +347,14 @@ export class WSAgentHandler {
       : Object.freeze(hostSystemPrefix);
   }
 
+  async _refreshEvolutionFactory() {
+    if (this._resolveEvolutionCompositionFactory === null) return;
+    const current = await this._resolveEvolutionCompositionFactory();
+    if (current !== null && typeof current !== "function")
+      throw new TypeError("Invalid evolution composition factory");
+    this._evolutionCompositionFactory = current;
+  }
+
   async _prepareEvolutionTurn(requestId) {
     if (!this._evolutionCompositionFactory) return null;
     const sessionId = String(this.session.id);
@@ -876,6 +894,7 @@ export class WSAgentHandler {
     let result;
     try {
       this._sessionHostLease?.assert?.();
+
       result = await this._compactContextMemory(
         session.messages,
         {
@@ -1402,6 +1421,11 @@ export class WSAgentHandler {
       const { session } = this;
       this.assertSessionBudgetAdmission("WebSocket turn");
       this._sessionHostLease?.assert?.();
+      // A resident UI must observe a changed setting before each new turn.
+      if (this._resolveEvolutionCompositionFactory !== null) {
+        await this._refreshEvolutionFactory();
+      }
+      turnSignal.throwIfAborted();
 
       if (session.canonicalJsonlSession === true) {
         const inputDigest =
@@ -1676,6 +1700,7 @@ export class WSAgentHandler {
       }
 
       const executeAgentTurn = async () => {
+        turnSignal.throwIfAborted();
         for await (const event of this._agentLoop(
           session.messages,
           loopOptions,
@@ -2282,6 +2307,11 @@ export class WSAgentHandler {
         try {
           this.assertSessionBudgetAdmission("WebSocket compaction");
           this._sessionHostLease?.assert?.();
+          if (this._resolveEvolutionCompositionFactory !== null) {
+            await this._refreshEvolutionFactory();
+          }
+          this._sessionBudgetSignal?.throwIfAborted();
+          this._sessionHostLease?.assert?.();
           compactionEvolution = await this._prepareEvolutionTurn(
             `compact:${requestId || randomUUID()}`,
           );

package/src/lib/background-launch-profile.js

@@ -666,6 +666,41 @@ export function normalizeBackgroundLaunchProfile(input) {
       `Unsupported background launch profile version: ${input?.version ?? "missing"}`,
     );
   }
+  const rejectField = (field) => {
+    const error = new Error(
+      `Invalid background launch profile field: ${field}`,
+    );
+    error.code = "BACKGROUND_LAUNCH_PROFILE_INVALID";
+    throw error;
+  };
+  // A persisted policy must not silently fall back to a weaker default.
+  if (
+    input.permission?.mode != null &&
+    !PERMISSION_MODES.has(input.permission.mode)
+  )
+    rejectField("permission.mode");
+  if (input.sandbox?.mode != null && !SANDBOX_MODES.has(input.sandbox.mode))
+    rejectField("sandbox.mode");
+  for (const field of [
+    "maxTurns",
+    "maxCostUsd",
+    "thinkingTokens",
+    "maxRewakes",
+    "maxOuterTurns",
+    "goalMaxTokens",
+    "goalMaxCostUsd",
+    "goalMaxTimeMs",
+  ]) {
+    const value = input.budget?.[field];
+    if (value == null || value === "") continue;
+    const number = Number(value);
+    if (
+      !Number.isFinite(number) ||
+      number <= 0 ||
+      (!field.toLowerCase().includes("cost") && !Number.isSafeInteger(number))
+    )
+      rejectField(`budget.${field}`);
+  }
   const cwd = canonicalPath(input.workspace?.cwd || process.cwd());
   const safeBase = sanitizeBackgroundBaseUrl(input.llm?.baseUrl);
   const permissionMode = PERMISSION_MODES.has(input.permission?.mode)
@@ -966,7 +1001,8 @@ export function buildArgvFromBackgroundLaunchProfile(profile) {
     pushValue(argv, "--fallback-model", model);
   }
   if (p.tools.allowed !== null) {
-    pushValue(argv, "--allowed-tools", p.tools.allowed.join(","));
+    // Empty means no tools; omitting this option would allow every tool.
+    argv.push("--allowed-tools", p.tools.allowed.join(","));
   }
   pushValue(argv, "--disallowed-tools", p.tools.disallowed.join(","));
   pushValue(argv, "--permission-mode", p.permission.mode);