chainlesschain 0.166.140 → 0.166.141

package/README.md

@@ -2,25 +2,43 @@
 
 Command-line interface for installing, configuring, and managing [ChainlessChain](https://www.chainlesschain.com), including the coding agent, governed tools, sessions, memory, and IDE integrations.
 
+<!-- release141-pairing:start -->
+
+## CLI 0.166.141 / complete source preview recovery
+
+Release candidate **0.166.141** preserves legitimate source spread expressions in complete file-read previews and keeps read-recovery guidance actionable. Launcher-owned hermetic evaluations use the same exact mutation scope through the CLI and IDE gateway; ordinary interactive permissions and the IDE protocol retain their existing behavior.
+
+The intended pairing is VS Code **0.37.177** and JetBrains **0.4.194**. Child npm versions are unchanged. Publication remains pending until this exact source passes every configured Linux, Windows and macOS CLI CI / CLI Strict Sandbox job, then GitHub Actions OIDC publishes and verifies the public npm archive. IDE publication follows verified CLI installation.
+
+After public availability is verified, install `npm i -g chainlesschain@0.166.141 --registry https://registry.npmjs.org`, restart the CLI and IDE hosts, and run `cc --version` and `cc doctor`.
+
+This release does not run additional model-task retests or rescore historical results. Volcengine historical coverage remains 36/45 with its original qualification limits; the latest complete round is 24/45. Sol original-project history is 41/45, the latest repaired-source four-case cohort is 2/4, and cross-version coverage is 45/45. Diagnostic future budgets remain finite; these are not automatic increases to ordinary user requests.
+
+<!-- release141-pairing:end -->
+
 <!-- release140-pairing:start -->
 
 ## CLI 0.166.140 / rejected tool argument recovery
 
-This package is CLI **0.166.140**, paired with Open VSX **0.37.176** and JetBrains **0.4.193**. Install `npm i -g chainlesschain@0.166.140 --registry https://registry.npmjs.org`, restart the CLI and IDE chat hosts, then check `cc --version` and `cc doctor`.
+As checked at **2026-11-03T11:42:31.329Z**, CLI **0.166.140** is verified public through [GitHub Actions OIDC](https://github.com/chainlesschain/chainlesschain/actions/runs/41610020835) from exact source `e2a91bf54332ff3d252c40ecc25c5887e0f0430d`. Public npm bytes, signed provenance, installation and startup have been verified. The same source passed every configured Linux, Windows and macOS CLI CI / CLI Strict Sandbox job.
 
-Malformed provider tool arguments are rejected before tool execution. A uniquely paired pre-execution rejection produces a model-only placeholder so the next turn can continue through strict self-evolution projection. Legacy run_code snapshot rejections can resume without replaying the rejected call; original durable history stays unchanged. Valid object arguments, duplicate-key rejection, nested JSON checks, redaction and decoding budgets retain their existing boundaries.
+Open VSX **0.37.176** is public, listed and downloadable; its VSIX matches the official build byte for byte. JetBrains **0.4.193** has been uploaded and awaits Marketplace review or public indexing; public availability has not been verified. The previously verified public JetBrains release remains **0.4.192**, whose recommendation is CLI **0.166.139**. Both new IDE versions recommend CLI **0.166.140**.
+
+[Publication and channel receipts](../../docs/research/cli/evidence/release140-public/publication-readback.json) · [Exact-source gates](../../docs/research/cli/evidence/release140-public/gates.json) · [CLI public readback](../../docs/research/cli/evidence/release140-public/cli.json) · [Open VSX readback](../../docs/research/cli/evidence/release140-public/open-vsx.json) · [JetBrains status](../../docs/research/cli/evidence/release140-public/jetbrains.json)
 
-Publication uses GitHub Actions OIDC after the exact release commit passes CLI CI and CLI Strict Sandbox on every configured Linux, Windows and macOS runner. IDE publication follows verified public CLI installation and its own exact-source host gates. JetBrains upload, Marketplace approval and public availability are reported separately.
+Install `npm i -g chainlesschain@0.166.140 --registry https://registry.npmjs.org`, restart the CLI and IDE chat hosts, then run `cc --version` and `cc doctor`.
+
+Malformed provider tool arguments are rejected before tool execution. A uniquely paired pre-execution rejection produces a model-only placeholder so the next turn can continue through strict self-evolution projection. Legacy run_code snapshot rejections can resume without replaying the rejected call; original durable history stays unchanged. Valid object arguments, duplicate-key rejection, nested JSON checks, redaction and decoding budgets retain their existing boundaries.
 
-The focused Windows checks passed 129 tests. Two bounded real Volcengine recovery scenarios passed through the installed runtime with five physical requests and 6,401 tokens; the first scenario explicitly injected the exact logged malformed argument into one inbound model response. These results cover this recovery defect and do not rescore historical model-task acceptance. SDK 0.2.17, Protocol 0.1.12, Kernel 0.1.11 and the other child packages retain their published versions. Microsoft Marketplace and the independent PC/mobile product release are outside this patch.
+Agent projection v10 also prevents genuine image and reasoning transport SHA-256 digests from being mistaken for phone numbers. Only authenticated protocol metadata uses the scan view; the original digest and byte-length restoration binding is unchanged. Real phone numbers, user-supplied digest-like text and forged markers retain their existing checks, and v1–v9 historical rules are preserved.
 
-[Focused live recovery evidence](../../docs/research/cli/evidence/tool-argument-recovery-20261103/live-volcengine.json).
+The focused Windows checks passed **129 tests**. The earlier v9 recovery check used **five real Volcengine requests and 6,401 tokens**; its first scenario explicitly injected the exact logged malformed argument into one inbound model response. [Original scoped evidence](../../docs/research/cli/evidence/tool-argument-recovery-20261103/live-volcengine.json). The separate v10 check passed both recovery scenarios with **five real Volcengine requests and 6,501 tokens**, with runtime source hashes matching this release. [Additional scoped evidence](../../docs/research/cli/evidence/tool-argument-recovery-20261103/live-volcengine-v10.json). The complete related projector/agent-model tests passed **393/393**. These runs remain separate and add no historical model-task acceptance.
 
-Agent projection v10 also prevents genuine image and reasoning transport SHA-256 digests from being mistaken for phone numbers. Only authenticated protocol metadata uses the scan view; the original digest and byte-length restoration binding is unchanged. Real phone numbers, user-supplied digest-like text and forged markers retain their existing checks, and v1-v9 historical rules are preserved.
+Earlier candidate `eb0fe7a8a1` failed at the Windows ArtifactStore post-index integrity guard, then passed a complete three-OS loopback rerun. The exact rejected condition remains unresolved; the guard stays enforced. The [original failure](../../docs/research/cli/evidence/tool-argument-recovery-20261103/windows-eb-trajectory-attempt1-failure.json) and [complete rerun](../../docs/research/cli/evidence/tool-argument-recovery-20261103/windows-eb-trajectory-attempt2-aggregate.json) retain their historical source scope. The final release source separately passed 100 loopback runs on each of three operating systems; these 300 structural-envelope-only runs are not paid-provider task acceptance or a replacement for CLI CI / Strict Sandbox. Local composition runs timed out on both the v10 source and the earlier baseline and are not counted as passing.
 
-The v10 candidate passed both recovery scenarios again with **five real Volcengine requests and 6,501 tokens**, using runtime source hashes matching this candidate. See the [additional live evidence](https://github.com/chainlesschain/chainlesschain/blob/main/docs/research/cli/evidence/tool-argument-recovery-20261103/live-volcengine-v10.json).
+Agent SDK **0.2.17**, Protocol **0.1.12**, Kernel **0.1.11** and the other child packages retain their published versions; required upstream packages were fetched and dependency alignment verified before CLI publication. Microsoft Marketplace remains deferred. PC/mobile **v5.0.3.144** is already public as an independent release; this CLI/IDE follow-up does not republish clients. Historical .138 **2/4**, .137 **0/5** and cumulative **41/45** retain separate scopes.
 
-Earlier candidate `eb0fe7a8a1` stopped at a Windows ArtifactStore post-index integrity guard, then passed a complete three-OS loopback rerun. The exact rejected condition remains unresolved, and the guard stays enforced. The [original failure](https://github.com/chainlesschain/chainlesschain/blob/main/docs/research/cli/evidence/tool-argument-recovery-20261103/windows-eb-trajectory-attempt1-failure.json) and [complete rerun](https://github.com/chainlesschain/chainlesschain/blob/main/docs/research/cli/evidence/tool-argument-recovery-20261103/windows-eb-trajectory-attempt2-aggregate.json) retain their historical source scope.
+Documentation reviewed against `main@d62866538c` on **2026-11-03**. The later read-recovery hint and Web Panel bundle fixes are outside the immutable CLI .140 release source. The .140 full 36+9 Volcengine campaign has no verified final score yet; the internal-output-limit adapter repair is tracked separately. Historical original-project **41/45**, .138 **2/4**, and Sol cross-revision coverage **45/45** (including repaired project sources) retain separate scopes. [Current design](../../docs/design/release-runtime-update-2026-11-03-140.md) · [Upgrade guide](https://docs.chainlesschain.com/chainlesschain/cli-ide-update-2026-11-03-140.html).
 
 <!-- release140-pairing:end -->
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chainlesschain",
-  "version": "0.166.140",
+  "version": "0.166.141",
   "description": "CLI for ChainlessChain - install, configure, and manage your personal AI management system",
   "type": "module",
   "bin": {

package/src/assets/linux-subreaper/linux-arm64/manifest.json

@@ -6,5 +6,5 @@
   "imageDigest": "sha256:6395a47a5bd9b038303e94a5e93754258c8480dab64635460f973eb93dc6f4d8",
   "bytes": 778808,
   "linkage": "static",
-  "commit": "e2a91bf54332ff3d252c40ecc25c5887e0f0430d"
+  "commit": "df9295e33ad04aec0aa74cab4dd242766d5556a4"
 }

package/src/assets/linux-subreaper/linux-x64/manifest.json

@@ -6,5 +6,5 @@
   "imageDigest": "sha256:f162e55ad3f3f72f8a52e9d7f12b5b8db44506c2ca66a14d7d62d5cd4f12498e",
   "bytes": 934160,
   "linkage": "static",
-  "commit": "e2a91bf54332ff3d252c40ecc25c5887e0f0430d"
+  "commit": "df9295e33ad04aec0aa74cab4dd242766d5556a4"
 }

package/src/data/changelog.json

@@ -1,6 +1,19 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.141",
+      "cliVersions": ["0.166.141"],
+      "date": "2026-11-04",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.141: preserve complete source previews and evaluation entry scope (2026-11-04)",
+          "body": "- Preserve legitimate bounded source spread expressions in host-created read previews instead of omitting valid code. Keep strict JSON, sensitive-data and source-identity checks enforced.\n- Keep focused read recovery instructions actionable and retain the existing shared author/review turn budget.\n- Bind launcher-owned hermetic evaluation file scope consistently at the shared CLI/IDE agent loop, preserving caller narrowing and empty/read-only tool sets. Ordinary interactive permissions and the IDE protocol retain their existing behavior.\n- Reject diagnostic broker construction under a formal budget before reading its options, while preserving the existing finite diagnostic limits.\n- Pair with Open VSX 0.37.177 and JetBrains 0.4.194 after verified CLI publication. Child npm packages are unchanged; require their public-byte reuse checks and the complete exact-source CLI CI / Strict Sandbox matrices.\n- Preserve the recorded Volcengine full-round results and OpenAI four-case results. Engineering checks and publication add no model-task acceptance; already tested samples are not retested."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.140",

package/src/lib/evolution/evolution-artifact-ports.js

@@ -3131,11 +3131,74 @@ export class EvolutionArtifactPorts {
       createdAtMs < core.issuedAtMs ||
       !storeRetentionIsAdmissible
     ) {
-      throw artifactError(
+      const error = artifactError(
         EVOLUTION_ARTIFACT_INTEGRITY_FAILED_CODE,
         "ArtifactStore index entry is not exactly admissible for this envelope",
         { artifactId: id },
       );
+      // Diagnostic branch only: observe the already-rejected guard without
+      // retaining any entry values or changing its decision or original error.
+      try {
+        if (process.env.CC_R140_STORAGE_DIAGNOSTIC) {
+          const failures = [
+            ["file", file !== `${id}.json` || path.basename(file) !== file],
+            [
+              "title",
+              ownData(entry, "title", "ArtifactStore index entry") !==
+                `Evolution ${core.type} artifact`,
+            ],
+            [
+              "kind",
+              ownData(entry, "kind", "ArtifactStore index entry") !== "data",
+            ],
+            [
+              "mime",
+              ownData(entry, "mime", "ArtifactStore index entry") !==
+                "application/json",
+            ],
+            [
+              "size",
+              !Number.isSafeInteger(size) ||
+                size < 1 ||
+                size > EVOLUTION_ARTIFACT_MAX_CANONICAL_BYTES,
+            ],
+            [
+              "hash",
+              ownData(entry, "sha256", "ArtifactStore index entry") !==
+                core.recordDigest.slice("sha256:".length),
+            ],
+            [
+              "sourcePath",
+              ownData(entry, "sourcePath", "ArtifactStore index entry") !==
+                null,
+            ],
+            [
+              "sessionId",
+              ownData(entry, "sessionId", "ArtifactStore index entry") !== null,
+            ],
+            [
+              "immutable",
+              ownData(entry, "immutable", "ArtifactStore index entry") !== true,
+            ],
+            [
+              "recordDigest",
+              ownData(entry, "recordDigest", "ArtifactStore index entry") !==
+                core.recordDigest,
+            ],
+            ["expiry-order", storeExpiresAtMs <= createdAtMs],
+            ["created-before-issued", createdAtMs < core.issuedAtMs],
+            ["retention", !storeRetentionIsAdmissible],
+          ]
+            .filter(([, failed]) => failed)
+            .map(([label]) => label);
+          Object.defineProperty(error, "r140IndexFailures", {
+            value: Object.freeze(failures),
+          });
+        }
+      } catch {
+        // Observation must never replace the original rejection.
+      }
+      throw error;
     }
     const lineage = this.#validateLineage(
       ownData(entry, "lineage", "ArtifactStore index entry"),

package/src/lib/read-file-loop-guard.js

@@ -26,6 +26,13 @@ function mergeSpan(spans, span) {
   return merged;
 }
 
+function rereadFingerprint(span, restoring) {
+  return (
+    (restoring ? "restore:" : "review:") +
+    createHash("sha256").update(JSON.stringify(span)).digest("hex")
+  );
+}
+
 /** Per-run read coverage and recovery, independent of compacted transcripts. */
 export class ReadFileLoopGuard {
   constructor() {
@@ -309,9 +316,7 @@ export class ReadFileLoopGuard {
         this.visiblePages !== null &&
         entry.lastReadRequest < this.visibleRequest &&
         !this.isPageVisible(page);
-      const fingerprint =
-        (restoring ? "restore:" : "review:") +
-        createHash("sha256").update(JSON.stringify(span)).digest("hex");
+      const fingerprint = rereadFingerprint(span, restoring);
       if (
         targeted &&
         !entry.rereads.has(fingerprint) &&
@@ -354,6 +359,40 @@ export class ReadFileLoopGuard {
               hint: "This range has a read pending in the current tool batch. Historical source coverage is recorded only after content reaches the model.",
             };
           }
+          const recoveryRead = {
+            path: filePath,
+            offset: explicitRange ? page.range.startLine : 1,
+            limit: 80,
+            ...(args.hashed === true ? { hashed: true } : {}),
+            ...(args.raw === true ? { raw: true } : {}),
+          };
+          const recoveryPage = readPage(recoveryRead);
+          const validRecoveryPage =
+            !recoveryPage.error &&
+            !!recoveryPage.readSpan &&
+            !recoveryPage.truncated;
+          const recoveryCovered =
+            validRecoveryPage &&
+            entry.spans.some(
+              ([start, end]) =>
+                start <= recoveryPage.readSpan.start &&
+                end >= recoveryPage.readSpan.end,
+            );
+          const recoveryRestoring =
+            validRecoveryPage &&
+            this.visiblePages !== null &&
+            entry.lastReadRequest < this.visibleRequest &&
+            !this.isPageVisible(recoveryPage);
+          // A recovery hint is a contract. Do not prescribe a read that this
+          // same guard would immediately omit again. This checks a pure page
+          // from the already-authorized file without minting a new allowance.
+          const canRecover =
+            validRecoveryPage &&
+            (!recoveryCovered ||
+              (entry.rereads.size < 3 &&
+                !entry.rereads.has(
+                  rereadFingerprint(recoveryPage.readSpan, recoveryRestoring),
+                )));
           return {
             path: filePath,
             fileVersion,
@@ -367,14 +406,10 @@ export class ReadFileLoopGuard {
             ...(entry.summary?.outline
               ? { outline: entry.summary.outline }
               : {}),
-            recoveryRead: {
-              path: filePath,
-              offset: explicitRange ? page.range.startLine : 1,
-              limit: 80,
-              ...(args.hashed === true ? { hashed: true } : {}),
-              ...(args.raw === true ? { raw: true } : {}),
-            },
-            hint: "This requested range was read earlier, but historical coverage does not mean its source is visible now. The runtime has not substituted an unrelated file range. Use source actually present in this request; recover missing details with a focused search or the bounded recoveryRead. Reading the file is not task completion.",
+            ...(canRecover ? { recoveryRead } : {}),
+            hint: canRecover
+              ? "This requested range was read earlier, but historical coverage does not mean its source is visible now. Recover missing details with a focused search or the bounded recoveryRead. Reading the file is not task completion."
+              : "This unchanged range cannot be reread within the remaining read allowance. Do not repeat it. Use source still visible in this request, or search_files for a precise symbol (set regex:true when using a regular expression). If required source is unavailable, report the limitation instead of guessing APIs.",
           };
         }
       }

package/src/lib/tool-result-preview.js

@@ -36,6 +36,7 @@ const PREVIEW_HINT =
 export function canProjectHostToolExcerpt(text, tool) {
   const scan = createEvidenceJsonTextBoundary((message) => new Error(message), {
     ...EVIDENCE_JSON_POLICY,
+    sourceExpressionPolicy: "bounded-source-tokens-v1",
     sourceLiteralPolicy: "explicit-source-containers-v1",
     maxSourceTokens: 32768,
   });

package/src/runtime/agent-core.js

@@ -7,6 +7,12 @@ import {
   requireUnscopedToolExecution,
 } from "../lib/formal-budget-provider-scope.js";
 import { isFormalBudgetError } from "../lib/formal-budget-errors.js";
+import {
+  FORMAL_QUALITY_ALLOWED_FILES_ENV,
+  FORMAL_QUALITY_FILE_TOOLS,
+  formalQualityAllowedFiles,
+  isFormalQualityHermeticRuntime,
+} from "../lib/formal-quality-eval-runtime.js";
 import { normalizeOllamaBaseUrl } from "../lib/ollama-base-url.js";
 import { ollamaProviderFetch } from "../lib/ollama-provider-fetch.js";
 import {
@@ -14987,7 +14993,59 @@ function permissionDecision(callId, tool, result) {
   });
 }
 
+function bindFormalQualityLoopOptions(options) {
+  // The launcher owns this binding. Apply it at the shared loop so direct
+  // gateway/IDE callers receive the same schema and execution guard as CLI.
+  // Legacy hermetic callers without a file binding retain their own boundary.
+  if (
+    !isFormalQualityHermeticRuntime(process.env) ||
+    !Object.hasOwn(process.env, FORMAL_QUALITY_ALLOWED_FILES_ENV)
+  ) {
+    return options;
+  }
+  const allowedPaths = formalQualityAllowedFiles(process.env);
+  const cwd = options.cwd || process.cwd();
+  const launcherScope = normalizeExactFileMutationScope(
+    { exact: true, worktreeRoot: canonicalRealpath(cwd), allowedPaths },
+    { cwd },
+  );
+  const callerScope = normalizeExactFileMutationScope(
+    options.fileMutationScope,
+    {
+      cwd,
+    },
+  );
+  if (
+    callerScope &&
+    callerScope.allowedPaths.some((file) => !allowedPaths.includes(file))
+  ) {
+    throw new Error("mutation scope widens the formal quality file binding");
+  }
+  if (
+    options.enabledToolNames != null &&
+    !Array.isArray(options.enabledToolNames)
+  ) {
+    throw new Error("formal quality enabled tool names must be an array");
+  }
+  return {
+    ...options,
+    fileMutationScope: callerScope || launcherScope,
+    hermeticExecution: true,
+    exactToolNames: true,
+    // Hermetic execution ignores host executors. Match that on the provider
+    // side too: a same-named host executor must not suppress the path enum
+    // for the built-in mutation tool that will actually execute.
+    externalToolExecutors: null,
+    enabledToolNames: Object.freeze(
+      (options.enabledToolNames ?? FORMAL_QUALITY_FILE_TOOLS).filter((name) =>
+        FORMAL_QUALITY_FILE_TOOLS.includes(name),
+      ),
+    ),
+  };
+}
+
 export async function* agentLoop(messages, options) {
+  options = bindFormalQualityLoopOptions(options);
   // Bind the actual task before compaction, runtime nudges or provider projection.
   // A new host-admitted user turn starts a new loop and receives its own binding.
   const currentUserTask = messages.findLast(