chainlesschain 0.166.47 → 0.166.56

package/src/commands/plugin.js

@@ -1445,12 +1445,24 @@ export function registerPluginCommand(program) {
       "--suite <file>",
       "Suite JSON inside the plugin root (default: evals/suite.json)",
     )
+    .option(
+      "--holdout <file>",
+      "Reviewer-owned holdout suite outside the plugin payload",
+    )
     .option("--provider <provider>", "Fixed provider for both eval arms")
     .option("--model <model>", "Fixed model for both eval arms")
     .option(
       "--min-pass-rate-delta <pct>",
       "Override the suite's minimum candidate gain in percentage points",
     )
+    .option(
+      "--samples <n>",
+      "Run each control/candidate task 1-20 times (default: suite or 1)",
+    )
+    .option(
+      "--arm-order <order>",
+      "balanced, control-first, or candidate-first (default: balanced)",
+    )
     .option("--json", "Output the bound report as JSON")
     .option("--html <file>", "Write a local HTML report")
     .option("--keep", "Keep per-task temporary workspaces")
@@ -1479,15 +1491,30 @@ export function registerPluginCommand(program) {
           }
           minPassRateDelta = percentage / 100;
         }
+        let sampleRuns;
+        if (options.samples !== undefined) {
+          sampleRuns = Number(options.samples);
+          if (
+            !Number.isSafeInteger(sampleRuns) ||
+            sampleRuns < 1 ||
+            sampleRuns > 20
+          ) {
+            throw new Error("--samples must be an integer between 1 and 20");
+          }
+        }
         const {
+          attachPluginEvalHoldout,
           loadPluginEvalDefinition,
           renderPluginEvalHtml,
           runPluginEval,
         } = await import("../lib/eval/plugin-suite.js");
         const { makeHeadlessRunAgent } = await import("./eval.js");
-        const definition = loadPluginEvalDefinition(dir, {
-          suiteFile: options.suite,
-        });
+        const definition = attachPluginEvalHoldout(
+          loadPluginEvalDefinition(dir, {
+            suiteFile: options.suite,
+          }),
+          options.holdout,
+        );
         const dryRunAgent = async () => ({
           ok: true,
           output: `${JSON.stringify({
@@ -1526,11 +1553,15 @@ export function registerPluginCommand(program) {
           dryRun: options.dryRun === true,
           keepWorkspaces: options.keep === true,
           ...(minPassRateDelta === undefined ? {} : { minPassRateDelta }),
+          ...(sampleRuns === undefined ? {} : { sampleRuns }),
+          ...(options.armOrder === undefined
+            ? {}
+            : { armOrder: options.armOrder }),
           onResult: options.json
             ? undefined
-            : ({ arm, result }) =>
+            : ({ arm, sample, result }) =>
                 logger.info(
-                  `  ${arm.padEnd(9)} ${result.pass ? "✔" : "✗"} ${result.id} (${result.ms}ms)`,
+                  `  ${arm.padEnd(9)} #${sample} ${result.pass ? "✔" : "✗"} ${result.id} (${result.ms}ms)`,
                 ),
         });
         if (options.html) {

package/src/data/changelog.json

@@ -1,6 +1,84 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.56",
+      "cliVersions": ["0.166.56"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.56: stabilize the OIDC release gates",
+          "body": "- Keep the root lockfile's CLI package version aligned with the publishable CLI\n  package so the cross-platform release contract remains valid.\n- Allow the REPL host's module-isolation failure test enough time on saturated\n  hosted runners without relaxing any failure-path assertion."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.54",
+      "cliVersions": ["0.166.54"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.54: canonicalize TEST deployment paths on macOS",
+          "body": "- Resolve generated credential directories and saved credential files to their\n  physical paths so macOS `/var` and `/private/var` aliases do not break TEST\n  deployment refresh or formal-certificate replacement.\n- Keep deployment profile path assertions portable while preserving real-path\n  verification before any private key is reused."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.53",
+      "cliVersions": ["0.166.53"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.53: one-click TEST deployment for governed Skill evolution",
+          "body": "- Add `cc evolution deployment init-test` to generate a local Ed25519 test key,\n  sign the deployment descriptor, and enable it through the normal descriptor\n  verification and profile write path, without OpenSSL or bypassing governance.\n- Add `cc evolution deployment replace-test` to rotate a test deployment into the\n  formal descriptor and trust root using a constrained root-rotation proof.\n- Keep `deploymentMode: test` and the red TEST badge visible in status and UI;\n  `init-test` refuses to overwrite an existing managed profile or to run while\n  `CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_*` environment overrides are present.\n- Surface the same one-click generate/refresh and replace flows in the VS Code\n  and JetBrains Configure Skill Evolution views and in `cc ui` settings."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.52",
+      "cliVersions": ["0.166.52"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.52: wait for authoritative release gates",
+          "body": "- Give the exact-SHA npm release gate enough time for the full Linux, Windows,\n  and macOS CLI matrix to finish when hosted runners are queued.\n- Prevent IDE release tags from scheduling a redundant CLI CI matrix for the\n  same commit, preserving runner capacity for the authoritative release gate."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.51",
+      "cliVersions": ["0.166.51"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.51: report the active model context accurately",
+          "body": "- Resolve the context window from the exact provider, endpoint, and explicit\n  override used for a request, so the planner, auto-compactor, session report,\n  REPL, and IDE panel share one capacity value.\n- Keep large-window conversations under a token budget rather than compacting\n  solely after 50 short messages; retain the count guard for smaller windows.\n- Carry the main model request's context window and cache counters through the\n  stream and session ledger, excluding sub-agent and compaction requests from\n  the primary context indicator.\n- Label transcript-derived context figures as estimates and retain cache-read\n  and cache-write usage in the completed chat status.\n- Keep semantic-compaction boundary fixtures explicit about their bounded\n  synthetic request window, so they continue to verify compaction settlement\n  rather than inheriting a provider default."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.48",
+      "cliVersions": ["0.166.48"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.48: make evaluation, recovery, and governed recall durable",
+          "body": "- Add repeated balanced sampling, confidence intervals, and reviewer-owned\n  holdout suites to `cc plugin eval` through `--samples`, `--arm-order`, and\n  `--holdout`.\n- Persist standalone Headless deferred questions across process restarts, with\n  binding checks and one-time answer consumption.\n- Add a file-identity-bound read-only index for paged background Agent status\n  queries, with authoritative full-scan fallback on cache misses or races.\n- Add host-supplied, revision/digest-bound semantic recall candidates while\n  preserving canonical lifecycle, scope, expiry, and sink enforcement.\n- Publish Context Memory Kernel `0.1.3` before the CLI so public installs\n  resolve the new governed semantic-recall contract."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.47",

package/src/gateways/ws/evolution-deployment-topic-handlers.js

@@ -3,6 +3,10 @@ import {
   getEvolutionDeploymentStatus,
   setEvolutionDeploymentEnabled,
 } from "../../lib/evolution/evolution-deployment-config.js";
+import {
+  initializeEvolutionTestDeployment,
+  replaceEvolutionTestDeployment,
+} from "../../lib/evolution/evolution-test-deployment.js";
 
 function assertSecureControl(context) {
   const server = context?.server;
@@ -30,6 +34,8 @@ export function createEvolutionDeploymentTopicHandlers(options = {}) {
   const getStatus = options.getStatus || getEvolutionDeploymentStatus;
   const configure = options.configure || configureEvolutionDeployment;
   const setEnabled = options.setEnabled || setEvolutionDeploymentEnabled;
+  const initTest = options.initTest || initializeEvolutionTestDeployment;
+  const replaceTest = options.replaceTest || replaceEvolutionTestDeployment;
   return {
     "evolution.deployment.status": async (_frame, context) => {
       assertSecureControl(context);
@@ -43,6 +49,20 @@ export function createEvolutionDeploymentTopicHandlers(options = {}) {
         enabled: true,
       });
     },
+    "evolution.deployment.init-test": async (frame, context) => {
+      assertSecureControl(context);
+      return initTest({
+        modulePath: requiredPath(frame?.modulePath, "modulePath"),
+        enabled: true,
+      });
+    },
+    "evolution.deployment.replace-test": async (frame, context) => {
+      assertSecureControl(context);
+      return replaceTest({
+        descriptorPath: requiredPath(frame?.descriptorPath, "descriptorPath"),
+        trustRootPath: requiredPath(frame?.trustRootPath, "trustRootPath"),
+      });
+    },
     "evolution.deployment.set-enabled": async (frame, context) => {
       assertSecureControl(context);
       if (typeof frame?.enabled !== "boolean")

package/src/generated/cc-agent-protocol.schema.json

@@ -24,7 +24,7 @@
     "contextMemory": {
       "schemaId": "https://chainlesschain.com/schemas/context-memory-kernel/v1",
       "schemaVersion": 1,
-      "sourceDigest": "sha256:9dabfbccf4315d511bb09d13decc743e1b43b90ad81eaa5da62df44ba55934cb",
+      "sourceDigest": "sha256:6599168b8fa9ace2d1697c44c2ac10141aa20bd7e9be29e9ea814ff032f87d68",
       "methods": {
         "context/plan": {
           "request": "ContextPlanRequest",
@@ -4808,6 +4808,13 @@
             "$ref": "#/$defs/ContextScopeAdmission"
           }
         },
+        "semanticCandidates": {
+          "type": "array",
+          "maxItems": 1000,
+          "items": {
+            "$ref": "#/$defs/MemorySemanticCandidate"
+          }
+        },
         "limit": {
           "type": "integer",
           "minimum": 1,
@@ -4854,6 +4861,15 @@
           "type": "integer",
           "minimum": 0
         },
+        "retrievalMode": {
+          "enum": [
+            "governed_hybrid"
+          ]
+        },
+        "semanticEvidenceCount": {
+          "type": "integer",
+          "minimum": 0
+        },
         "results": {
           "type": "array",
           "maxItems": 1000,
@@ -5768,6 +5784,33 @@
           "$ref": "#/$defs/MemoryRecallResult"
         }
       }
+    },
+    "MemorySemanticCandidate": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "memoryId",
+        "revision",
+        "recordDigest",
+        "score"
+      ],
+      "properties": {
+        "memoryId": {
+          "$ref": "#/$defs/ContextMemoryIdentifier"
+        },
+        "revision": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "recordDigest": {
+          "$ref": "#/$defs/ContextMemoryDigest"
+        },
+        "score": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        }
+      }
     }
   }
 }

package/src/harness/prompt-compressor.js

@@ -315,7 +315,11 @@ export class PromptCompressor {
       !options.maxMessages &&
       !options.maxTokens
     ) {
-      const ctxWindow = getContextWindow(options.model, options.provider);
+      const ctxWindow = getContextWindow(
+        options.model,
+        options.provider,
+        options,
+      );
       const adaptive = adaptiveThresholds(ctxWindow);
       this.maxMessages = adaptive.maxMessages;
       this.maxTokens = adaptive.maxTokens;
@@ -337,8 +341,8 @@ export class PromptCompressor {
     );
   }
 
-  adaptToModel(model, provider) {
-    const ctxWindow = getContextWindow(model, provider);
+  adaptToModel(model, provider, options = {}) {
+    const ctxWindow = getContextWindow(model, provider, options);
     const adaptive = adaptiveThresholds(ctxWindow);
     this.maxMessages = adaptive.maxMessages;
     this.maxTokens = adaptive.maxTokens;
@@ -483,8 +487,12 @@ export class PromptCompressor {
   }
 
   shouldAutoCompact(messages) {
+    // Large adaptive windows use token pressure, not an arbitrary 50-message
+    // trigger. Small local models and explicit fixed limits retain their
+    // count-based policy; maxMessages remains a compaction target in all modes.
     return (
-      messages.length > this.maxMessages ||
+      ((!this._adaptive || this._contextWindow < 128000) &&
+        messages.length > this.maxMessages) ||
       estimateMessagesTokens(messages) > this.maxTokens
     );
   }

package/src/lib/background-agent-list-index.js

@@ -0,0 +1,222 @@
+import {
+  chmodSync,
+  lstatSync,
+  openSync,
+  closeSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { createHash, randomBytes } from "node:crypto";
+import { join } from "node:path";
+
+export const BACKGROUND_AGENT_LIST_INDEX_SCHEMA =
+  "chainlesschain.background-agent-list-index/v1";
+export const BACKGROUND_AGENT_LIST_INDEX_FILE =
+  ".background-agent-list-index-v1";
+
+const STATE_FILE = /^(bg-[A-Za-z0-9-]+)\.json$/u;
+const MAX_INDEX_BYTES = 64 * 1024 * 1024;
+const MAX_INDEX_ENTRIES = 1_000_000;
+
+function sha256(value, domain) {
+  return `sha256:${createHash("sha256")
+    .update(domain)
+    .update("\0")
+    .update(value)
+    .digest("hex")}`;
+}
+
+function stateFileSignature(directory, name, id) {
+  const target = join(directory, name);
+  const link = lstatSync(target);
+  if (!link.isFile() || link.isSymbolicLink()) {
+    throw new TypeError(`background agent state is not a regular file: ${id}`);
+  }
+  const stat = statSync(target, { bigint: true });
+  return {
+    id,
+    name,
+    size: String(stat.size),
+    mtimeNs: String(stat.mtimeNs),
+    ctimeNs: String(stat.ctimeNs),
+    dev: String(stat.dev),
+    ino: String(stat.ino),
+  };
+}
+
+function collectInventory(directory) {
+  const files = readdirSync(directory, { withFileTypes: true })
+    .map((entry) => {
+      const match = STATE_FILE.exec(entry.name);
+      if (!match || entry.name.includes(".job.")) return null;
+      if (!entry.isFile()) {
+        throw new TypeError(
+          `background agent state is not a regular file: ${match[1]}`,
+        );
+      }
+      return stateFileSignature(directory, entry.name, match[1]);
+    })
+    .filter(Boolean)
+    .sort((left, right) => left.name.localeCompare(right.name, "en"));
+  if (files.length > MAX_INDEX_ENTRIES) {
+    throw new RangeError(
+      `background agent list index exceeds ${MAX_INDEX_ENTRIES} entries`,
+    );
+  }
+  const encoded = JSON.stringify(files);
+  return {
+    files,
+    digest: sha256(encoded, "cc.background-agent-list-inventory/v1"),
+  };
+}
+
+function normalizeEntry(value, inventoryIds) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  if (!inventoryIds.has(value.id)) return null;
+  const startedAt = Number(value.startedAt);
+  if (!Number.isFinite(startedAt) || startedAt < 0) return null;
+  if (
+    typeof value.status !== "string" ||
+    value.status.length === 0 ||
+    value.status.length > 64
+  ) {
+    return null;
+  }
+  return { id: value.id, startedAt, status: value.status };
+}
+
+function readCachedIndex(directory, inventory) {
+  const target = join(directory, BACKGROUND_AGENT_LIST_INDEX_FILE);
+  try {
+    const stat = lstatSync(target);
+    if (
+      !stat.isFile() ||
+      stat.isSymbolicLink() ||
+      stat.size <= 0 ||
+      stat.size > MAX_INDEX_BYTES
+    ) {
+      return null;
+    }
+    const parsed = JSON.parse(readFileSync(target, "utf8"));
+    if (
+      !parsed ||
+      typeof parsed !== "object" ||
+      Array.isArray(parsed) ||
+      parsed.schema !== BACKGROUND_AGENT_LIST_INDEX_SCHEMA ||
+      parsed.inventoryDigest !== inventory.digest ||
+      parsed.fileCount !== inventory.files.length ||
+      !Array.isArray(parsed.entries) ||
+      parsed.entries.length > inventory.files.length
+    ) {
+      return null;
+    }
+    const inventoryIds = new Set(inventory.files.map((file) => file.id));
+    const entries = parsed.entries.map((entry) =>
+      normalizeEntry(entry, inventoryIds),
+    );
+    if (entries.some((entry) => entry === null)) return null;
+    if (new Set(entries.map((entry) => entry.id)).size !== entries.length) {
+      return null;
+    }
+    const contentDigest = sha256(
+      JSON.stringify({
+        schema: parsed.schema,
+        inventoryDigest: parsed.inventoryDigest,
+        fileCount: parsed.fileCount,
+        entries,
+      }),
+      "cc.background-agent-list-index/v1",
+    );
+    if (parsed.digest !== contentDigest) return null;
+    return entries;
+  } catch {
+    return null;
+  }
+}
+
+function writeCachedIndex(directory, inventory, entries) {
+  const target = join(directory, BACKGROUND_AGENT_LIST_INDEX_FILE);
+  const value = {
+    schema: BACKGROUND_AGENT_LIST_INDEX_SCHEMA,
+    inventoryDigest: inventory.digest,
+    fileCount: inventory.files.length,
+    entries,
+  };
+  value.digest = sha256(
+    JSON.stringify(value),
+    "cc.background-agent-list-index/v1",
+  );
+  const temporary = `${target}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  try {
+    const descriptor = openSync(temporary, "wx", 0o600);
+    try {
+      writeFileSync(descriptor, `${JSON.stringify(value)}\n`, "utf8");
+    } finally {
+      closeSync(descriptor);
+    }
+    if (process.platform !== "win32") chmodSync(temporary, 0o600);
+    renameSync(temporary, target);
+  } catch {
+    rmSync(temporary, { force: true });
+  }
+}
+
+function projectState(state, id) {
+  if (!state || typeof state !== "object" || String(state.id) !== id) {
+    return null;
+  }
+  const startedAt = Number(state.startedAt || 0);
+  if (!Number.isFinite(startedAt) || startedAt < 0) return null;
+  if (
+    typeof state.status !== "string" ||
+    state.status.length === 0 ||
+    state.status.length > 64
+  ) {
+    return null;
+  }
+  return { id, startedAt, status: state.status };
+}
+
+/**
+ * Load a content-free projection when it exactly matches every authority-file
+ * identity. A miss rebuilds from authority and retries the inventory fence;
+ * callers must fall back to their authoritative scan if a concurrent writer
+ * prevents a stable rebuild.
+ */
+export function loadBackgroundAgentListIndex({ directory, readState }) {
+  if (typeof directory !== "string" || !directory) {
+    throw new TypeError("background agent list index directory is required");
+  }
+  if (typeof readState !== "function") {
+    throw new TypeError("background agent list index readState is required");
+  }
+  const inventory = collectInventory(directory);
+  const cached = readCachedIndex(directory, inventory);
+  if (cached) {
+    return Object.freeze({
+      source: "index",
+      entries: Object.freeze(cached.map((entry) => Object.freeze(entry))),
+    });
+  }
+
+  const entries = inventory.files
+    .map((file) => projectState(readState(file.id), file.id))
+    .filter(Boolean);
+  const verifiedInventory = collectInventory(directory);
+  if (verifiedInventory.digest !== inventory.digest) {
+    const error = new Error(
+      "background agent authority changed while rebuilding the list index",
+    );
+    error.code = "BACKGROUND_AGENT_LIST_INDEX_RACE";
+    throw error;
+  }
+  writeCachedIndex(directory, inventory, entries);
+  return Object.freeze({
+    source: "rebuilt",
+    entries: Object.freeze(entries.map((entry) => Object.freeze(entry))),
+  });
+}

package/src/lib/background-agent-supervisor.js

@@ -60,6 +60,7 @@ import {
   cleanupBackgroundAgentKeeperPipeDirectory,
   prepareBackgroundAgentKeeperPipePath,
 } from "./background-agent-keeper-protocol.js";
+import { loadBackgroundAgentListIndex } from "./background-agent-list-index.js";
 
 export const DEFAULT_HEARTBEAT_INTERVAL_MS = 5000;
 export const DEFAULT_HEARTBEAT_STALE_MS = 120000;
@@ -2181,6 +2182,43 @@ export function listBackgroundAgentsPage(options = {}) {
       "background agent page cursor does not match the requested filter",
     );
   }
+  let indexed = null;
+  try {
+    indexed = loadBackgroundAgentListIndex({
+      directory: backgroundAgentsDir(),
+      readState: readBackgroundAgentState,
+    });
+  } catch {
+    // The index is a disposable, content-free projection. Authority races,
+    // corruption, or an unwritable cache must retain the full-scan behavior.
+  }
+  if (indexed) {
+    const projected = [];
+    const summaries = [...indexed.entries]
+      .filter((state) => options.all || state.status === "running")
+      .sort(compareBackgroundAgentListEntries);
+    for (const summary of summaries) {
+      if (cursor && !isBackgroundAgentAfterCursor(summary, cursor)) continue;
+      const state = readBackgroundAgentState(summary.id);
+      if (!state) continue;
+      const effective = effectiveBackgroundAgentState(state, options);
+      if (!effective || (!options.all && effective.status !== "running")) {
+        continue;
+      }
+      if (cursor && !isBackgroundAgentAfterCursor(effective, cursor)) continue;
+      projected.push(withLifecycleState(effective));
+      if (projected.length > limit) break;
+    }
+    const sessions = projected.slice(0, limit);
+    const nextCursor =
+      projected.length > sessions.length
+        ? encodeBackgroundAgentPageCursor(sessions.at(-1), options.all)
+        : null;
+    return Object.freeze({
+      sessions: Object.freeze(sessions),
+      nextCursor,
+    });
+  }
   const eligible = cursor
     ? listBackgroundAgentEntries(options, { stableTieBreak: true }).filter(
         (state) => isBackgroundAgentAfterCursor(state, cursor),

package/src/lib/codex-app-server-adapter.js

@@ -6,6 +6,7 @@ export const CODEX_APP_SERVER_COMPATIBILITY_MATRIX = Object.freeze([
   Object.freeze({ version: "0.149.0" }),
   Object.freeze({ version: "0.150.0" }),
   Object.freeze({ version: "0.150.1" }),
+  Object.freeze({ version: "0.154.0" }),
 ]);
 
 function adapterError(code, message, details = {}) {