chainlesschain 0.166.14 → 0.166.15

package/src/harness/worktree-isolator.js

@@ -173,7 +173,7 @@ function parseRegisteredWorktrees(output) {
 
 function readRegisteredWorktrees(repoDir) {
   return parseRegisteredWorktrees(
-    gitExec("worktree list --porcelain", repoDir),
+    gitExecArgs(["worktree", "list", "--porcelain"], repoDir),
   );
 }
 
@@ -251,10 +251,16 @@ function assertNoSymlinkAncestors(root, target, label) {
   }
 }
 
+function managedWorktreePathFromContext(context, branchName) {
+  return resolve(context.managedRoot, branchName.replace(/\//g, "-"));
+}
+
 export function managedWorktreePath(repoDir, branchName) {
   assertSafeGitRef(branchName, "branch name");
-  const { managedRoot } = repositoryManagementContext(repoDir);
-  return resolve(managedRoot, branchName.replace(/\//g, "-"));
+  return managedWorktreePathFromContext(
+    repositoryManagementContext(repoDir),
+    branchName,
+  );
 }
 
 /**
@@ -262,10 +268,11 @@ export function managedWorktreePath(repoDir, branchName) {
  * removal. Managed worktrees are direct children of `<repo>/.worktrees` and,
  * when a branch is known, have exactly the deterministic path created for it.
  */
-export function assertManagedWorktreePath(
+function assertManagedWorktreePathWithContext(
   repoDir,
   worktreePath,
   { branchName = null } = {},
+  context,
 ) {
   if (
     typeof repoDir !== "string" ||
@@ -280,7 +287,6 @@ export function assertManagedWorktreePath(
     assertSafeGitRef(branchName, "branch name");
   }
 
-  const context = repositoryManagementContext(repoDir);
   const candidate = resolve(worktreePath);
   const candidatePath = canonicalExistingPrefixPath(candidate);
   const candidateIdentity = normalizeFilesystemPath(candidatePath);
@@ -335,6 +341,19 @@ export function assertManagedWorktreePath(
   return candidatePath;
 }
 
+export function assertManagedWorktreePath(
+  repoDir,
+  worktreePath,
+  options = {},
+) {
+  return assertManagedWorktreePathWithContext(
+    repoDir,
+    worktreePath,
+    options,
+    repositoryManagementContext(repoDir),
+  );
+}
+
 function pathSeparator() {
   return process.platform === "win32" ? "\\" : "/";
 }
@@ -404,10 +423,11 @@ export function createWorktree(repoDir, branchName, baseBranch, options = {}) {
 
   const context = repositoryManagementContext(repoDir);
   ensureManagedWorktreeExcluded(context);
-  const worktreePath = assertManagedWorktreePath(
+  const worktreePath = assertManagedWorktreePathWithContext(
     repoDir,
-    managedWorktreePath(repoDir, branchName),
+    managedWorktreePathFromContext(context, branchName),
     { branchName },
+    context,
   );
 
   if (existsSync(worktreePath)) {
@@ -449,7 +469,12 @@ export function createWorktree(repoDir, branchName, baseBranch, options = {}) {
     )
       .trim()
       .toLowerCase();
-    assertManagedWorktreePath(repoDir, worktreePath, { branchName });
+    assertManagedWorktreePathWithContext(
+      repoDir,
+      worktreePath,
+      { branchName },
+      repositoryManagementContext(repoDir),
+    );
     // Sparse checkout: only materialize the packages this task needs. For a
     // large monorepo this cuts worktree creation time and disk. Cone mode wants
     // directory paths — our sparsePaths are package dirs. Fail-closed on unsafe
@@ -1067,6 +1092,44 @@ export function previewWorktreeMerge(repoDir, branchName, options = {}) {
     throw new Error(`Worktree not found for branch: ${branchName}`);
   }
 
+  // Prefer Git's read-only merge-tree for the overwhelmingly common clean
+  // preview. It computes the same recursive merge result without mutating the
+  // task worktree and then running a second process to abort it. A conflict or
+  // an older Git falls back to the established worktree-based path below so
+  // detailed conflict summaries and compatibility remain unchanged.
+  try {
+    const previewTree = gitExecArgs(
+      ["merge-tree", "--write-tree", baseBranch, branchName],
+      repoDir,
+    )
+      .split(/\r?\n/u)[0]
+      ?.trim();
+    if (/^[a-f0-9]{40,64}$/iu.test(previewTree || "")) {
+      return {
+        success: true,
+        previewOnly: true,
+        strategy,
+        branch: branchName,
+        baseBranch,
+        message: `Merge preview is clean. ${branchName} can be merged into ${baseBranch} without conflicts.`,
+        summary: {
+          conflictedFiles: 0,
+          bothModified: 0,
+          bothAdded: 0,
+          deleteModify: 0,
+        },
+        conflicts: [],
+        suggestions: [
+          `No merge conflicts detected between ${branchName} and ${baseBranch}.`,
+          "You can proceed with the final merge when ready.",
+        ],
+        previewEntrypoints: [],
+      };
+    }
+  } catch {
+    // Conflict/unsupported Git: preserve the detailed compatibility path.
+  }
+
   _abortMergeIfPresent(worktree.path);
 
   let mergeStarted = false;
@@ -1626,7 +1689,9 @@ function _resolveBaseBranchForMerge(repoDir, baseBranch) {
   }
 
   try {
-    return gitExec("rev-parse --abbrev-ref HEAD", repoDir) || "HEAD";
+    return (
+      gitExecArgs(["rev-parse", "--abbrev-ref", "HEAD"], repoDir) || "HEAD"
+    );
   } catch (_e) {
     return "HEAD";
   }

package/src/lib/agent-team/team-graph-runtime-adapter.js

@@ -7,6 +7,7 @@ import {
 import { GraphEventStore } from "../graph-kernel/event-store.js";
 import { GraphKernel } from "../graph-kernel/runtime.js";
 import { createGraphAuthorityBinding } from "../graph-kernel/authority.js";
+import { reduceGraphTrace } from "../graph-kernel/trace-reducer.js";
 
 const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}$/u;
 const DIGEST = /^sha256:[a-f0-9]{64}$/u;
@@ -1906,6 +1907,11 @@ export class TeamGraphRuntimeAdapter {
     return this.kernel.getRun(this.runId);
   }
 
+  traceProjection(options = {}) {
+    if (!this.kernel || !this.runId) return null;
+    return reduceGraphTrace(this.kernel.events(this.runId), options);
+  }
+
   events(options = {}) {
     if (!this.kernel || !this.runId) return [];
     return this.kernel.events(this.runId, options);

package/src/lib/agent-team/team-runner.js

@@ -2785,6 +2785,10 @@ export class TeamRunner {
           key,
           holder,
           error: failure?.message || String(failure),
+          code: failure?.code || null,
+          exitCode: Number.isInteger(failure?.exitCode)
+            ? failure.exitCode
+            : null,
           retry: outcome.retry === true,
           attempts: outcome.attempts,
           interrupted: failure?.code === "TEAM_TASK_HUMAN_INTERRUPTED",

package/src/lib/agent-team/team-worktree.js

@@ -1974,6 +1974,10 @@ export class TeamWorktreeCoordinator {
           ...(executionResult?.usageRecords
             ? { usageRecords: executionResult.usageRecords }
             : {}),
+          terminalEvidence: {
+            ...(executionResult?.terminalEvidence || {}),
+            commit: commitOid,
+          },
         };
       };
 

package/src/lib/formal-quality-eval-runtime.js

@@ -0,0 +1,92 @@
+import os from "node:os";
+import path from "node:path";
+
+export const FORMAL_QUALITY_HERMETIC_ENV = "CC_FORMAL_QUALITY_EVAL_HERMETIC";
+export const FORMAL_QUALITY_PROVIDER_ENV = "CC_FORMAL_QUALITY_EVAL_PROVIDER";
+export const FORMAL_QUALITY_ALLOWED_FILES_ENV =
+  "CC_FORMAL_QUALITY_EVAL_ALLOWED_FILES";
+export const FORMAL_QUALITY_FILE_TOOLS = Object.freeze([
+  "read_file",
+  "search_files",
+  "list_dir",
+  "write_file",
+  "edit_file",
+  "edit_file_hashed",
+]);
+
+/**
+ * The real-model quality harness opts into the already-supported hermetic
+ * headless boundary through a launcher-only environment marker. Keep the
+ * check exact so inherited or malformed values never change normal CLI runs.
+ */
+export function isFormalQualityHermeticRuntime(environment = process.env) {
+  if (environment?.[FORMAL_QUALITY_HERMETIC_ENV] !== "1") return false;
+  const configuredHome = String(environment?.CHAINLESSCHAIN_HOME || "").trim();
+  if (!configuredHome) return false;
+  const temporaryRoot = path.resolve(os.tmpdir());
+  const resolvedHome = path.resolve(configuredHome);
+  const relation = path.relative(temporaryRoot, resolvedHome);
+  return Boolean(
+    relation &&
+    relation !== ".." &&
+    !relation.startsWith(`..${path.sep}`) &&
+    !path.isAbsolute(relation),
+  );
+}
+
+/** Resolve the provider that the formal harness bound before any model call. */
+export function formalQualityProvider(environment = process.env) {
+  if (!isFormalQualityHermeticRuntime(environment)) return null;
+  const provider = String(environment?.[FORMAL_QUALITY_PROVIDER_ENV] || "")
+    .trim()
+    .toLowerCase();
+  return provider || null;
+}
+
+function validateAllowedFiles(value) {
+  const allowedFiles = Array.isArray(value) ? value : null;
+  if (
+    !allowedFiles ||
+    allowedFiles.length === 0 ||
+    allowedFiles.length > 16 ||
+    allowedFiles.some(
+      (file) =>
+        typeof file !== "string" ||
+        file.length === 0 ||
+        file.includes("\\") ||
+        file.includes("\0") ||
+        path.posix.isAbsolute(file) ||
+        path.posix.normalize(file) !== file ||
+        file === "." ||
+        file === ".." ||
+        file.startsWith("../"),
+    ) ||
+    new Set(allowedFiles).size !== allowedFiles.length
+  ) {
+    throw new Error("formal quality allowed-files binding is invalid");
+  }
+  return Object.freeze([...allowedFiles]);
+}
+
+/** Resolve the exact task-local file allowlist passed to a formal child. */
+export function formalQualityAllowedFiles(environment = process.env) {
+  if (!isFormalQualityHermeticRuntime(environment)) return null;
+  let allowedFiles;
+  try {
+    allowedFiles = JSON.parse(
+      String(environment?.[FORMAL_QUALITY_ALLOWED_FILES_ENV] || ""),
+    );
+  } catch {
+    throw new Error("formal quality allowed-files binding is invalid");
+  }
+  return validateAllowedFiles(allowedFiles);
+}
+
+/** Bind a validated plan allowlist to the child without widening normal runs. */
+export function formalQualityTaskAllowedFiles(
+  allowedFiles,
+  environment = process.env,
+) {
+  if (!isFormalQualityHermeticRuntime(environment)) return null;
+  return validateAllowedFiles(allowedFiles);
+}

package/src/lib/process-execution-broker/index.js

@@ -4201,9 +4201,35 @@ class ProcessExecutionBroker extends EventEmitter {
       args: filteredArgs,
       env: filteredEnv,
       report: credentialReport,
+      referenceIds: Object.entries(filteredEnv)
+        .filter(
+          ([key, value]) =>
+            (key.startsWith("CC_CRED_REF_") ||
+              key.startsWith("CC_CRED_ARG_REF_")) &&
+            typeof value === "string" &&
+            value.startsWith("cc-cred-"),
+        )
+        .map(([, value]) => value),
     };
   }
 
+  _revokeCredentialReferences(referenceIds, reason) {
+    if (
+      !Array.isArray(referenceIds) ||
+      typeof this._credentialAgent.revokeCredentialRef !== "function"
+    ) {
+      return;
+    }
+    for (const refId of new Set(referenceIds)) {
+      try {
+        this._credentialAgent.revokeCredentialRef(refId, reason);
+      } catch {
+        // Credential cleanup must never replace the authoritative process
+        // result. References remain bounded by their issuance TTL.
+      }
+    }
+  }
+
   _createCredentialContext(command, options, executionId, decision) {
     if (typeof this._credentialAgent.createBrokerContext !== "function") {
       return options.credentialContext;
@@ -4933,6 +4959,7 @@ class ProcessExecutionBroker extends EventEmitter {
     options = this._withAmbientProcessContext(command, options);
     const executionId = crypto.randomUUID();
     const startTime = Date.now();
+    let credentialReferenceIds = [];
     const origin = options.origin || "unknown";
     const requestedCwd = options.cwd || process.cwd();
     options = this._withWorkspaceTransactionBoundaries(options, requestedCwd, {
@@ -5055,6 +5082,7 @@ class ProcessExecutionBroker extends EventEmitter {
       );
       spawnOpts.env = credentialBoundary.env;
       args = credentialBoundary.args;
+      credentialReferenceIds = credentialBoundary.referenceIds;
       auditEntry.args = this._auditArgs(args, auditRedactArgIndexes);
       this._recordCredentialReport(auditEntry, credentialBoundary.report);
       this._stripCredentialControlOptions(spawnOpts);
@@ -5159,6 +5187,10 @@ class ProcessExecutionBroker extends EventEmitter {
       throw err;
     } finally {
       sandboxPlan.cleanup?.();
+      this._revokeCredentialReferences(
+        credentialReferenceIds,
+        "sync-process-settled",
+      );
     }
   }
 

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -2719,17 +2719,18 @@ function sameWindowsFileIdentity(left, right) {
   );
 }
 
-// Cleanup is authorized by the stable file-object identity, not by metadata
+// Cleanup is authorized by the stable volume/file identity, not by metadata
 // that Windows may settle after the helper closes its last write handle.  The
 // strict identity above remains authoritative while content is read or
 // attested; this cleanup-only comparison still rejects a same-path replacement
-// because that changes the inode/birth identity.
+// because that changes the inode. Node's Windows birthtime projection can
+// settle together with size/ctime/mtime, so it is metadata rather than part of
+// the deletion authority.
 function sameWindowsFileObjectIdentity(left, right) {
   return (
     left.dev === right.dev &&
     left.ino === right.ino &&
-    left.mode === right.mode &&
-    left.birthtimeNs === right.birthtimeNs
+    left.mode === right.mode
   );
 }
 

package/src/lib/secure-fs.js

@@ -605,6 +605,25 @@ export const _deps = {
 // tests and repairPrivatePath() always execute and verify the operation.
 const securedWindowsPaths = new Set();
 const WINDOWS_ACL_BATCH_SIZE = 500;
+const WINDOWS_ACL_TIMEOUT_ENV = "CC_SECURE_FS_WINDOWS_ACL_TIMEOUT_MS";
+const MAX_WINDOWS_ACL_TIMEOUT_MS = 5 * 60_000;
+
+// Windows hosted runners can need more than the normal 15/30 second allowance
+// to cold-start PowerShell and load the access-control types. A trusted harness
+// may raise (but never lower) that allowance; the cap prevents an inherited
+// environment value from wedging owner-only storage initialization forever.
+export function _resolveWindowsAclTimeout(
+  defaultTimeoutMs,
+  environment = process.env,
+) {
+  const fallback = Math.max(1, Math.floor(Number(defaultTimeoutMs) || 1));
+  const configured = Number(environment?.[WINDOWS_ACL_TIMEOUT_ENV]);
+  if (!Number.isFinite(configured) || configured <= 0) return fallback;
+  return Math.min(
+    Math.max(fallback, Math.floor(configured)),
+    MAX_WINDOWS_ACL_TIMEOUT_MS,
+  );
+}
 
 function repairWindowsAclOnce(target, deps, options) {
   const cacheable = !options.deps;
@@ -630,7 +649,11 @@ function windowsAcl(target, operation, deps) {
       target,
       operation,
     ],
-    { encoding: "utf8", windowsHide: true, timeout: 15000 },
+    {
+      encoding: "utf8",
+      windowsHide: true,
+      timeout: _resolveWindowsAclTimeout(15_000),
+    },
   );
   let details = null;
   try {
@@ -675,7 +698,7 @@ function windowsAclBatch(targets, operation, deps, expectedKind = null) {
         ...(expectedKind ? { expectedKind } : {}),
       }),
       windowsHide: true,
-      timeout: 30000,
+      timeout: _resolveWindowsAclTimeout(30_000),
       maxBuffer: 4 * 1024 * 1024,
     },
   );

package/src/runtime/agent-core.js

@@ -746,14 +746,25 @@ export function reapIdleBackgroundShellTasks(deps = {}) {
 // Foreground (synchronous) run_shell timeout. Configurable per-call via the
 // optional `timeout` arg; defaults to 60s and is hard-capped at 10 min so a
 // synchronous call can never wedge the loop indefinitely (use run_in_background
-// for genuinely long work).
+// for genuinely long work). Trusted harnesses may set a minimum through the
+// parent-process environment so model-generated tool arguments cannot shorten a
+// benchmark's platform-neutral execution allowance. The unset path preserves
+// the public per-call semantics byte-for-byte.
 const DEFAULT_SHELL_TIMEOUT_MS = 60000;
 const MAX_SHELL_TIMEOUT_MS = 600000;
-function _resolveShellTimeout(raw) {
-  if (raw == null) return DEFAULT_SHELL_TIMEOUT_MS;
+export function _resolveShellTimeout(raw, environment = process.env) {
+  const configuredMinimum = Number(environment?.CC_RUN_SHELL_MIN_TIMEOUT_MS);
+  const minimum =
+    Number.isFinite(configuredMinimum) && configuredMinimum > 0
+      ? Math.min(Math.floor(configuredMinimum), MAX_SHELL_TIMEOUT_MS)
+      : 0;
+  if (raw == null) return Math.max(DEFAULT_SHELL_TIMEOUT_MS, minimum);
   const n = Number(raw);
-  if (!Number.isFinite(n) || n <= 0) return DEFAULT_SHELL_TIMEOUT_MS;
-  return Math.min(Math.floor(n), MAX_SHELL_TIMEOUT_MS);
+  const requested =
+    Number.isFinite(n) && n > 0
+      ? Math.min(Math.floor(n), MAX_SHELL_TIMEOUT_MS)
+      : DEFAULT_SHELL_TIMEOUT_MS;
+  return Math.max(requested, minimum);
 }
 
 /**
@@ -1325,6 +1336,7 @@ const GUARDED_FILE_MUTATION_TOOLS = new Set([
 ]);
 const EXACT_FILE_MUTATION_SCOPE_TOOL_NAMES = new Set([
   "read_file",
+  "search_files",
   "list_dir",
   "write_file",
   "edit_file",

package/src/runtime/headless-runner.js

@@ -40,6 +40,10 @@ import {
 import { maybeApplyToolSearch } from "./mcp-tool-search.js";
 import { IterationBudget } from "../lib/iteration-budget.js";
 import { HostResourceBudget } from "../lib/host-resource-budget.js";
+import {
+  FORMAL_QUALITY_FILE_TOOLS,
+  isFormalQualityHermeticRuntime,
+} from "../lib/formal-quality-eval-runtime.js";
 import {
   startSession as jsonlStartSession,
   appendUserMessage as jsonlAppendUserMessage,
@@ -186,7 +190,6 @@ const HERMETIC_SKILL_LOADER = Object.freeze({
   getCacheLedger: () => null,
   getLimits: () => null,
 });
-
 // EPIPE guard for `cc agent -p … | head`. Lives in pipe-safety.js (shared with
 // the stream-json driver + REPL); re-exported here for existing importers.
 export { installPipeSafety } from "./pipe-safety.js";
@@ -850,7 +853,9 @@ async function runAgentHeadlessInWorkspace(
   const baseUrl = options.baseUrl || "http://localhost:11434";
   const apiKey = options.apiKey || null;
   const cwd = options.cwd || process.cwd();
-  const hermeticExecution = options.hermeticExecution === true;
+  const formalQualityHermetic = isFormalQualityHermeticRuntime(process.env);
+  const hermeticExecution =
+    options.hermeticExecution === true || formalQualityHermetic;
   if (
     options.fileMutationScope != null &&
     (options.exactToolNames !== true || !hermeticExecution)
@@ -1220,12 +1225,14 @@ async function runAgentHeadlessInWorkspace(
     assertManagedPermissionMode(options.permissionMode, managedSettings);
   }
   const perm = resolvePermissionMode(options.permissionMode);
-  const enabledToolNames = resolveEnabledTools({
-    // An explicit --allowed-tools wins; otherwise a matched command's
-    // `allowed-tools:` frontmatter scopes the run (null when neither applies).
-    allowedTools: options.allowedTools || macroAllowedTools,
-    readOnly: perm.readOnly,
-  });
+  const enabledToolNames = formalQualityHermetic
+    ? [...FORMAL_QUALITY_FILE_TOOLS]
+    : resolveEnabledTools({
+        // An explicit --allowed-tools wins; otherwise a matched command's
+        // `allowed-tools:` frontmatter scopes the run (null when neither applies).
+        allowedTools: options.allowedTools || macroAllowedTools,
+        readOnly: perm.readOnly,
+      });
   const disabledTools = options.disallowedTools || [];
 
   // ── Best-effort runtime bootstrap (DB optional, like startAgentRepl) ───
@@ -1699,7 +1706,7 @@ async function runAgentHeadlessInWorkspace(
     : options.skillLoader || new CLISkillLoader();
   const systemContent = hermeticExecution
     ? composeSystemPrompt(
-        "You are a hermetic code fixer. Use only the exposed file tools, work only inside the current worktree, and mutate only the exact paths authorized in the user request. Do not invoke commands, plugins, hooks, IDE bridges, MCP servers, or sub-agents.",
+        "You are a hermetic code fixer. The exposed file tools are the complete tool surface. Inspect and mutate only the exact paths authorized in the user request, then return a concise completion message.",
         { projectMemory: false },
       )
     : composeSystemPrompt(

package/src/assets/web-panel/assets/MarkdownRenderer-BEPDcSwz.js

@@ -1 +0,0 @@
-import{P as c,J as p,b as s}from"./vendor-Bn1JzzAn.js";import{r as a}from"./markdown-Yo_c6Krv.js";import{_ as d}from"./index-C9gtY4nG.js";const _={__name:"MarkdownRenderer",props:{content:{type:String,default:""}},setup(t,{expose:o}){o();const e=t,r=s(()=>a(e.content||"")),n={props:e,rendered:r,computed:s,get renderMarkdown(){return a}};return Object.defineProperty(n,"__isScriptSetup",{enumerable:!1,value:!0}),n}},i=["innerHTML"];function l(t,o,e,r,n,m){return c(),p("div",{class:"markdown-content",innerHTML:r.rendered},null,8,i)}const w=d(_,[["render",l],["__scopeId","data-v-0b0b9f63"],["__file","/tmp/cc-web-panel-eI5lXL/repo/packages/web-panel/src/components/MarkdownRenderer.vue"]]);export{w as M};

package/src/assets/web-panel/assets/devWarning-DdqnMhzi.js

@@ -1 +0,0 @@
-import{Q as r}from"./index-C9gtY4nG.js";const o=((n,a,e)=>{r(n,`[ant-design-vue: ${a}] ${e}`)});export{o as d};

package/src/assets/web-panel/assets/index-BcK8o4ke.js

@@ -1 +0,0 @@
-import{C as o}from"./Col-CkfdKhyJ.js";import{a0 as t}from"./index-C9gtY4nG.js";import"./vendor-Bn1JzzAn.js";import"./index-BQp5M0s1.js";import"./icons-DG5UD-6K.js";const s=t(o);export{s as default};

package/src/assets/web-panel/assets/index-DvbAjyYI.js

@@ -1 +0,0 @@
-import{A as o}from"./Row-CA_nASyL.js";import{a0 as t}from"./index-C9gtY4nG.js";import"./vendor-Bn1JzzAn.js";import"./responsiveObserve-pta_O8AU.js";import"./useFlexGapSupport-KcjZZ5U7.js";import"./styleChecker-p8NfWmcG.js";import"./index-BQp5M0s1.js";import"./icons-DG5UD-6K.js";const l=t(o);export{l as default};