chainlesschain 0.166.26 → 0.166.28

package/src/commands/orchestrate.js

@@ -16,7 +16,9 @@ import fs from "fs";
 import path from "path";
 import { logger } from "../lib/logger.js";
 
-export function registerOrchestrateCommand(program) {
+export function registerOrchestrateCommand(program, dependencies = {}) {
+  const evolutionCompositionFactory =
+    dependencies.evolutionCompositionFactory ?? null;
   const cmd = program
     .command("orchestrate [task]")
     .description(
@@ -122,13 +124,13 @@ export function registerOrchestrateCommand(program) {
 
     // --watch mode
     if (options.watch) {
-      await _watchMode(cwd, options);
+      await _watchMode(cwd, options, evolutionCompositionFactory);
       return;
     }
 
     // --webhook mode: start HTTP server to receive commands from IM platforms
     if (options.webhook) {
-      await _webhookMode(cwd, options);
+      await _webhookMode(cwd, options, evolutionCompositionFactory);
       return;
     }
 
@@ -177,6 +179,7 @@ export function registerOrchestrateCommand(program) {
         ? { provider: options.provider, model: options.model }
         : {},
       verbose: options.verbose,
+      evolutionCompositionFactory,
     });
 
     if (options.json) {
@@ -520,7 +523,7 @@ async function _showStatus(cwd, options) {
 
 // ─── Webhook mode (receive commands from IM platforms) ─────────────
 
-async function _webhookMode(cwd, options) {
+async function _webhookMode(cwd, options, evolutionCompositionFactory = null) {
   const { createServer } = await import("http");
   const { parseDingTalkIncoming, parseFeishuIncoming, parseWeComIncoming } =
     await import("../lib/notifiers/index.js");
@@ -529,7 +532,11 @@ async function _webhookMode(cwd, options) {
 
   const port = parseInt(options.webhookPort, 10) || 18820;
 
-  const orch = new Orchestrator({ cwd, verbose: options.verbose });
+  const orch = new Orchestrator({
+    cwd,
+    verbose: options.verbose,
+    evolutionCompositionFactory,
+  });
   const secretEnvironmentName =
     options.webhookSecretEnv || "CC_ORCHESTRATE_WEBHOOK_SECRET";
   if (!/^[A-Z_][A-Z0-9_]{0,127}$/u.test(secretEnvironmentName)) {
@@ -738,11 +745,15 @@ async function _webhookMode(cwd, options) {
 
 // ─── Watch mode ──────────────────────────────────────────────────
 
-async function _watchMode(cwd, options) {
+async function _watchMode(cwd, options, evolutionCompositionFactory = null) {
   const { Orchestrator } = await import("../lib/orchestrator.js");
   const intervalMs = parseInt(options.interval, 10) * 60_000 || 600_000;
 
-  const orch = new Orchestrator({ cwd, verbose: options.verbose });
+  const orch = new Orchestrator({
+    cwd,
+    verbose: options.verbose,
+    evolutionCompositionFactory,
+  });
   orch.startCronWatch(intervalMs);
 
   orch.on("cron:tick", ({ at }) => {

package/src/data/changelog.json

@@ -1,6 +1,19 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.28",
+      "cliVersions": ["0.166.26", "0.166.28"],
+      "date": "2026-09-06",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.28: reduce repeated long-document output",
+          "body": "> `chainlesschain` **0.166.26 -> 0.166.28** (2026-09-06; incorporates the\n> unpublished 0.166.27 candidate), paired with\n> VS Code **0.37.85** and JetBrains **0.4.112**.\n\n- Direct task-count/status questions to current summary sections and local\n  aggregation, returning relevant rows, totals and source line numbers.\n- Budget script output after JSON escaping and explicitly report truncation\n  with guidance to retrieve missing sections instead of printing the file again.\n- Reference identical large command output while the original remains visible;\n  restore content after compaction. Every authorized command still executes.\n- Detect repeated large code/shell dumps across compaction and tool changes,\n  retaining recovery guidance and the incomplete-task backstop.\n- Validate with 80 focused regression tests; publication requires successful\n  CLI CI and CLI Strict Sandbox matrices for the exact release commit.\n- Regenerate the bundled changelog index so its entries match the canonical\n  release notes and package version before CI tests and packaging."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.26",

package/src/gateways/ws/action-protocol.js

@@ -54,6 +54,7 @@ export async function handleCoworkTask(server, id, ws, message) {
       files,
       cwd: server.projectRoot || process.cwd(),
       llmOptions: {},
+      evolutionCompositionFactory: server.evolutionCompositionFactory ?? null,
       signal: ac.signal,
       ...(message.mcpSessionId ? { mcpSessionId: message.mcpSessionId } : {}),
       ...(useParallel
@@ -247,6 +248,7 @@ export async function handleOrchestrate(server, id, ws, message) {
       maxParallel: Math.min(parseInt(agents, 10) || 3, 10),
       ciCommand: ci,
       agents: strategy ? { strategy } : undefined,
+      evolutionCompositionFactory: server.evolutionCompositionFactory ?? null,
       verbose: false,
     });
 

package/src/lib/agent-router.js

@@ -32,6 +32,8 @@ import {
   detectCodex,
 } from "./claude-code-bridge.js";
 import { createChatFn } from "./cowork-adapter.js";
+import { captureAgentEvolutionIngress } from "./evolution/agent-evolution-ingress.js";
+import { isTerminalModelFailure } from "./model-failure-policy.js";
 import runtimeClaimsContract from "@chainlesschain/session-core/runtime-claims";
 
 const { RUNTIME_MODE, createRuntimeClaims } = runtimeClaimsContract;
@@ -78,6 +80,8 @@ const TYPE_KEYWORDS = {
 
 export const AGENT_ROUTER_ERROR = Object.freeze({
   WRITE_ISOLATION_REQUIRED: "AGENT_ROUTER_WRITE_ISOLATION_REQUIRED",
+  EXTERNAL_MODEL_INGRESS_UNATTESTED:
+    "AGENT_ROUTER_EXTERNAL_MODEL_INGRESS_UNATTESTED",
 });
 
 function normalizedScopes(task) {
@@ -122,9 +126,23 @@ function detectTaskType(description) {
  * through ChainlessChain's existing llm-providers infrastructure.
  */
 async function executeViaAPI(task, options) {
-  const { provider, model, apiKey, baseUrl, cwd, timeout = 120_000 } = options;
-
-  const chat = createChatFn({ provider, model, apiKey, baseUrl });
+  const {
+    provider,
+    model,
+    apiKey,
+    baseUrl,
+    cwd,
+    timeout = 120_000,
+    evolutionIngress = null,
+  } = options;
+
+  const chat = createChatFn({
+    provider,
+    model,
+    apiKey,
+    baseUrl,
+    ...(evolutionIngress === null ? {} : { evolutionIngress }),
+  });
 
   const systemPrompt =
     "You are an expert software engineer. Implement the requested changes precisely. " +
@@ -132,10 +150,14 @@ async function executeViaAPI(task, options) {
     `Working directory: ${cwd}`;
 
   const startTime = Date.now();
+  let timeoutHandle;
   try {
-    const timeoutPromise = new Promise((_, reject) =>
-      setTimeout(() => reject(new Error("LLM API timeout")), timeout),
-    );
+    const timeoutPromise = new Promise((_, reject) => {
+      timeoutHandle = setTimeout(
+        () => reject(new Error("LLM API timeout")),
+        timeout,
+      );
+    });
     const output = await Promise.race([
       chat(
         [
@@ -163,6 +185,7 @@ async function executeViaAPI(task, options) {
       terminalEvidence: [],
     };
   } catch (err) {
+    if (isTerminalModelFailure(err)) throw err;
     return {
       success: false,
       status: "failed",
@@ -174,6 +197,8 @@ async function executeViaAPI(task, options) {
       runtimeClaims: SIMULATED_API_CLAIMS,
       terminalEvidence: [],
     };
+  } finally {
+    clearTimeout(timeoutHandle);
   }
 }
 
@@ -232,63 +257,102 @@ export class AgentRouter extends EventEmitter {
    */
   async dispatch(subtasks, options = {}) {
     const { cwd = process.cwd() } = options;
+    const evolutionIngress =
+      options.evolutionIngress == null
+        ? null
+        : captureAgentEvolutionIngress(options.evolutionIngress);
+    const backends =
+      evolutionIngress === null
+        ? this._backends
+        : this._backends.filter((backend) => !backend.isCLI);
 
     if (this._backends.length === 0) {
       throw new Error(
         "No agent backends available. Install Claude Code: npm i -g @anthropic-ai/claude-code",
       );
     }
+    if (backends.length === 0) {
+      const error = new Error(
+        "No backend can attest per-request evolution ingress; external agent CLIs are opaque",
+      );
+      error.code = AGENT_ROUTER_ERROR.EXTERNAL_MODEL_INGRESS_UNATTESTED;
+      throw error;
+    }
 
     switch (this.strategy) {
       case "parallel-all":
-        return this._dispatchParallelAll(subtasks, { cwd });
+        return this._dispatchParallelAll(subtasks, {
+          cwd,
+          evolutionIngress,
+          backends,
+        });
       case "by-type":
-        return this._dispatchByType(subtasks, { cwd });
+        return this._dispatchByType(subtasks, {
+          cwd,
+          evolutionIngress,
+          backends,
+        });
       case "primary":
-        return this._dispatchPrimary(subtasks, { cwd });
+        return this._dispatchPrimary(subtasks, {
+          cwd,
+          evolutionIngress,
+          backends,
+        });
       default: // round-robin
-        return this._dispatchRoundRobin(subtasks, { cwd });
+        return this._dispatchRoundRobin(subtasks, {
+          cwd,
+          evolutionIngress,
+          backends,
+        });
     }
   }
 
   // ─── Strategies ────────────────────────────────────────────────
 
   /** Round-robin: distribute tasks evenly across all backends. */
-  async _dispatchRoundRobin(subtasks, { cwd }) {
+  async _dispatchRoundRobin(subtasks, { cwd, evolutionIngress, backends }) {
     // Assign each subtask a backend
     const assignments = subtasks.map((task) => {
-      const backend = this._weightedNext();
+      const backend = this._weightedNext(backends);
       return { task, backend };
     });
 
-    return this._runAssignments(assignments, { cwd });
+    return this._runAssignments(assignments, { cwd, evolutionIngress });
   }
 
   /** By-type: route task to the best backend for its type. */
-  async _dispatchByType(subtasks, { cwd }) {
+  async _dispatchByType(subtasks, { cwd, evolutionIngress, backends }) {
     const assignments = subtasks.map((task) => {
       const taskType = task.type || detectTaskType(task.description);
       const preferredType = TASK_TYPE_ROUTING[taskType];
-      const backend = this._findBackend(preferredType) || this._weightedNext();
+      const backend =
+        this._findBackend(preferredType, backends) ||
+        this._weightedNext(backends);
       return { task, backend };
     });
 
-    return this._runAssignments(assignments, { cwd });
+    return this._runAssignments(assignments, { cwd, evolutionIngress });
   }
 
   /** Primary: all tasks go to first backend; fallback on failure. */
-  async _dispatchPrimary(subtasks, { cwd }) {
-    const primary = this._backends[0];
+  async _dispatchPrimary(subtasks, { cwd, evolutionIngress, backends }) {
+    const primary = backends[0];
     const assignments = subtasks.map((task) => ({ task, backend: primary }));
-    const results = await this._runAssignments(assignments, { cwd });
+    const results = await this._runAssignments(assignments, {
+      cwd,
+      evolutionIngress,
+    });
 
     // Retry failed tasks on next available backend
     const retries = [];
     for (let i = 0; i < results.length; i++) {
-      if (!results[i].success && this._backends.length > 1) {
-        const fallback = this._backends[1];
+      if (!results[i].success && backends.length > 1) {
+        const fallback = backends[1];
         retries.push(
-          this._runSingleTask(subtasks[i], fallback, { cwd }).then((r) => {
+          this._runSingleTask(subtasks[i], fallback, {
+            cwd,
+            evolutionIngress,
+          }).then((r) => {
             results[i] = r;
           }),
         );
@@ -299,8 +363,8 @@ export class AgentRouter extends EventEmitter {
   }
 
   /** Parallel-all: run every task on ALL backends; return best result per task. */
-  async _dispatchParallelAll(subtasks, { cwd }) {
-    if (this._backends.length > 1) {
+  async _dispatchParallelAll(subtasks, { cwd, evolutionIngress, backends }) {
+    if (backends.length > 1) {
       const error = new Error(
         "parallel-all requires per-attempt worktrees and accepted-winner merge",
       );
@@ -310,8 +374,8 @@ export class AgentRouter extends EventEmitter {
     const results = [];
     for (const task of subtasks) {
       const allResults = await Promise.all(
-        this._backends.map((backend) =>
-          this._runSingleTask(task, backend, { cwd }),
+        backends.map((backend) =>
+          this._runSingleTask(task, backend, { cwd, evolutionIngress }),
         ),
       );
       // Pick the first successful result; if all fail, pick the first
@@ -324,7 +388,7 @@ export class AgentRouter extends EventEmitter {
 
   // ─── Execution ─────────────────────────────────────────────────
 
-  async _runAssignments(assignments, { cwd }) {
+  async _runAssignments(assignments, { cwd, evolutionIngress }) {
     const results = new Array(assignments.length);
     const concurrency = assignmentsHaveDisjointWrites(assignments)
       ? this.maxParallel
@@ -337,7 +401,7 @@ export class AgentRouter extends EventEmitter {
       const batch = assignments.slice(i, i + concurrency);
       const batchResults = await Promise.all(
         batch.map(({ task, backend }) =>
-          this._runSingleTask(task, backend, { cwd }),
+          this._runSingleTask(task, backend, { cwd, evolutionIngress }),
         ),
       );
       for (let j = 0; j < batchResults.length; j++) {
@@ -348,12 +412,27 @@ export class AgentRouter extends EventEmitter {
     return results;
   }
 
-  async _runSingleTask(task, backend, { cwd }) {
+  async _runSingleTask(task, backend, { cwd, evolutionIngress }) {
     this.emit("agent:start", { taskId: task.id, backend: backend.type });
 
     let result;
     if (backend.isCLI) {
-      // Use ClaudeCodePool for CLI-based backends
+      // Claude/Codex own every provider call made inside their subprocess. A
+      // projected initial prompt cannot prove that later compaction, retry,
+      // tool, or model calls crossed this Run's durable ingress. Until an
+      // authenticated child protocol can bind every such call and return
+      // evidence, admitting the black box would create an unobservable model
+      // bypass. Keep unmanaged legacy dispatch available, but fail closed for
+      // governed evolution Runs before the process can be spawned.
+      if (evolutionIngress !== null) {
+        const error = new Error(
+          `External ${backend.type} CLI does not attest per-request evolution ingress`,
+        );
+        error.code = AGENT_ROUTER_ERROR.EXTERNAL_MODEL_INGRESS_UNATTESTED;
+        throw error;
+      }
+
+      // Use ClaudeCodePool for unmanaged CLI-based backends.
       const pool = backend._pool;
       const [r] = await pool.dispatch([task], { cwd });
       result = r;
@@ -366,6 +445,7 @@ export class AgentRouter extends EventEmitter {
         baseUrl: backend.baseUrl,
         cwd,
         timeout: backend.timeout,
+        evolutionIngress,
       });
     }
 
@@ -421,18 +501,18 @@ export class AgentRouter extends EventEmitter {
   }
 
   /** Find the first backend matching a given type. */
-  _findBackend(type) {
-    return this._backends.find((b) => b.type === type) || null;
+  _findBackend(type, backends = this._backends) {
+    return backends.find((b) => b.type === type) || null;
   }
 
   /** Pick next backend using weighted round-robin. */
-  _weightedNext() {
-    if (this._backends.length === 0) throw new Error("No backends");
-    if (this._backends.length === 1) return this._backends[0];
+  _weightedNext(backends = this._backends) {
+    if (backends.length === 0) throw new Error("No backends");
+    if (backends.length === 1) return backends[0];
 
     // Build weighted list
     const weighted = [];
-    for (const b of this._backends) {
+    for (const b of backends) {
       for (let i = 0; i < (b.weight || 1); i++) weighted.push(b);
     }
 

package/src/lib/cowork-task-runner.js

@@ -11,6 +11,7 @@ import { randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, appendFileSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { SubAgentContext } from "./sub-agent-context.js";
+import { captureAgentEvolutionRuntimeComposition } from "./evolution/agent-evolution-runtime-composition-brand.js";
 import { getTemplate, setUserTemplates } from "./cowork-task-templates.js";
 import { mountTemplateMcpTools } from "./cowork-mcp-tools.js";
 import { listUserTemplates } from "./cowork-template-marketplace.js";
@@ -553,6 +554,7 @@ export async function runCoworkTask(options = {}) {
     onToolCallBoundary = null,
     onToolCallSettlement = null,
     approveMcpLocalCodeExecution = null,
+    evolutionCompositionFactory = null,
   } = options;
 
   if (!userMessage || typeof userMessage !== "string") {
@@ -604,6 +606,58 @@ export async function runCoworkTask(options = {}) {
 
   let task = taskParts.join("\n");
 
+  // The governed task identity exists before any local MCP server can start.
+  // A child context gets its own identity only after task admission succeeds.
+  const admittedTaskId =
+    evolutionCompositionFactory === null ? null : `cowork-${randomUUID()}`;
+  let ingress = null;
+  if (admittedTaskId !== null) {
+    try {
+      const composition = captureAgentEvolutionRuntimeComposition(
+        await evolutionCompositionFactory(
+          Object.freeze({
+            mode: "cowork-sequential",
+            runId: admittedTaskId,
+            taskId: admittedTaskId,
+            cwd,
+          }),
+        ),
+      );
+      ingress = composition.evolutionIngress;
+      if (
+        composition.runId !== admittedTaskId ||
+        ingress.runId !== admittedTaskId ||
+        composition.tenantId !== ingress.tenantId
+      ) {
+        throw new Error(
+          "Cowork evolution composition is not bound to the requested Run",
+        );
+      }
+      await ingress.start();
+      await ingress.ingestUserPrompt({
+        content: userMessage,
+        source: "cowork-sequential",
+      });
+    } catch (error) {
+      if (workflowEffectId) throw error;
+      const entry = {
+        taskId: admittedTaskId,
+        status: "failed",
+        templateId: template.id,
+        templateName: template.name,
+        result: {
+          summary: `Task failed: ${error.message}`,
+          artifacts: [],
+          tokenCount: 0,
+          toolsUsed: [],
+          iterationCount: 0,
+        },
+      };
+      _appendHistory(cwd, entry, userMessage);
+      return entry;
+    }
+  }
+
   // Mount template-declared MCP servers (best-effort, failures are tolerated)
   const mcp = await mountTemplateMcpTools(template, {
     workspaceRoot: cwd,
@@ -660,7 +714,7 @@ export async function runCoworkTask(options = {}) {
       ...(mcpRuntime.ledger ? { mcpCallLedger: mcpRuntime.ledger } : {}),
     });
 
-    const taskId = subAgent.id;
+    const taskId = admittedTaskId ?? subAgent.id;
 
     if (mcpRuntime.sessionId && mcpRuntime.bindingAllowed) {
       const mapped = await _deps.appendSessionEventIfHead(
@@ -707,10 +761,17 @@ export async function runCoworkTask(options = {}) {
 
     // Run the agent with the user's message
     try {
+      if (ingress !== null) {
+        loopOptions.evolutionIngress = ingress;
+      }
       const result = await subAgent.run(userMessage, loopOptions);
+      const status = result?.incomplete === true ? "failed" : subAgent.status;
+      if (ingress !== null && status === "completed") {
+        await ingress.complete();
+      }
       const entry = {
         taskId,
-        status: subAgent.status,
+        status,
         templateId: template.id,
         templateName: template.name,
         ...(mcpRuntime.sessionId ? { mcpSessionId: mcpRuntime.sessionId } : {}),
@@ -810,6 +871,7 @@ export async function runCoworkTaskParallel(options = {}) {
     const orch = new Orchestrator({
       cwd,
       maxParallel: Math.min(parseInt(agents, 10) || 3, 10),
+      evolutionCompositionFactory: options.evolutionCompositionFactory ?? null,
       ciCommand: "echo ok",
       agents: strategy ? { strategy } : undefined,
       verbose: false,
@@ -925,6 +987,8 @@ export async function runCoworkTaskParallel(options = {}) {
  * @returns {Promise<{ taskId, status, result }>}
  */
 export async function runCoworkDebate(options = {}) {
+  const evolutionCompositionFactory =
+    options.evolutionCompositionFactory ?? null;
   const {
     templateId = "code-review",
     userMessage,
@@ -975,21 +1039,60 @@ export async function runCoworkDebate(options = {}) {
     code = userMessage;
   }
 
-  const taskId = `cowork-debate-${Date.now()}`;
+  const taskId = `cowork-debate-${randomUUID()}`;
 
   if (onProgress) {
     onProgress({ type: "debate-started", perspectives: reviewPerspectives });
   }
 
   try {
+    let ingress = null;
+    if (evolutionCompositionFactory !== null) {
+      const composition = captureAgentEvolutionRuntimeComposition(
+        await evolutionCompositionFactory(
+          Object.freeze({
+            mode: "cowork-debate",
+            runId: taskId,
+            taskId,
+            cwd,
+          }),
+        ),
+      );
+      ingress = composition.evolutionIngress;
+      if (
+        composition.runId !== taskId ||
+        ingress.runId !== taskId ||
+        composition.tenantId !== ingress.tenantId
+      ) {
+        throw new Error(
+          "Cowork debate evolution composition is not bound to the requested Run",
+        );
+      }
+      await ingress.start();
+      await ingress.ingestUserPrompt({
+        content: userMessage,
+        source: "cowork-debate",
+      });
+    }
     const { startDebate } = await import("./cowork/debate-review-cli.js");
     const debateResult = await startDebate({
       target: userMessage,
       code,
       perspectives: reviewPerspectives,
-      llmOptions,
+      llmOptions:
+        ingress === null
+          ? llmOptions
+          : { ...llmOptions, evolutionIngress: ingress },
     });
 
+    if (ingress !== null) {
+      await ingress.ingestAgentEvent({
+        type: "response-complete",
+        content: debateResult.summary,
+      });
+      await ingress.complete();
+    }
+
     if (onProgress) {
       onProgress({ type: "debate-completed", verdict: debateResult.verdict });
     }