chainlesschain 0.166.48 → 0.166.56

package/src/data/changelog.json

@@ -1,6 +1,71 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.56",
+      "cliVersions": ["0.166.56"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.56: stabilize the OIDC release gates",
+          "body": "- Keep the root lockfile's CLI package version aligned with the publishable CLI\n  package so the cross-platform release contract remains valid.\n- Allow the REPL host's module-isolation failure test enough time on saturated\n  hosted runners without relaxing any failure-path assertion."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.54",
+      "cliVersions": ["0.166.54"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.54: canonicalize TEST deployment paths on macOS",
+          "body": "- Resolve generated credential directories and saved credential files to their\n  physical paths so macOS `/var` and `/private/var` aliases do not break TEST\n  deployment refresh or formal-certificate replacement.\n- Keep deployment profile path assertions portable while preserving real-path\n  verification before any private key is reused."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.53",
+      "cliVersions": ["0.166.53"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.53: one-click TEST deployment for governed Skill evolution",
+          "body": "- Add `cc evolution deployment init-test` to generate a local Ed25519 test key,\n  sign the deployment descriptor, and enable it through the normal descriptor\n  verification and profile write path, without OpenSSL or bypassing governance.\n- Add `cc evolution deployment replace-test` to rotate a test deployment into the\n  formal descriptor and trust root using a constrained root-rotation proof.\n- Keep `deploymentMode: test` and the red TEST badge visible in status and UI;\n  `init-test` refuses to overwrite an existing managed profile or to run while\n  `CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_*` environment overrides are present.\n- Surface the same one-click generate/refresh and replace flows in the VS Code\n  and JetBrains Configure Skill Evolution views and in `cc ui` settings."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.52",
+      "cliVersions": ["0.166.52"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.52: wait for authoritative release gates",
+          "body": "- Give the exact-SHA npm release gate enough time for the full Linux, Windows,\n  and macOS CLI matrix to finish when hosted runners are queued.\n- Prevent IDE release tags from scheduling a redundant CLI CI matrix for the\n  same commit, preserving runner capacity for the authoritative release gate."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.51",
+      "cliVersions": ["0.166.51"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.51: report the active model context accurately",
+          "body": "- Resolve the context window from the exact provider, endpoint, and explicit\n  override used for a request, so the planner, auto-compactor, session report,\n  REPL, and IDE panel share one capacity value.\n- Keep large-window conversations under a token budget rather than compacting\n  solely after 50 short messages; retain the count guard for smaller windows.\n- Carry the main model request's context window and cache counters through the\n  stream and session ledger, excluding sub-agent and compaction requests from\n  the primary context indicator.\n- Label transcript-derived context figures as estimates and retain cache-read\n  and cache-write usage in the completed chat status.\n- Keep semantic-compaction boundary fixtures explicit about their bounded\n  synthetic request window, so they continue to verify compaction settlement\n  rather than inheriting a provider default."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.48",

package/src/gateways/ws/evolution-deployment-topic-handlers.js

@@ -3,6 +3,10 @@ import {
   getEvolutionDeploymentStatus,
   setEvolutionDeploymentEnabled,
 } from "../../lib/evolution/evolution-deployment-config.js";
+import {
+  initializeEvolutionTestDeployment,
+  replaceEvolutionTestDeployment,
+} from "../../lib/evolution/evolution-test-deployment.js";
 
 function assertSecureControl(context) {
   const server = context?.server;
@@ -30,6 +34,8 @@ export function createEvolutionDeploymentTopicHandlers(options = {}) {
   const getStatus = options.getStatus || getEvolutionDeploymentStatus;
   const configure = options.configure || configureEvolutionDeployment;
   const setEnabled = options.setEnabled || setEvolutionDeploymentEnabled;
+  const initTest = options.initTest || initializeEvolutionTestDeployment;
+  const replaceTest = options.replaceTest || replaceEvolutionTestDeployment;
   return {
     "evolution.deployment.status": async (_frame, context) => {
       assertSecureControl(context);
@@ -43,6 +49,20 @@ export function createEvolutionDeploymentTopicHandlers(options = {}) {
         enabled: true,
       });
     },
+    "evolution.deployment.init-test": async (frame, context) => {
+      assertSecureControl(context);
+      return initTest({
+        modulePath: requiredPath(frame?.modulePath, "modulePath"),
+        enabled: true,
+      });
+    },
+    "evolution.deployment.replace-test": async (frame, context) => {
+      assertSecureControl(context);
+      return replaceTest({
+        descriptorPath: requiredPath(frame?.descriptorPath, "descriptorPath"),
+        trustRootPath: requiredPath(frame?.trustRootPath, "trustRootPath"),
+      });
+    },
     "evolution.deployment.set-enabled": async (frame, context) => {
       assertSecureControl(context);
       if (typeof frame?.enabled !== "boolean")

package/src/harness/prompt-compressor.js

@@ -315,7 +315,11 @@ export class PromptCompressor {
       !options.maxMessages &&
       !options.maxTokens
     ) {
-      const ctxWindow = getContextWindow(options.model, options.provider);
+      const ctxWindow = getContextWindow(
+        options.model,
+        options.provider,
+        options,
+      );
       const adaptive = adaptiveThresholds(ctxWindow);
       this.maxMessages = adaptive.maxMessages;
       this.maxTokens = adaptive.maxTokens;
@@ -337,8 +341,8 @@ export class PromptCompressor {
     );
   }
 
-  adaptToModel(model, provider) {
-    const ctxWindow = getContextWindow(model, provider);
+  adaptToModel(model, provider, options = {}) {
+    const ctxWindow = getContextWindow(model, provider, options);
     const adaptive = adaptiveThresholds(ctxWindow);
     this.maxMessages = adaptive.maxMessages;
     this.maxTokens = adaptive.maxTokens;
@@ -483,8 +487,12 @@ export class PromptCompressor {
   }
 
   shouldAutoCompact(messages) {
+    // Large adaptive windows use token pressure, not an arbitrary 50-message
+    // trigger. Small local models and explicit fixed limits retain their
+    // count-based policy; maxMessages remains a compaction target in all modes.
     return (
-      messages.length > this.maxMessages ||
+      ((!this._adaptive || this._contextWindow < 128000) &&
+        messages.length > this.maxMessages) ||
       estimateMessagesTokens(messages) > this.maxTokens
     );
   }

package/src/lib/evolution/evolution-deployment-config.js

@@ -80,7 +80,7 @@ export function assessEvolutionDeploymentReadiness(
         : "no enabled signed Evolution deployment",
       disabled
         ? "review the saved signed deployment, then run cc evolution deployment enable"
-        : "configure a signed descriptor and trust root with cc evolution deployment configure --descriptor <path> --trust-root <path>",
+        : "before production, run cc evolution deployment init-test --module <absolute-path>; otherwise configure a signed descriptor and trust root",
     );
   }
   if (missingCommands.length > 0) {
@@ -126,6 +126,10 @@ export async function getEvolutionDeploymentStatus(options = {}) {
     fromEnvironment || (saved.profile?.enabled ? saved.profile : null);
   const base = {
     source,
+    deploymentMode:
+      source === "environment"
+        ? "external"
+        : saved.profile?.deploymentMode || "none",
     effectiveEnabled: source !== "none",
     profileEnabled: saved.profile?.enabled === true,
     profilePath: saved.filePath,
@@ -183,6 +187,8 @@ export async function configureEvolutionDeployment(
     rootRotationPath = null,
     revocationPath = null,
     enabled = true,
+    deploymentMode,
+    testPrivateKeyPath,
   },
   options = {},
 ) {
@@ -239,6 +245,11 @@ export async function configureEvolutionDeployment(
         verified.descriptor.revision,
       ),
     };
+    const preserveTestMode =
+      deploymentMode === undefined &&
+      current?.deploymentMode === "test" &&
+      current.descriptorPath === verified.descriptorPath &&
+      current.trustRootPath === verified.trustRootPath;
     return {
       enabled: enabled === true,
       descriptorPath: verified.descriptorPath,
@@ -246,6 +257,10 @@ export async function configureEvolutionDeployment(
       revisionFloors,
       activeTrustRootDigest: verified.descriptor.trustRootDigest,
       revokedDescriptorRevisions,
+      deploymentMode: preserveTestMode ? "test" : deploymentMode || "managed",
+      testPrivateKeyPath: preserveTestMode
+        ? current.testPrivateKeyPath
+        : testPrivateKeyPath || null,
     };
   }, options);
   return getEvolutionDeploymentStatus(options);

package/src/lib/evolution/evolution-deployment-profile.js

@@ -1,11 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
-import {
-  readFileSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync,
-} from "node:fs";
+import { readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join } from "node:path";
 import { resolveConfigDataRoot } from "../paths.js";
 import {
@@ -16,7 +11,7 @@ import {
 import { withFileLock } from "../with-file-lock.js";
 
 export const EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA =
-  "chainlesschain.evolution-deployment-profile/v4";
+  "chainlesschain.evolution-deployment-profile/v5";
 
 const LEGACY_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA =
   "chainlesschain.evolution-deployment-profile/v1";
@@ -24,6 +19,8 @@ const PREVIOUS_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA =
   "chainlesschain.evolution-deployment-profile/v2";
 const PRIOR_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA =
   "chainlesschain.evolution-deployment-profile/v3";
+const LAST_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA =
+  "chainlesschain.evolution-deployment-profile/v4";
 const DIGEST = /^sha256:[a-f0-9]{64}$/u;
 const MAX_TRUST_ROOT_REVISION_FLOORS = 64;
 
@@ -47,6 +44,8 @@ function normalizeProfile(value) {
     PREVIOUS_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA,
     PRIOR_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA,
   ].includes(value.schema);
+  const beforeDeploymentMode =
+    legacy || value.schema === LAST_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA;
   const expected =
     value.schema === LEGACY_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA
       ? ["descriptorPath", "enabled", "schema", "trustRootPath"]
@@ -58,31 +57,44 @@ function normalizeProfile(value) {
             "schema",
             "trustRootPath",
           ]
-      : value.schema === PRIOR_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA
-        ? [
-            "activeTrustRootDigest",
-            "descriptorPath",
-            "enabled",
-            "revisionFloors",
-            "schema",
-            "trustRootPath",
-          ]
-        : [
-            "activeTrustRootDigest",
-            "descriptorPath",
-            "enabled",
-            "revisionFloors",
-            "revokedDescriptorRevisions",
-            "schema",
-            "trustRootPath",
-          ];
+        : value.schema === PRIOR_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA
+          ? [
+              "activeTrustRootDigest",
+              "descriptorPath",
+              "enabled",
+              "revisionFloors",
+              "schema",
+              "trustRootPath",
+            ]
+          : value.schema === LAST_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA
+            ? [
+                "activeTrustRootDigest",
+                "descriptorPath",
+                "enabled",
+                "revisionFloors",
+                "revokedDescriptorRevisions",
+                "schema",
+                "trustRootPath",
+              ]
+            : [
+                "activeTrustRootDigest",
+                "deploymentMode",
+                "descriptorPath",
+                "enabled",
+                "revisionFloors",
+                "revokedDescriptorRevisions",
+                "schema",
+                "testPrivateKeyPath",
+                "trustRootPath",
+              ];
   if (JSON.stringify(keys) !== JSON.stringify(expected.sort()))
     throw new TypeError("evolution deployment profile has unexpected fields");
   if (
     value.schema !== EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA &&
     value.schema !== LEGACY_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA &&
     value.schema !== PREVIOUS_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA &&
-    value.schema !== PRIOR_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA
+    value.schema !== PRIOR_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA &&
+    value.schema !== LAST_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA
   )
     throw new TypeError("evolution deployment profile schema is invalid");
   if (typeof value.enabled !== "boolean")
@@ -103,10 +115,30 @@ function normalizeProfile(value) {
   const activeTrustRootDigest = legacy
     ? null
     : normalizeTrustRootDigest(value.activeTrustRootDigest);
-  const revokedDescriptorRevisions =
-    value.schema === EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA
-      ? normalizeRevokedDescriptorRevisions(value.revokedDescriptorRevisions)
-      : {};
+  const revokedDescriptorRevisions = [
+    EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA,
+    LAST_EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA,
+  ].includes(value.schema)
+    ? normalizeRevokedDescriptorRevisions(value.revokedDescriptorRevisions)
+    : {};
+  const deploymentMode = beforeDeploymentMode
+    ? "managed"
+    : value.deploymentMode;
+  if (!["managed", "test"].includes(deploymentMode))
+    throw new TypeError("evolution deployment profile mode is invalid");
+  const testPrivateKeyPath = beforeDeploymentMode
+    ? null
+    : value.testPrivateKeyPath;
+  if (
+    (deploymentMode === "test" &&
+      (typeof testPrivateKeyPath !== "string" ||
+        !isAbsolute(testPrivateKeyPath))) ||
+    (deploymentMode === "managed" && testPrivateKeyPath !== null)
+  ) {
+    throw new TypeError(
+      "evolution deployment profile test private key path is invalid",
+    );
+  }
   return Object.freeze({
     schema: EVOLUTION_DEPLOYMENT_PROFILE_SCHEMA,
     enabled: value.enabled,
@@ -115,6 +147,8 @@ function normalizeProfile(value) {
     revisionFloors,
     activeTrustRootDigest,
     revokedDescriptorRevisions,
+    deploymentMode,
+    testPrivateKeyPath,
   });
 }
 
@@ -156,12 +190,16 @@ function normalizeTrustRootDigest(value) {
 
 function normalizeRevisionFloors(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
-    throw new TypeError("evolution deployment profile revisionFloors is invalid");
+    throw new TypeError(
+      "evolution deployment profile revisionFloors is invalid",
+    );
   const entries = Object.entries(value).sort(([left], [right]) =>
     left.localeCompare(right),
   );
   if (entries.length > MAX_TRUST_ROOT_REVISION_FLOORS)
-    throw new TypeError("evolution deployment profile revisionFloors is too large");
+    throw new TypeError(
+      "evolution deployment profile revisionFloors is too large",
+    );
   for (const [trustRootDigest, revision] of entries) {
     if (!DIGEST.test(trustRootDigest))
       throw new TypeError(
@@ -228,6 +266,8 @@ function profileFromInput(input) {
     revisionFloors: input?.revisionFloors || {},
     activeTrustRootDigest: input?.activeTrustRootDigest,
     revokedDescriptorRevisions: input?.revokedDescriptorRevisions || {},
+    deploymentMode: input?.deploymentMode || "managed",
+    testPrivateKeyPath: input?.testPrivateKeyPath || null,
   });
 }
 
@@ -251,29 +291,34 @@ export async function readEvolutionDeploymentProfile(options = {}) {
 
 export async function writeEvolutionDeploymentProfile(input, options = {}) {
   const proposed = profileFromInput(input);
-  return updateEvolutionDeploymentProfile((current) => ({
-    ...proposed,
-    // This lower-level writer cannot authenticate a descriptor, so it never
-    // lowers or erases a floor established by configureEvolutionDeployment().
-    revisionFloors: Object.fromEntries(
-      Object.keys({
-        ...(current?.revisionFloors || {}),
-        ...proposed.revisionFloors,
-      }).map((trustRootDigest) => [
-        trustRootDigest,
-        Math.max(
-          current?.revisionFloors?.[trustRootDigest] || 0,
-          proposed.revisionFloors[trustRootDigest] || 0,
-        ),
-      ]),
-    ),
-    activeTrustRootDigest:
-      proposed.activeTrustRootDigest || current?.activeTrustRootDigest,
-    revokedDescriptorRevisions: {
-      ...(current?.revokedDescriptorRevisions || {}),
-      ...(proposed.revokedDescriptorRevisions || {}),
-    },
-  }), options);
+  return updateEvolutionDeploymentProfile(
+    (current) => ({
+      ...proposed,
+      // This lower-level writer cannot authenticate a descriptor, so it never
+      // lowers or erases a floor established by configureEvolutionDeployment().
+      revisionFloors: Object.fromEntries(
+        Object.keys({
+          ...(current?.revisionFloors || {}),
+          ...proposed.revisionFloors,
+        }).map((trustRootDigest) => [
+          trustRootDigest,
+          Math.max(
+            current?.revisionFloors?.[trustRootDigest] || 0,
+            proposed.revisionFloors[trustRootDigest] || 0,
+          ),
+        ]),
+      ),
+      activeTrustRootDigest:
+        proposed.activeTrustRootDigest || current?.activeTrustRootDigest,
+      revokedDescriptorRevisions: {
+        ...(current?.revokedDescriptorRevisions || {}),
+        ...(proposed.revokedDescriptorRevisions || {}),
+      },
+      deploymentMode: proposed.deploymentMode,
+      testPrivateKeyPath: proposed.testPrivateKeyPath,
+    }),
+    options,
+  );
 }
 
 /**
@@ -335,9 +380,8 @@ export function assertEvolutionDeploymentDescriptorNotRevoked(
   profile,
   descriptor,
 ) {
-  const revoked = profile?.revokedDescriptorRevisions?.[
-    descriptor?.trustRootDigest
-  ];
+  const revoked =
+    profile?.revokedDescriptorRevisions?.[descriptor?.trustRootDigest];
   if (!revoked?.includes(descriptor?.revision)) return;
   const error = new Error(
     `evolution deployment descriptor revision ${descriptor.revision} is revoked`,