chainlesschain 0.166.135 → 0.166.136
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -2
- package/package.json +1 -1
- package/src/assets/linux-subreaper/linux-arm64/manifest.json +1 -1
- package/src/assets/linux-subreaper/linux-x64/manifest.json +1 -1
- package/src/command-help-index.json +1 -1
- package/src/commands/agent.js +7 -0
- package/src/data/changelog.json +13 -0
- package/src/lib/background-launch-profile.js +143 -28
- package/src/lib/safe-mode.js +10 -0
- package/src/lib/session-history-origins.js +36 -0
package/README.md
CHANGED
|
@@ -2,14 +2,18 @@
|
|
|
2
2
|
|
|
3
3
|
Command-line interface for installing, configuring, and managing [ChainlessChain](https://www.chainlesschain.com), including the coding agent, governed tools, sessions, memory, and IDE integrations.
|
|
4
4
|
|
|
5
|
-
## CLI 0.166.135
|
|
5
|
+
## CLI 0.166.135 — verified public release
|
|
6
6
|
|
|
7
7
|
This release recovers genuine OpenAI Responses JSON disconnects before accepted output, bounds stalled requests, and settles completed streaming responses without waiting for socket EOF. It preserves empty tool allowlists across resume and rejects malformed saved permission, sandbox and budget settings. HTTP/provider failures, cancellation, usage persistence and incomplete tool-call replay protections remain authoritative.
|
|
8
8
|
|
|
9
|
-
Install with `npm i -g chainlesschain@0.166.135 --registry https://registry.npmjs.org`, restart the chat host, then run `cc --version` and `cc doctor`.
|
|
9
|
+
Install with `npm i -g chainlesschain@0.166.135 --registry https://registry.npmjs.org`, restart the chat host, then run `cc --version` and `cc doctor`. Public Open VSX **0.37.173** recommends CLI **0.166.135**. JetBrains **0.4.189** recommends the same CLI and has been uploaded after passing all release gates, but awaits Marketplace approval/listing. Current public JetBrains **0.4.188** retains its CLI **0.166.133** recommendation; Kernel stays **0.1.11**. Check the [release guide](https://docs.chainlesschain.com/chainlesschain/agent-platform-release.html) for channel publication status. Microsoft Marketplace and PC/mobile releases are outside this release scope.
|
|
10
|
+
|
|
11
|
+
Exact CLI source `82aa6d703a8695721a7ccf0793a435853bc2bbf2` passed all 76 CLI CI jobs and all 6 Strict Sandbox jobs. [OIDC publication](https://github.com/chainlesschain/chainlesschain/actions/runs/41168880872) and [independent public readback](https://github.com/chainlesschain/chainlesschain/actions/runs/41169921448) verified registry bytes, provenance and direct child dependencies. [Component-specific publication evidence](../../docs/research/cli/evidence/release135-public/publication.json).
|
|
10
12
|
|
|
11
13
|
The preceding OpenAI native cohort accepted **39/45** tasks. Runtime regression tests and this release do not change that historical result or establish formal paid/native production admission.
|
|
12
14
|
|
|
15
|
+
A subsequent user-authorized retest used this public CLI, Open VSX 0.37.173 and the verified JetBrains 0.4.189 Actions build without waiting for Marketplace review. Only the six previously failed samples were rerun: **1/6** passed (`verify-26`), with **5** still failing independent acceptance. The cross-version cumulative result is **40/45**, not a new full 45-task success rate. All 100 upstream calls have complete usage; token-only estimate **$5.880530**, invoice unknown. The temporary task secret was deleted. [Targeted report](../../docs/research/cli/verify01-openai-135/retest-six-99b93fc209/REPORT.md).
|
|
16
|
+
|
|
13
17
|
## CLI 0.166.133 — verified preceding release
|
|
14
18
|
|
|
15
19
|
CLI **0.166.133** is published on npm. It preserves required empty OpenAI Responses reasoning summaries, applies the self-evolution switch to all model-owning `cc ui` entry points, and supports explicitly configured OpenAI-compatible local/LAN platforms through `custom`, with optional credentials and unchanged endpoint/model aliases. It also exposes canonical allowed mutation paths in provider tool schemas while retaining execution-time scope and file-identity checks. Controlled regressions and release gates do not establish live-platform task acceptance.
|
package/package.json
CHANGED
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
"a2a": "Usage: chainlesschain a2a [options] [command]\n\nA2A Protocol — agent-to-agent communication\n\nOptions:\n -h, --help display help for command\n\nCommands:\n register [options] <name> Register an agent card\n discover [options] Discover agents by capability or skill\n submit [options] <agent-id> <input> Submit a task to an agent\n status [options] <task-id> Get task status\n complete <task-id> <output> Mark a task as completed\n fail <task-id> <error> Mark a task as failed\n peers [options] List all registered agents\n cards [options] List all agent cards with details\n negotiate [options] <agent-id> <capabilities> Check if an agent supports required capabilities\n task-statuses [options] List V2 task statuses (Phase 81)\n card-statuses [options] List V2 card statuses (Phase 81)\n subscription-types [options] List V2 subscription types (Phase 81)\n negotiation-results [options] List V2 negotiation outcomes (Phase 81)\n validate-card [options] <name> Validate an agent card against the A2A schema\n set-card-status [options] <cardId> <status> Transition a card between active/inactive/expired\n card-status [options] <cardId> Show a card's V2 status\n send-task-v2 [options] <agentId> <input> Submit a V2 task (in-memory, with optional timeout)\n start-working [options] <taskId> Transition a V2 task to working\n request-input [options] <taskId> <prompt> Request user input while a V2 task is working\n provide-input [options] <taskId> <input> Provide input for an input-required V2 task\n complete-task-v2 [options] <taskId> [output] Complete a V2 task (from working only)\n fail-task-v2 [options] <taskId> [error] Fail a V2 task with an error message\n cancel-task [options] <taskId> [reason] Cancel a non-terminal V2 task\n check-timeout [options] <taskId> Check V2 task timeout (auto-fails if past deadline)\n task-v2 [options] <taskId> Show a V2 task snapshot\n tasks-v2 [options] List V2 tasks\n negotiate-v2 [options] <cardJson> Phase 81 capability negotiation against an agent card\n stats-v2 [options] Aggregate V2 stats (tasks + cards + subscriptions)\n enums-v2 Show V2 governance enums\n register-agent-v2 [options] Register an a2a agent profile (pending)\n activate-agent-v2 <id> Activate agent\n suspend-agent-v2 <id> Suspend agent\n retire-agent-v2 <id> Retire agent (terminal)\n touch-agent-v2 <id> Refresh lastTouchedAt\n get-agent-v2 <id> Get agent\n list-agents-v2 List agents\n create-message-v2 [options] Create an a2a message (queued)\n start-message-v2 <id> Transition message to sending\n deliver-message-v2 <id> Transition message to delivered\n fail-message-v2 [options] <id> Fail message\n cancel-message-v2 [options] <id> Cancel message\n get-message-v2 <id> Get message\n list-messages-v2 List messages\n set-max-active-agents-v2 <n> Set per-owner active cap\n set-max-pending-messages-v2 <n> Set per-agent pending cap\n set-agent-idle-ms-v2 <n> Set idle threshold\n set-message-stuck-ms-v2 <n> Set stuck threshold\n auto-suspend-idle-agents-v2 Auto-suspend idle agents\n auto-fail-stuck-messages-v2 Auto-fail stuck sending messages\n gov-stats-v2 V2 governance aggregate stats\n help [command] display help for command\n",
|
|
6
6
|
"activitypub": "Usage: chainlesschain activitypub|ap [options] [command]\n\nActivityPub C2S bridge — actors, outbox/inbox, Follow/Create/Like/Announce\n\nOptions:\n -h, --help display help for command\n\nCommands:\n actor Manage local and remote ActivityPub actors\n publish [options] <content> Publish a Create(Note) activity to the actor's outbox\n follow [options] <target> Publish a Follow activity (target: username or actor URL)\n accept [options] <follow-activity-id> Accept a pending Follow request\n unfollow [options] <target> Publish an Undo(Follow) activity\n like [options] <object-id> Publish a Like activity for an object URL\n announce [options] <object-id> Publish an Announce (boost) activity for an object URL\n outbox [options] <username> List an actor's outbox activities\n inbox [options] <username> List an actor's inbox activities\n deliver [options] <username> <activity-json> Simulate inbox delivery — push a JSON activity into a local actor's inbox\n followers [options] <username> List followers of an actor\n search [options] <query> Search actors and/or notes in the local Fediverse index\n following [options] <username> List who this actor is following\n enums-v2 Show V2 enums\n register-actor-v2 [options] Register an AP actor profile (pending)\n activate-actor-v2 <id> Activate actor\n suspend-actor-v2 <id> Suspend actor\n deactivate-actor-v2 <id> Deactivate actor (terminal)\n touch-actor-v2 <id> Refresh lastTouchedAt\n get-actor-v2 <id> Get actor\n list-actors-v2 List actors\n create-activity-v2 [options] Create an AP activity (queued)\n start-activity-v2 <id> Transition activity to delivering\n deliver-activity-v2 <id> Transition activity to delivered\n fail-activity-v2 [options] <id> Fail activity\n cancel-activity-v2 [options] <id> Cancel activity\n get-activity-v2 <id> Get activity\n list-activities-v2 List activities\n set-max-active-actors-v2 <n> Set per-owner active cap\n set-max-pending-activities-v2 <n> Set per-actor pending cap\n set-actor-idle-ms-v2 <n> Set idle threshold\n set-activity-stuck-ms-v2 <n> Set stuck threshold\n auto-suspend-idle-actors-v2 Auto-suspend idle actors\n auto-fail-stuck-activities-v2 Auto-fail stuck delivering activities\n gov-stats-v2 V2 governance aggregate stats\n help [command] display help for command\n",
|
|
7
7
|
"agenda": "Usage: chainlesschain agenda [options] [command]\n\nFire agent-scheduled wakeups / crons / monitors (persisted by the `schedule`\ntool)\n\nOptions:\n -h, --help display help for command\n\nCommands:\n list [options] List all scheduled entries\n run [options] Fire every entry that is due now\n cancel [options] <id> Remove a scheduled entry by id\n prune [options] Remove finished entries (fired / matched / exhausted /\n expired)\n help [command] display help for command\n",
|
|
8
|
-
"agent": "Usage: chainlesschain agent|a [options] [command] [task...]\n\nStart an agentic AI session (reads/writes files, runs commands)\n\nArguments:\n task Headless task 鈥?when given (or with -p /\n piped stdin), runs non-interactively\n\nOptions:\n --model <model> Model name\n --provider <provider> LLM provider (ollama, openai,\n volcengine, deepseek, ...)\n --base-url <url> API base URL\n --service-tier <tier> Reviewed provider service tier\n (standard, fast, flex, ultrafast)\n --api-key <key> API key\n --think [level] Enable Anthropic extended thinking\n (level: think | hard | ultra; Anthropic\n models only)\n --ultrathink Maximum Anthropic extended thinking (=\n --think ultra)\n --thinking-budget <n> Thinking token budget for legacy Claude\n models (Sonnet 4.5 / Opus 4.0-4.5 /\n older); clamped below max_tokens.\n Adaptive-thinking models ignore it (they\n use --think's effort). Requires\n --think/--ultrathink.\n --image <path> Attach an image (png/jpg/jpeg/gif/webp)\n to the prompt for a vision-capable model\n (headless; repeatable)\n --vision-model <id> Explicit image model override\n (otherwise: multimodal main model, then\n config llm.visionModel or\n doubao-seed-2-0-lite-260215)\n --session <id> Resume a previous agent session\n -c, --continue Resume the most recent session (no id\n needed 鈥?claude --continue parity)\n --resume [id] Resume a session by id (no id 鈫?most\n recent 鈥?claude --resume parity)\n --fork-session When resuming, branch into a NEW session\n id and leave the original untouched\n (claude --fork-session parity)\n --fork-request-id <key> Stable idempotency key for\n --fork-session retries (omit for a new\n fork each invocation)\n --add-dir <dir> Extra working directory the agent may\n read/search/edit (repeatable)\n --checkpoint Auto-snapshot the work tree before each\n mutating tool (DEFAULT inside a git\n repo; cc checkpoint restore to roll\n back)\n --no-checkpoint Disable auto-checkpointing (it is on by\n default inside git repos)\n --managed-checkpoint Checkpoint bounded mutating tools with\n Process Broker; unavailable writer\n lifetimes are reported as coverage none\n --managed-checkpoint-state <dir> Durable managed-checkpoint state\n directory (must be outside the\n workspace)\n --managed-checkpoint-exclude <path> Explicit workspace path excluded from\n managed checkpoints; repeatable and\n reported as partial coverage\n --safe-mode Run bare: disable project memory,\n settings hooks, memory recall, IDE\n context, status line and update notice\n (permission rules STAY active)\n --bare Everything --safe-mode disables PLUS\n skills, plugins and MCP/IDE auto-connect\n — minimal fast surface for scripted\n calls (explicit --mcp-config still\n loads; permission rules STAY active)\n --ephemeral No session persistence: nothing is\n written to the session store (headless;\n a --resume id still replays history\n read-only)\n --decision-mode <mode> Typed Skill-routing experiment for\n durable headless sessions: off | shadow\n | suggest (default: \"off\")\n --decision-provider <provider> Decision provider: typesafe | laya\n (local) | system-one (compatible API)\n (default: \"typesafe\")\n --decision-model <model> Decision model (defaults:\n typesafe=jev-latest, laya=laya; required\n for system-one)\n --decision-base-url <url> System One API base URL (laya: loopback\n only; other providers: HTTPS or\n loopback)\n --decision-timeout-ms <ms> Decision timeout in milliseconds\n (50-30000; default: 800)\n --capabilities Print a machine-readable capability\n manifest (JSON: protocol version, tools,\n permission modes, exit codes) and exit\n --disable-slash-commands Interactive REPL: don't dispatch '/'\n input as slash commands — it reaches the\n model verbatim (/exit and /quit stay\n live)\n --ax-screen-reader Screen-reader friendly output: no ANSI\n colors, no in-place status line repaints\n (also CC_SCREEN_READER=1)\n --worktree Run this session in a fresh git worktree\n (isolated branch; auto-removed when the\n session changes nothing)\n --no-worktree Background Git task: explicitly share\n the current work tree (intended for\n read-only tasks; writable runs are not\n isolated)\n --unattended Enable fail-closed shell action policy\n for scheduled/event-driven runs\n --unattended-allow <classes> Comma-separated action classes\n explicitly allowed for unattended shell\n runs\n --sandbox [image] Run shell commands in an ephemeral\n Docker sandbox (network disabled by\n default)\n --sandbox-mode <mode> Sandbox posture: off | workspace-write |\n strict (explicit isolation modes fail\n closed)\n --sandbox-network Allow network access inside --sandbox\n --otlp <file> Write the agent run's OpenTelemetry\n spans (model/tool/retry) as OTLP/JSON to\n <file>\n --otlp-content Include prompt/response CONTENT in\n --otlp spans (off by default; content is\n redacted unless this is set)\n --auto-rewake When an async `asyncRewake` hook (e.g. a\n background test) fails at turn end,\n re-engage the agent to fix it (bounded\n by --max-rewakes)\n --auto-pin Force-pin the original task (first user\n turn) through compaction (ON by default;\n disable with CC_AUTO_PIN=0 or config\n context.autoPin=false)\n --max-rewakes <n> Max auto-rewake re-drives per run\n (default 1); implies --auto-rewake\n --bg, --background Start as a detached background agent and\n return its id immediately\n --agent-id <id> Agent id for scoped memory recall\n --recall-limit <n> Top-K memories to inject into system\n prompt\n --recall-query <q> Query string for startup memory recall\n --no-recall-memory Disable startup memory recall\n --vim Start the interactive REPL in vim-mode\n line editing (toggle later with /vim; or\n CC_VIM=1)\n --no-stream Disable streamed response rendering\n --no-park-on-exit Close the session-core handle on exit\n instead of parking it\n --bundle <path> Agent bundle directory (may execute\n local MCP commands from mcp.json)\n -p, --print [prompt] Headless: run one non-interactive turn\n and exit\n --output-format <fmt> Headless output: text | json |\n stream-json (default: \"text\")\n --max-turns <n> Cap agent loop iterations (0 =\n unlimited; interactive streams default\n to unlimited, unattended runs to 50)\n --review-changes Headless: review write/edit tool changes\n once within remaining budgets; final\n text only (no partial deltas)\n --json-schema <file> Headless structured output: final reply\n must be JSON validating against this\n schema (invalid replies retried)\n --allowed-tools <list> Comma/space-separated tool allow-list\n (headless)\n --disallowed-tools <list> Comma/space-separated tool deny-list\n (headless)\n --permission-mode <mode> manual | auto | dontAsk | default | plan\n | acceptEdits | bypassPermissions (plan\n headless-only)\n --no-file-refs Disable @path file-reference expansion\n in the prompt (headless)\n --no-slash-macros Disable /name custom-command\n (.claude/commands) expansion in the\n prompt (headless)\n --system-prompt <text> Replace the built-in system prompt\n (literal text or @file)\n --append-system-prompt <text> Append extra guidance to the system\n prompt (literal text or @file)\n --no-project-memory Skip auto-loaded project memory (cc.md /\n CLAUDE.md / AGENTS.md hierarchy,\n .chainlesschain/rules.md,\n .claude/rules/*.md) — a lean system\n prompt for token-tight surfaces (e.g.\n IDE chat). The agent can still read\n those files with tools when it needs\n them.\n --output-style <name> Apply a named output-style persona\n (.claude/output-styles/<name>.md or a\n built-in: concise | explanatory |\n learning)\n --input-format <fmt> Headless input: text | stream-json\n (NDJSON user events on stdin,\n multi-turn) (default: \"text\")\n --trace-id <id> Correlation id stamped as `trace_id` on\n every stream-json output line (also read\n from CC_TRACE_ID). Lets an IDE/bridge\n trace one run across its own logs, the\n CLI, transcripts and diagnostics.\n Auto-generated per run when omitted.\n --fallback-model <model> Backup model(s) to try in order when the\n primary fails (transient error or\n model-not-found). Repeatable or\n comma-separated; up to 3. A\n `provider:model` entry (e.g.\n openai:gpt-4o) falls back\n cross-provider, using that provider's\n API key from its env var (skipped if\n unset — never reuses the primary key).\n Defaults to config llm.fallbackModels.\n --include-partial-messages Emit live assistant-text deltas as\n stream_event lines (requires\n --output-format stream-json)\n --include-hook-events Emit redacted hook and subagent\n lifecycle events (requires\n --output-format stream-json)\n --goal [id] Bind a cc goal into the run (id, or omit\n the value to auto-resolve the active\n goal)\n --goal-assess After the run, ask the model to assess\n goal progress and persist it (opt-in;\n costs one extra completion; requires\n --goal)\n --goal-condition <spec> Session completion condition; prefer\n verify:<manifest.json> for independent\n engineering acceptance, or\n exit-zero:/file-exists:/contains:/regex:;\n model:<desc> uses model judgment\n --goal-recovery-reviewed Resume an interrupted goal after\n reviewing prior effects and usage\n (requires --resume/--continue and\n --goal-condition)\n --max-outer-turns <n> Max outer re-drive turns for\n --goal-condition (default 10, hard cap\n 100)\n --goal-max-tokens <n> Token budget across --goal-condition\n outer turns\n --goal-max-cost <usd> Cost budget (USD) across\n --goal-condition outer turns\n --goal-max-time <ms> Wall-clock budget (ms) across\n --goal-condition outer turns\n --mcp-config <file> Load ad-hoc MCP servers from a JSON file\n for this run (headless); their tools\n become callable (mcp__<server>__<tool>)\n --no-mcp Don't auto-connect MCP servers\n registered with `cc mcp add\n --auto-connect` (--mcp-config still\n loads)\n --ide Force-enable IDE bridge auto-connect:\n discover a running editor's MCP server\n via ~/.chainlesschain/ide/*.json\n (default: auto inside an IDE integrated\n terminal)\n --no-ide Disable IDE bridge auto-connect\n --pdh Force-enable PDH bridge auto-connect:\n discover the Android app's\n device-capability MCP server via\n ~/.chainlesschain/pdh-bridge/*.json\n (default: auto when\n CHAINLESSCHAIN_PDH_PORT is set)\n --no-pdh Disable PDH bridge auto-connect\n --jetbrains Force-enable IntelliJ IDEA built-in MCP\n (IDEA >= 2025.2) as server `idea`\n (default: auto when the ChainlessChain\n JetBrains plugin injects\n CHAINLESSCHAIN_JETBRAINS_MCP_URL)\n --no-jetbrains Disable IDEA built-in MCP auto-connect\n --interactive-approvals Stream mode: confirm-tier approvals\n become approval_request/approval\n stdin-stdout events instead of failing\n closed (chat-panel UX)\n --permission-prompt-tool <tool> Defer tool approvals to an MCP tool\n (mcp__<server>__<tool>; requires\n --mcp-config) instead of headless\n fail-closed\n --remote-control Route confirm-tier approvals to paired\n mobile/web devices — requires a relay or\n explicit LAN opt-in; headless waits\n fail-closed, interactive races the\n terminal prompt (also /remote-control)\n --remote-control-allow-lan Permit --remote-control to expose its\n authenticated WS endpoint on a trusted\n LAN\n --channels <list> Inbound channels for the interactive\n session (webhook[:port],telegram) —\n external events enter as user turns;\n webhook needs its bearer token, telegram\n needs channels.telegram.allowFrom\n --settings <file> Merge an extra\n .claude/settings.json-shaped file for\n this run: permission rules\n (allow/ask/deny) + native config\n overrides (model, env)\n --max-budget-usd <amount> Hard USD spend cap: stop the run before\n the next paid LLM call once the\n estimated cost reaches this (headless;\n uses the cc cost price table)\n --session-budget Enable the durable session-wide budget\n authority (headless; requires\n --session/--resume/--continue)\n --session-max-concurrent <n> Durable session cap for concurrent child\n work\n --session-max-spawns <n> Durable session cap for total child-work\n admissions\n --session-max-depth <n> Durable session cap for child-agent\n nesting depth\n --session-max-turns <n> Durable session cap for model turns\n across resumes\n --session-max-tokens <n> Durable session cap for\n provider-reported tokens across resumes\n --session-max-cost-usd <amount> Durable session cost cap across resumes\n (requires priced provider usage)\n --session-max-wall-ms <n> Durable session cap for cumulative\n active wall time\n --session-max-tool-ms <n> Durable session cap for aggregate tool\n execution time\n --observability-workspace <id> Persist a workspace scope on new session\n authority for causal reports\n --observability-team <id> Persist a team scope on new session\n authority for causal reports\n --observability-policy <id> Persist a policy scope on new session\n authority for causal reports\n --strict-mcp-config Use ONLY --mcp-config servers; ignore\n registered (cc mcp add) and IDE-bridge\n MCP for a reproducible tool surface\n --project-mcp Opt in to loading a project-scoped\n .mcp.json (default off; a checked-in\n .mcp.json can spawn commands)\n --replay-user-messages Stream-input mode: echo each accepted\n stdin user message back as a `user`\n event (transcript/correlation)\n --allow-dangerous-bypass Bypass all permission prompts in\n headless mode (DANGEROUS: auto-approves\n all tool calls) (default: false)\n -y, --yolo Alias for --allow-dangerous-bypass\n (default: false)\n --dangerously-skip-permissions Alias for --allow-dangerous-bypass\n (default: false)\n -h, --help display help for command\n\nCommands:\n controlled-host [options] Run against a pre-provisioned Linux\n permission authority (one-shot, dontAsk)\n process-ownership Inspect Linux process quarantine or\n explicitly stop one recoverable\n execution\n",
|
|
8
|
+
"agent": "Usage: chainlesschain agent|a [options] [command] [task...]\n\nStart an agentic AI session (reads/writes files, runs commands)\n\nArguments:\n task Headless task 鈥?when given (or with -p /\n piped stdin), runs non-interactively\n\nOptions:\n --model <model> Model name\n --provider <provider> LLM provider (ollama, openai,\n volcengine, deepseek, ...)\n --base-url <url> API base URL\n --service-tier <tier> Reviewed provider service tier\n (standard, fast, flex, ultrafast)\n --api-key <key> API key\n --think [level] Enable Anthropic extended thinking\n (level: think | hard | ultra; Anthropic\n models only)\n --ultrathink Maximum Anthropic extended thinking (=\n --think ultra)\n --thinking-budget <n> Thinking token budget for legacy Claude\n models (Sonnet 4.5 / Opus 4.0-4.5 /\n older); clamped below max_tokens.\n Adaptive-thinking models ignore it (they\n use --think's effort). Requires\n --think/--ultrathink.\n --image <path> Attach an image (png/jpg/jpeg/gif/webp)\n to the prompt for a vision-capable model\n (headless; repeatable)\n --vision-model <id> Explicit image model override\n (otherwise: multimodal main model, then\n config llm.visionModel or\n doubao-seed-2-0-lite-260215)\n --session <id> Resume a previous agent session\n -c, --continue Resume the most recent session (no id\n needed 鈥?claude --continue parity)\n --resume [id] Resume a session by id (no id 鈫?most\n recent 鈥?claude --resume parity)\n --fork-session When resuming, branch into a NEW session\n id and leave the original untouched\n (claude --fork-session parity)\n --fork-request-id <key> Stable idempotency key for\n --fork-session retries (omit for a new\n fork each invocation)\n --add-dir <dir> Extra working directory the agent may\n read/search/edit (repeatable)\n --checkpoint Auto-snapshot the work tree before each\n mutating tool (DEFAULT inside a git\n repo; cc checkpoint restore to roll\n back)\n --no-checkpoint Disable auto-checkpointing (it is on by\n default inside git repos)\n --managed-checkpoint Checkpoint bounded mutating tools with\n Process Broker; unavailable writer\n lifetimes are reported as coverage none\n --managed-checkpoint-state <dir> Durable managed-checkpoint state\n directory (must be outside the\n workspace)\n --managed-checkpoint-exclude <path> Explicit workspace path excluded from\n managed checkpoints; repeatable and\n reported as partial coverage\n --safe-mode Run bare: disable project memory,\n settings hooks, memory recall, IDE\n context, status line and update notice\n (permission rules STAY active)\n --bare Everything --safe-mode disables PLUS\n skills, plugins and MCP/IDE auto-connect\n — minimal fast surface for scripted\n calls (explicit --mcp-config still\n loads; permission rules STAY active)\n --no-plugins Disable plugin customizations for this\n run\n --ephemeral No session persistence: nothing is\n written to the session store (headless;\n a --resume id still replays history\n read-only)\n --decision-mode <mode> Typed Skill-routing experiment for\n durable headless sessions: off | shadow\n | suggest (default: \"off\")\n --decision-provider <provider> Decision provider: typesafe | laya\n (local) | system-one (compatible API)\n (default: \"typesafe\")\n --decision-model <model> Decision model (defaults:\n typesafe=jev-latest, laya=laya; required\n for system-one)\n --decision-base-url <url> System One API base URL (laya: loopback\n only; other providers: HTTPS or\n loopback)\n --decision-timeout-ms <ms> Decision timeout in milliseconds\n (50-30000; default: 800)\n --capabilities Print a machine-readable capability\n manifest (JSON: protocol version, tools,\n permission modes, exit codes) and exit\n --disable-slash-commands Interactive REPL: don't dispatch '/'\n input as slash commands — it reaches the\n model verbatim (/exit and /quit stay\n live)\n --ax-screen-reader Screen-reader friendly output: no ANSI\n colors, no in-place status line repaints\n (also CC_SCREEN_READER=1)\n --worktree Run this session in a fresh git worktree\n (isolated branch; auto-removed when the\n session changes nothing)\n --no-worktree Background Git task: explicitly share\n the current work tree (intended for\n read-only tasks; writable runs are not\n isolated)\n --unattended Enable fail-closed shell action policy\n for scheduled/event-driven runs\n --unattended-allow <classes> Comma-separated action classes\n explicitly allowed for unattended shell\n runs\n --sandbox [image] Run shell commands in an ephemeral\n Docker sandbox (network disabled by\n default)\n --sandbox-mode <mode> Sandbox posture: off | workspace-write |\n strict (explicit isolation modes fail\n closed)\n --sandbox-network Allow network access inside --sandbox\n --otlp <file> Write the agent run's OpenTelemetry\n spans (model/tool/retry) as OTLP/JSON to\n <file>\n --otlp-content Include prompt/response CONTENT in\n --otlp spans (off by default; content is\n redacted unless this is set)\n --auto-rewake When an async `asyncRewake` hook (e.g. a\n background test) fails at turn end,\n re-engage the agent to fix it (bounded\n by --max-rewakes)\n --auto-pin Force-pin the original task (first user\n turn) through compaction (ON by default;\n disable with CC_AUTO_PIN=0 or config\n context.autoPin=false)\n --max-rewakes <n> Max auto-rewake re-drives per run\n (default 1); implies --auto-rewake\n --bg, --background Start as a detached background agent and\n return its id immediately\n --agent-id <id> Agent id for scoped memory recall\n --recall-limit <n> Top-K memories to inject into system\n prompt\n --recall-query <q> Query string for startup memory recall\n --no-recall-memory Disable startup memory recall\n --vim Start the interactive REPL in vim-mode\n line editing (toggle later with /vim; or\n CC_VIM=1)\n --no-stream Disable streamed response rendering\n --no-park-on-exit Close the session-core handle on exit\n instead of parking it\n --bundle <path> Agent bundle directory (may execute\n local MCP commands from mcp.json)\n -p, --print [prompt] Headless: run one non-interactive turn\n and exit\n --output-format <fmt> Headless output: text | json |\n stream-json (default: \"text\")\n --max-turns <n> Cap agent loop iterations (0 =\n unlimited; interactive streams default\n to unlimited, unattended runs to 50)\n --review-changes Headless: review write/edit tool changes\n once within remaining budgets; final\n text only (no partial deltas)\n --json-schema <file> Headless structured output: final reply\n must be JSON validating against this\n schema (invalid replies retried)\n --allowed-tools <list> Comma/space-separated tool allow-list\n (headless)\n --disallowed-tools <list> Comma/space-separated tool deny-list\n (headless)\n --permission-mode <mode> manual | auto | dontAsk | default | plan\n | acceptEdits | bypassPermissions (plan\n headless-only)\n --no-file-refs Disable @path file-reference expansion\n in the prompt (headless)\n --no-slash-macros Disable /name custom-command\n (.claude/commands) expansion in the\n prompt (headless)\n --system-prompt <text> Replace the built-in system prompt\n (literal text or @file)\n --append-system-prompt <text> Append extra guidance to the system\n prompt (literal text or @file)\n --no-project-memory Skip auto-loaded project memory (cc.md /\n CLAUDE.md / AGENTS.md hierarchy,\n .chainlesschain/rules.md,\n .claude/rules/*.md) — a lean system\n prompt for token-tight surfaces (e.g.\n IDE chat). The agent can still read\n those files with tools when it needs\n them.\n --output-style <name> Apply a named output-style persona\n (.claude/output-styles/<name>.md or a\n built-in: concise | explanatory |\n learning)\n --input-format <fmt> Headless input: text | stream-json\n (NDJSON user events on stdin,\n multi-turn) (default: \"text\")\n --trace-id <id> Correlation id stamped as `trace_id` on\n every stream-json output line (also read\n from CC_TRACE_ID). Lets an IDE/bridge\n trace one run across its own logs, the\n CLI, transcripts and diagnostics.\n Auto-generated per run when omitted.\n --fallback-model <model> Backup model(s) to try in order when the\n primary fails (transient error or\n model-not-found). Repeatable or\n comma-separated; up to 3. A\n `provider:model` entry (e.g.\n openai:gpt-4o) falls back\n cross-provider, using that provider's\n API key from its env var (skipped if\n unset — never reuses the primary key).\n Defaults to config llm.fallbackModels.\n --include-partial-messages Emit live assistant-text deltas as\n stream_event lines (requires\n --output-format stream-json)\n --include-hook-events Emit redacted hook and subagent\n lifecycle events (requires\n --output-format stream-json)\n --goal [id] Bind a cc goal into the run (id, or omit\n the value to auto-resolve the active\n goal)\n --goal-assess After the run, ask the model to assess\n goal progress and persist it (opt-in;\n costs one extra completion; requires\n --goal)\n --goal-condition <spec> Session completion condition; prefer\n verify:<manifest.json> for independent\n engineering acceptance, or\n exit-zero:/file-exists:/contains:/regex:;\n model:<desc> uses model judgment\n --goal-recovery-reviewed Resume an interrupted goal after\n reviewing prior effects and usage\n (requires --resume/--continue and\n --goal-condition)\n --max-outer-turns <n> Max outer re-drive turns for\n --goal-condition (default 10, hard cap\n 100)\n --goal-max-tokens <n> Token budget across --goal-condition\n outer turns\n --goal-max-cost <usd> Cost budget (USD) across\n --goal-condition outer turns\n --goal-max-time <ms> Wall-clock budget (ms) across\n --goal-condition outer turns\n --mcp-config <file> Load ad-hoc MCP servers from a JSON file\n for this run (headless); their tools\n become callable (mcp__<server>__<tool>)\n --no-mcp Don't auto-connect MCP servers\n registered with `cc mcp add\n --auto-connect` (--mcp-config still\n loads)\n --no-mcp-auto-connect Disable implicit MCP and editor\n discovery (explicit --mcp-config or\n bridge flags still apply)\n --ide Force-enable IDE bridge auto-connect:\n discover a running editor's MCP server\n via ~/.chainlesschain/ide/*.json\n (default: auto inside an IDE integrated\n terminal)\n --no-ide Disable IDE bridge auto-connect\n --pdh Force-enable PDH bridge auto-connect:\n discover the Android app's\n device-capability MCP server via\n ~/.chainlesschain/pdh-bridge/*.json\n (default: auto when\n CHAINLESSCHAIN_PDH_PORT is set)\n --no-pdh Disable PDH bridge auto-connect\n --jetbrains Force-enable IntelliJ IDEA built-in MCP\n (IDEA >= 2025.2) as server `idea`\n (default: auto when the ChainlessChain\n JetBrains plugin injects\n CHAINLESSCHAIN_JETBRAINS_MCP_URL)\n --no-jetbrains Disable IDEA built-in MCP auto-connect\n --interactive-approvals Stream mode: confirm-tier approvals\n become approval_request/approval\n stdin-stdout events instead of failing\n closed (chat-panel UX)\n --permission-prompt-tool <tool> Defer tool approvals to an MCP tool\n (mcp__<server>__<tool>; requires\n --mcp-config) instead of headless\n fail-closed\n --remote-control Route confirm-tier approvals to paired\n mobile/web devices — requires a relay or\n explicit LAN opt-in; headless waits\n fail-closed, interactive races the\n terminal prompt (also /remote-control)\n --remote-control-allow-lan Permit --remote-control to expose its\n authenticated WS endpoint on a trusted\n LAN\n --channels <list> Inbound channels for the interactive\n session (webhook[:port],telegram) —\n external events enter as user turns;\n webhook needs its bearer token, telegram\n needs channels.telegram.allowFrom\n --settings <file> Merge an extra\n .claude/settings.json-shaped file for\n this run: permission rules\n (allow/ask/deny) + native config\n overrides (model, env)\n --max-budget-usd <amount> Hard USD spend cap: stop the run before\n the next paid LLM call once the\n estimated cost reaches this (headless;\n uses the cc cost price table)\n --session-budget Enable the durable session-wide budget\n authority (headless; requires\n --session/--resume/--continue)\n --session-max-concurrent <n> Durable session cap for concurrent child\n work\n --session-max-spawns <n> Durable session cap for total child-work\n admissions\n --session-max-depth <n> Durable session cap for child-agent\n nesting depth\n --session-max-turns <n> Durable session cap for model turns\n across resumes\n --session-max-tokens <n> Durable session cap for\n provider-reported tokens across resumes\n --session-max-cost-usd <amount> Durable session cost cap across resumes\n (requires priced provider usage)\n --session-max-wall-ms <n> Durable session cap for cumulative\n active wall time\n --session-max-tool-ms <n> Durable session cap for aggregate tool\n execution time\n --observability-workspace <id> Persist a workspace scope on new session\n authority for causal reports\n --observability-team <id> Persist a team scope on new session\n authority for causal reports\n --observability-policy <id> Persist a policy scope on new session\n authority for causal reports\n --strict-mcp-config Use ONLY --mcp-config servers; ignore\n registered (cc mcp add) and IDE-bridge\n MCP for a reproducible tool surface\n --project-mcp Opt in to loading a project-scoped\n .mcp.json (default off; a checked-in\n .mcp.json can spawn commands)\n --replay-user-messages Stream-input mode: echo each accepted\n stdin user message back as a `user`\n event (transcript/correlation)\n --allow-dangerous-bypass Bypass all permission prompts in\n headless mode (DANGEROUS: auto-approves\n all tool calls) (default: false)\n -y, --yolo Alias for --allow-dangerous-bypass\n (default: false)\n --dangerously-skip-permissions Alias for --allow-dangerous-bypass\n (default: false)\n -h, --help display help for command\n\nCommands:\n controlled-host [options] Run against a pre-provisioned Linux\n permission authority (one-shot, dontAsk)\n process-ownership Inspect Linux process quarantine or\n explicitly stop one recoverable\n execution\n",
|
|
9
9
|
"agent-network": "Usage: chainlesschain agent-network|anet [options] [command]\n\nDecentralized Agent Network (Phase 24) — DID / registry / credentials / task\nrouting\n\nOptions:\n -h, --help display help for command\n\nCommands:\n config [options] Show network constants & reputation weights\n dimensions [options] List reputation dimensions\n task-statuses [options] List task lifecycle statuses\n did-create [options] Create an Agent DID (Ed25519 + DID document)\n did-resolve [options] <did> Resolve DID → DID document\n dids [options] List Agent DIDs\n did-deactivate [options] <did> Deactivate a DID (also forces registry offline)\n sign [options] <did> <data> Sign data with agent's Ed25519 key\n verify [options] <did> <data> <signature> Verify a signature from an agent\n register [options] <did> <orgId> Register an Agent in the federated registry\n unregister [options] <did> Remove an Agent from the registry\n heartbeat [options] <did> Bump last_heartbeat (forces online)\n discover [options] Discover agents (capability / org / status)\n sweep [options] Mark stale online agents offline\n peer-add [options] <peerId> Add/update a Kademlia peer (k-bucket auto-computed)\n peer-remove [options] <peerId> Remove a peer\n peers [options] List peers (optionally by k-bucket)\n auth-start [options] <did> Issue an auth challenge for a DID\n auth-complete [options] <sessionId> <signature> Complete auth with signature over challenge\n auth-validate [options] <token> Validate a session token (returns agentDid or exits 1)\n auth-sessions [options] List auth sessions\n credential-issue [options] <issuerDid> <subjectDid> Issue a VC with HMAC/Ed25519 proof\n credential-verify [options] <id> Verify a VC (signature + expiry + revocation)\n credential-revoke [options] <id> Revoke a credential\n credential-show [options] <id> Show a credential\n credentials [options] List credentials (filter by subject/issuer/status/type)\n task-route [options] <sourceOrg> <taskType> Route task → pick best-rep agent matching capability\n task-show [options] <taskId> Show a task\n task-status [options] <taskId> <status> Update task status (terminal states set completedAt)\n task-cancel [options] <taskId> Cancel a task (sets CANCELLED + reason)\n tasks [options] List tasks\n rep-update [options] <did> <dimension> <score> Record a reputation observation\n rep-show [options] <did> Show reputation summary (weighted total + per-dim avg)\n rep-history [options] <did> Show reputation history (newest first)\n rep-top [options] Top agents by dimension (or total)\n stats [options] Network-level statistics\n agent-maturities-v2 List V2 agent maturity states\n task-lifecycles-v2 List V2 task lifecycle states\n stats-v2 V2 agent-network stats\n get-max-active-agents-v2 Get max active agents per network (V2)\n set-max-active-agents-v2 <n> Set max active agents per network (V2)\n get-max-pending-tasks-v2 Get max pending tasks per agent (V2)\n set-max-pending-tasks-v2 <n> Set max pending tasks per agent (V2)\n get-agent-idle-ms-v2 Get agent idle threshold (V2)\n set-agent-idle-ms-v2 <ms> Set agent idle threshold (V2)\n get-task-stuck-ms-v2 Get task stuck threshold (V2)\n set-task-stuck-ms-v2 <ms> Set task stuck threshold (V2)\n active-agent-count-v2 <networkId> Active agent count for network (V2)\n pending-task-count-v2 <agentId> Pending task count for agent (V2)\n register-agent-v2 [options] <id> Register a V2 agent\n get-agent-v2 <id> Get a V2 agent\n list-agents-v2 [options] List V2 agents\n set-agent-status-v2 <id> <next> Set V2 agent status\n activate-agent-v2 <id> Activate a V2 agent\n suspend-agent-v2 <id> Suspend a V2 agent\n revoke-agent-v2 <id> Revoke a V2 agent\n touch-agent-v2 <id> Touch a V2 agent\n create-task-v2 [options] <id> Create a V2 task\n get-task-v2 <id> Get a V2 task\n list-tasks-v2 [options] List V2 tasks\n set-task-status-v2 <id> <next> Set V2 task status\n start-task-v2 <id> Start a V2 task\n complete-task-v2 <id> Complete a V2 task\n fail-task-v2 <id> Fail a V2 task\n cancel-task-v2 <id> Cancel a V2 task\n auto-suspend-idle-agents-v2 Auto-suspend idle V2 agents\n auto-fail-stuck-tasks-v2 Auto-fail stuck V2 tasks\n help [command] display help for command\n",
|
|
10
10
|
"agents": "Usage: chainlesschain agents [options] [command]\n\nUser-defined subagents (.claude/agents/*.md)\n\nOptions:\n -h, --help display help for command\n\nCommands:\n background|bg [options] List background agent sessions\n logs [options] <id> Print recent output from a background agent\n view [options] <id> Show a detailed background agent view\n stop [options] <id> Stop a running background agent\n rename [options] <id> <title...> Rename a background agent session\n list|ls [options] List discovered subagents (project +\n personal)\n show [options] <name> Show an agent's metadata + system prompt\n run [options] <name> [task...] Run a task headlessly as the named subagent\n new [options] <name> Scaffold a new agent file (project-native\n .chainlesschain/agents/)\n help [command] display help for command\n",
|
|
11
11
|
"android": "Usage: chainlesschain android [options] [command]\n\nAndroid-native bridge: ContentResolver / SAF / Accessibility / Shizuku / root\n(Plan A A7)\n\nOptions:\n -h, --help display help for command\n\nCommands:\n caps [options] Probe what bridge capabilities are available on this\n device\n contacts ContentResolver: contacts\n sms ContentResolver: SMS\n calls ContentResolver: call log\n app PackageManager: app inventory + Intent\n fs SAF / sandbox filesystem\n a11y Accessibility Service\n shizuku Shizuku ADB-like privileges\n root Magisk root su\n perms [options] <name> Check (and request) a runtime permission\n help [command] display help for command\n",
|
package/src/commands/agent.js
CHANGED
|
@@ -390,6 +390,7 @@ export function registerAgentCommand(program, dependencies = {}) {
|
|
|
390
390
|
"--bare",
|
|
391
391
|
"Everything --safe-mode disables PLUS skills, plugins and MCP/IDE auto-connect — minimal fast surface for scripted calls (explicit --mcp-config still loads; permission rules STAY active)",
|
|
392
392
|
)
|
|
393
|
+
.option("--no-plugins", "Disable plugin customizations for this run")
|
|
393
394
|
.option(
|
|
394
395
|
"--ephemeral",
|
|
395
396
|
"No session persistence: nothing is written to the session store (headless; a --resume id still replays history read-only)",
|
|
@@ -619,6 +620,10 @@ export function registerAgentCommand(program, dependencies = {}) {
|
|
|
619
620
|
"--no-mcp",
|
|
620
621
|
"Don't auto-connect MCP servers registered with `cc mcp add --auto-connect` (--mcp-config still loads)",
|
|
621
622
|
)
|
|
623
|
+
.option(
|
|
624
|
+
"--no-mcp-auto-connect",
|
|
625
|
+
"Disable implicit MCP and editor discovery (explicit --mcp-config or bridge flags still apply)",
|
|
626
|
+
)
|
|
622
627
|
.option(
|
|
623
628
|
"--ide",
|
|
624
629
|
"Force-enable IDE bridge auto-connect: discover a running editor's MCP server via ~/.chainlesschain/ide/*.json (default: auto inside an IDE integrated terminal)",
|
|
@@ -864,6 +869,8 @@ export function registerAgentCommand(program, dependencies = {}) {
|
|
|
864
869
|
// 2.1.169 parity): flip every customization kill-switch BEFORE anything
|
|
865
870
|
// loads. Permission rules stay active. --bare (CC_BARE) is safe mode
|
|
866
871
|
// PLUS skills, plugins and MCP/IDE/PDH/JetBrains auto-connect off.
|
|
872
|
+
const { applyCustomizationOptions } = await import("../lib/safe-mode.js");
|
|
873
|
+
applyCustomizationOptions(options);
|
|
867
874
|
let safeIsolationRequested = options.permissionMode === "auto";
|
|
868
875
|
{
|
|
869
876
|
const {
|
package/src/data/changelog.json
CHANGED
|
@@ -1,6 +1,19 @@
|
|
|
1
1
|
{
|
|
2
2
|
"source": "CHANGELOG.md",
|
|
3
3
|
"releases": [
|
|
4
|
+
{
|
|
5
|
+
"productVersion": null,
|
|
6
|
+
"cliVersion": "0.166.136",
|
|
7
|
+
"cliVersions": ["0.166.136"],
|
|
8
|
+
"date": "2026-10-31",
|
|
9
|
+
"title": "",
|
|
10
|
+
"sections": [
|
|
11
|
+
{
|
|
12
|
+
"heading": "Fixed - cc CLI 0.166.136: verified history forks and background policy restrictions (candidate, 2026-10-31)",
|
|
13
|
+
"body": "- Admit complete, verified session-history forks without weakening strict rewind-prefix checks; retain source provenance and capability rejection controls.\n- Preserve plugin/MCP auto-connect restrictions through persisted background launch profiles and real CLI flags. Reject malformed policy values before customization loading or fallback normalization.\n- Cover pinned-image metadata/pixel limits and owner-aborted pending approvals with positive and negative controls. Compare fixture inode identities as BigInt to avoid Windows Number precision loss.\n- This is an engineering repair of the five remaining failed tasks, not a new model acceptance run. Historical six-task acceptance stays 1/6 (cumulative 40/45); publication is blocked until the new exact commit passes complete CLI CI and Strict Sandbox."
|
|
14
|
+
}
|
|
15
|
+
]
|
|
16
|
+
},
|
|
4
17
|
{
|
|
5
18
|
"productVersion": null,
|
|
6
19
|
"cliVersion": "0.166.135",
|
|
@@ -48,6 +48,29 @@ function positive(value, integer = false) {
|
|
|
48
48
|
return integer ? Math.floor(number) : number;
|
|
49
49
|
}
|
|
50
50
|
|
|
51
|
+
function invalidProfileField(field) {
|
|
52
|
+
const error = new Error(`Invalid background launch profile field: ${field}`);
|
|
53
|
+
error.code = "BACKGROUND_LAUNCH_PROFILE_INVALID";
|
|
54
|
+
return error;
|
|
55
|
+
}
|
|
56
|
+
|
|
57
|
+
function policyBudget(value, field) {
|
|
58
|
+
const text = String(value).trim();
|
|
59
|
+
const cost = field.toLowerCase().includes("cost");
|
|
60
|
+
const number = Number(value);
|
|
61
|
+
if (
|
|
62
|
+
value == null ||
|
|
63
|
+
!(cost ? /^\+?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i : /^\+?\d+$/).test(
|
|
64
|
+
text,
|
|
65
|
+
) ||
|
|
66
|
+
!Number.isFinite(number) ||
|
|
67
|
+
number <= 0 ||
|
|
68
|
+
(!cost && !Number.isSafeInteger(number))
|
|
69
|
+
)
|
|
70
|
+
throw invalidProfileField(`budget.${field}`);
|
|
71
|
+
return number;
|
|
72
|
+
}
|
|
73
|
+
|
|
51
74
|
function sortedStrings(values, { split = false, pathsFrom = null } = {}) {
|
|
52
75
|
const raw = Array.isArray(values) ? values : values ? [values] : [];
|
|
53
76
|
const expanded = split
|
|
@@ -356,6 +379,17 @@ export function captureBackgroundLaunchProfile({
|
|
|
356
379
|
index++;
|
|
357
380
|
return next;
|
|
358
381
|
};
|
|
382
|
+
const takePolicy = (allowEmpty = false) => {
|
|
383
|
+
const next = inline !== null ? inline : args[index + 1];
|
|
384
|
+
if (
|
|
385
|
+
next == null ||
|
|
386
|
+
(inline === null && next.startsWith("--")) ||
|
|
387
|
+
(!allowEmpty && next.trim() === "")
|
|
388
|
+
)
|
|
389
|
+
throw invalidProfileField(`argv.${name}`);
|
|
390
|
+
if (inline === null) index++;
|
|
391
|
+
return next;
|
|
392
|
+
};
|
|
359
393
|
switch (name) {
|
|
360
394
|
case "--provider":
|
|
361
395
|
profile.llm.provider = scalar(take());
|
|
@@ -376,14 +410,17 @@ export function captureBackgroundLaunchProfile({
|
|
|
376
410
|
fallbackModels.push(...orderedStrings(take(), { split: true }));
|
|
377
411
|
break;
|
|
378
412
|
case "--allowed-tools":
|
|
379
|
-
profile.tools.allowed = sortedStrings(
|
|
413
|
+
profile.tools.allowed = sortedStrings(takePolicy(true), {
|
|
414
|
+
split: true,
|
|
415
|
+
});
|
|
380
416
|
break;
|
|
381
417
|
case "--disallowed-tools":
|
|
382
|
-
profile.tools.disallowed = sortedStrings(
|
|
418
|
+
profile.tools.disallowed = sortedStrings(takePolicy(true), {
|
|
419
|
+
split: true,
|
|
420
|
+
});
|
|
383
421
|
break;
|
|
384
422
|
case "--permission-mode": {
|
|
385
|
-
|
|
386
|
-
profile.permission.mode = PERMISSION_MODES.has(mode) ? mode : "default";
|
|
423
|
+
profile.permission.mode = scalar(takePolicy());
|
|
387
424
|
break;
|
|
388
425
|
}
|
|
389
426
|
case "--allow-dangerous-bypass":
|
|
@@ -395,7 +432,7 @@ export function captureBackgroundLaunchProfile({
|
|
|
395
432
|
profile.permission.unattended = true;
|
|
396
433
|
break;
|
|
397
434
|
case "--unattended-allow":
|
|
398
|
-
profile.permission.unattendedAllow = sortedStrings(
|
|
435
|
+
profile.permission.unattendedAllow = sortedStrings(takePolicy(true), {
|
|
399
436
|
split: true,
|
|
400
437
|
});
|
|
401
438
|
break;
|
|
@@ -413,8 +450,7 @@ export function captureBackgroundLaunchProfile({
|
|
|
413
450
|
profile.sandbox.image = scalar(take(true));
|
|
414
451
|
break;
|
|
415
452
|
case "--sandbox-mode": {
|
|
416
|
-
|
|
417
|
-
profile.sandbox.mode = SANDBOX_MODES.has(mode) ? mode : null;
|
|
453
|
+
profile.sandbox.mode = scalar(takePolicy());
|
|
418
454
|
break;
|
|
419
455
|
}
|
|
420
456
|
case "--sandbox-network":
|
|
@@ -427,6 +463,12 @@ export function captureBackgroundLaunchProfile({
|
|
|
427
463
|
profile.mcp.disabled = true;
|
|
428
464
|
profile.runtime.noMcpAutoConnect = true;
|
|
429
465
|
break;
|
|
466
|
+
case "--no-mcp-auto-connect":
|
|
467
|
+
profile.runtime.noMcpAutoConnect = true;
|
|
468
|
+
break;
|
|
469
|
+
case "--no-plugins":
|
|
470
|
+
profile.plugins.disabled = true;
|
|
471
|
+
break;
|
|
430
472
|
case "--strict-mcp-config":
|
|
431
473
|
profile.mcp.strict = true;
|
|
432
474
|
break;
|
|
@@ -461,28 +503,43 @@ export function captureBackgroundLaunchProfile({
|
|
|
461
503
|
addDirs.push(take());
|
|
462
504
|
break;
|
|
463
505
|
case "--max-turns":
|
|
464
|
-
profile.budget.maxTurns =
|
|
506
|
+
profile.budget.maxTurns = policyBudget(takePolicy(), "maxTurns");
|
|
465
507
|
break;
|
|
466
508
|
case "--max-budget-usd":
|
|
467
|
-
profile.budget.maxCostUsd =
|
|
509
|
+
profile.budget.maxCostUsd = policyBudget(takePolicy(), "maxCostUsd");
|
|
468
510
|
break;
|
|
469
511
|
case "--thinking-budget":
|
|
470
|
-
profile.budget.thinkingTokens =
|
|
512
|
+
profile.budget.thinkingTokens = policyBudget(
|
|
513
|
+
takePolicy(),
|
|
514
|
+
"thinkingTokens",
|
|
515
|
+
);
|
|
471
516
|
break;
|
|
472
517
|
case "--max-rewakes":
|
|
473
|
-
profile.budget.maxRewakes =
|
|
518
|
+
profile.budget.maxRewakes = policyBudget(takePolicy(), "maxRewakes");
|
|
474
519
|
break;
|
|
475
520
|
case "--max-outer-turns":
|
|
476
|
-
profile.budget.maxOuterTurns =
|
|
521
|
+
profile.budget.maxOuterTurns = policyBudget(
|
|
522
|
+
takePolicy(),
|
|
523
|
+
"maxOuterTurns",
|
|
524
|
+
);
|
|
477
525
|
break;
|
|
478
526
|
case "--goal-max-tokens":
|
|
479
|
-
profile.budget.goalMaxTokens =
|
|
527
|
+
profile.budget.goalMaxTokens = policyBudget(
|
|
528
|
+
takePolicy(),
|
|
529
|
+
"goalMaxTokens",
|
|
530
|
+
);
|
|
480
531
|
break;
|
|
481
532
|
case "--goal-max-cost":
|
|
482
|
-
profile.budget.goalMaxCostUsd =
|
|
533
|
+
profile.budget.goalMaxCostUsd = policyBudget(
|
|
534
|
+
takePolicy(),
|
|
535
|
+
"goalMaxCostUsd",
|
|
536
|
+
);
|
|
483
537
|
break;
|
|
484
538
|
case "--goal-max-time":
|
|
485
|
-
profile.budget.goalMaxTimeMs =
|
|
539
|
+
profile.budget.goalMaxTimeMs = policyBudget(
|
|
540
|
+
takePolicy(),
|
|
541
|
+
"goalMaxTimeMs",
|
|
542
|
+
);
|
|
486
543
|
break;
|
|
487
544
|
case "--safe-mode":
|
|
488
545
|
profile.runtime.safeMode = true;
|
|
@@ -667,12 +724,70 @@ export function normalizeBackgroundLaunchProfile(input) {
|
|
|
667
724
|
);
|
|
668
725
|
}
|
|
669
726
|
const rejectField = (field) => {
|
|
670
|
-
|
|
671
|
-
`Invalid background launch profile field: ${field}`,
|
|
672
|
-
);
|
|
673
|
-
error.code = "BACKGROUND_LAUNCH_PROFILE_INVALID";
|
|
674
|
-
throw error;
|
|
727
|
+
throw invalidProfileField(field);
|
|
675
728
|
};
|
|
729
|
+
for (const group of [
|
|
730
|
+
"llm",
|
|
731
|
+
"tools",
|
|
732
|
+
"permission",
|
|
733
|
+
"sandbox",
|
|
734
|
+
"mcp",
|
|
735
|
+
"plugins",
|
|
736
|
+
"runtime",
|
|
737
|
+
"budget",
|
|
738
|
+
])
|
|
739
|
+
if (
|
|
740
|
+
input[group] != null &&
|
|
741
|
+
(typeof input[group] !== "object" || Array.isArray(input[group]))
|
|
742
|
+
)
|
|
743
|
+
rejectField(group);
|
|
744
|
+
for (const [group, fields] of Object.entries({
|
|
745
|
+
permission: [
|
|
746
|
+
"dangerousBypass",
|
|
747
|
+
"unattended",
|
|
748
|
+
"interactiveApprovals",
|
|
749
|
+
"remoteControl",
|
|
750
|
+
],
|
|
751
|
+
sandbox: ["enabled", "network"],
|
|
752
|
+
mcp: ["disabled", "strict", "project"],
|
|
753
|
+
plugins: ["disabled"],
|
|
754
|
+
runtime: [
|
|
755
|
+
"safeMode",
|
|
756
|
+
"bare",
|
|
757
|
+
"managedCheckpoint",
|
|
758
|
+
"noProjectMemory",
|
|
759
|
+
"noFileRefs",
|
|
760
|
+
"noSlashMacros",
|
|
761
|
+
"noRecallMemory",
|
|
762
|
+
"noMcpAutoConnect",
|
|
763
|
+
"autoRewake",
|
|
764
|
+
"autoPin",
|
|
765
|
+
"noStream",
|
|
766
|
+
"noParkOnExit",
|
|
767
|
+
],
|
|
768
|
+
}))
|
|
769
|
+
for (const field of fields)
|
|
770
|
+
if (
|
|
771
|
+
input[group]?.[field] !== undefined &&
|
|
772
|
+
typeof input[group][field] !== "boolean"
|
|
773
|
+
)
|
|
774
|
+
rejectField(`${group}.${field}`);
|
|
775
|
+
for (const field of ["ide", "pdh", "jetbrains"])
|
|
776
|
+
if (input.mcp?.[field] != null && !TRI_STATES.has(input.mcp[field]))
|
|
777
|
+
rejectField(`mcp.${field}`);
|
|
778
|
+
for (const [group, fields] of Object.entries({
|
|
779
|
+
tools: ["allowed", "disallowed"],
|
|
780
|
+
permission: ["unattendedAllow"],
|
|
781
|
+
}))
|
|
782
|
+
for (const field of fields) {
|
|
783
|
+
const value = input[group]?.[field];
|
|
784
|
+
if (
|
|
785
|
+
value != null &&
|
|
786
|
+
(!Array.isArray(value) ||
|
|
787
|
+
value.some((item) => typeof item !== "string" || !item.trim()))
|
|
788
|
+
)
|
|
789
|
+
rejectField(`${group}.${field}`);
|
|
790
|
+
}
|
|
676
791
|
// A persisted policy must not silently fall back to a weaker default.
|
|
677
792
|
if (
|
|
678
793
|
input.permission?.mode != null &&
|
|
@@ -692,14 +807,8 @@ export function normalizeBackgroundLaunchProfile(input) {
|
|
|
692
807
|
"goalMaxTimeMs",
|
|
693
808
|
]) {
|
|
694
809
|
const value = input.budget?.[field];
|
|
695
|
-
if (value == null
|
|
696
|
-
|
|
697
|
-
if (
|
|
698
|
-
!Number.isFinite(number) ||
|
|
699
|
-
number <= 0 ||
|
|
700
|
-
(!field.toLowerCase().includes("cost") && !Number.isSafeInteger(number))
|
|
701
|
-
)
|
|
702
|
-
rejectField(`budget.${field}`);
|
|
810
|
+
if (value == null) continue;
|
|
811
|
+
policyBudget(value, field);
|
|
703
812
|
}
|
|
704
813
|
const cwd = canonicalPath(input.workspace?.cwd || process.cwd());
|
|
705
814
|
const safeBase = sanitizeBackgroundBaseUrl(input.llm?.baseUrl);
|
|
@@ -1020,6 +1129,11 @@ export function buildArgvFromBackgroundLaunchProfile(profile) {
|
|
|
1020
1129
|
pushFlag(argv, "--sandbox-network", p.sandbox.network);
|
|
1021
1130
|
pushValue(argv, "--mcp-config", p.mcp.configFile);
|
|
1022
1131
|
pushFlag(argv, "--no-mcp", p.mcp.disabled);
|
|
1132
|
+
pushFlag(
|
|
1133
|
+
argv,
|
|
1134
|
+
"--no-mcp-auto-connect",
|
|
1135
|
+
p.runtime.noMcpAutoConnect && !p.mcp.disabled,
|
|
1136
|
+
);
|
|
1023
1137
|
pushFlag(argv, "--strict-mcp-config", p.mcp.strict);
|
|
1024
1138
|
pushFlag(argv, "--project-mcp", p.mcp.project);
|
|
1025
1139
|
for (const [key, value] of [
|
|
@@ -1032,6 +1146,7 @@ export function buildArgvFromBackgroundLaunchProfile(profile) {
|
|
|
1032
1146
|
}
|
|
1033
1147
|
pushValue(argv, "--settings", p.settings.file);
|
|
1034
1148
|
pushValue(argv, "--bundle", p.plugins.bundle);
|
|
1149
|
+
pushFlag(argv, "--no-plugins", p.plugins.disabled && !p.runtime.bare);
|
|
1035
1150
|
for (const dir of p.workspace.addDirs) pushValue(argv, "--add-dir", dir);
|
|
1036
1151
|
pushValue(argv, "--max-turns", p.budget.maxTurns);
|
|
1037
1152
|
pushValue(argv, "--max-budget-usd", p.budget.maxCostUsd);
|
package/src/lib/safe-mode.js
CHANGED
|
@@ -83,3 +83,13 @@ export function bareModeRequested(opts = {}, env = process.env) {
|
|
|
83
83
|
const raw = env.CC_BARE;
|
|
84
84
|
return raw != null && /^(1|true|yes|on)$/i.test(String(raw).trim());
|
|
85
85
|
}
|
|
86
|
+
|
|
87
|
+
/** Apply independent saved restrictions without enabling the rest of bare mode. */
|
|
88
|
+
export function applyCustomizationOptions(options, env = process.env) {
|
|
89
|
+
if (options.plugins === false) env.CC_PLUGINS = "0";
|
|
90
|
+
if (options.mcpAutoConnect === false) {
|
|
91
|
+
options.mcp = false;
|
|
92
|
+
for (const field of ["ide", "pdh", "jetbrains"])
|
|
93
|
+
if (options[field] === undefined) options[field] = false;
|
|
94
|
+
}
|
|
95
|
+
}
|
|
@@ -108,6 +108,42 @@ export function createSessionHistoryOrigins() {
|
|
|
108
108
|
},
|
|
109
109
|
branchPrefix(messages, head, count) {
|
|
110
110
|
if (!context) return null;
|
|
111
|
+
// A branch may retain the complete verified context. A rewind must remove
|
|
112
|
+
// something, so its strict-prefix admission cannot decide this case.
|
|
113
|
+
if (messages.length === context.length) {
|
|
114
|
+
if (
|
|
115
|
+
!/^[a-f0-9]{64}$/u.test(head) ||
|
|
116
|
+
!Number.isSafeInteger(count) ||
|
|
117
|
+
count < 0 ||
|
|
118
|
+
context.some(
|
|
119
|
+
(entry) =>
|
|
120
|
+
historyBearing(entry) &&
|
|
121
|
+
(!entry.origin ||
|
|
122
|
+
!Number.isSafeInteger(entry.origin.first) ||
|
|
123
|
+
!Number.isSafeInteger(entry.origin.last) ||
|
|
124
|
+
entry.origin.first < 0 ||
|
|
125
|
+
entry.origin.last < entry.origin.first ||
|
|
126
|
+
entry.origin.last >= count),
|
|
127
|
+
)
|
|
128
|
+
)
|
|
129
|
+
return null;
|
|
130
|
+
try {
|
|
131
|
+
if (
|
|
132
|
+
fingerprint(context.map((entry) => entry.message)) !==
|
|
133
|
+
fingerprint(messages)
|
|
134
|
+
)
|
|
135
|
+
return null;
|
|
136
|
+
} catch {
|
|
137
|
+
return null;
|
|
138
|
+
}
|
|
139
|
+
return {
|
|
140
|
+
cutoff: count,
|
|
141
|
+
entries: context.map((entry) => ({
|
|
142
|
+
message: entry.message,
|
|
143
|
+
origin: entry.origin ? { ...entry.origin } : null,
|
|
144
|
+
})),
|
|
145
|
+
};
|
|
146
|
+
}
|
|
111
147
|
const cutoff = api.rewind(
|
|
112
148
|
{
|
|
113
149
|
prevHash: head,
|