chainlesschain 0.166.77 → 0.166.79

package/src/lib/agent-router.js

@@ -228,12 +228,14 @@ export class AgentRouter extends EventEmitter {
    */
   static autoDetect(options = {}) {
     const backends = [];
+    const claude = options.cliDetections?.claude || detectClaudeCode();
+    const codex = options.cliDetections?.codex || detectCodex();
 
-    if (detectClaudeCode().found) {
-      backends.push({ type: BACKEND_TYPE.CLAUDE, weight: 3 });
+    if (claude.found) {
+      backends.push({ type: BACKEND_TYPE.CLAUDE, weight: 3, installed: true });
     }
-    if (detectCodex().found) {
-      backends.push({ type: BACKEND_TYPE.CODEX, weight: 2 });
+    if (codex.found) {
+      backends.push({ type: BACKEND_TYPE.CODEX, weight: 2, installed: true });
     }
     if (process.env.GEMINI_API_KEY) {
       backends.push({ type: BACKEND_TYPE.GEMINI, weight: 2 });
@@ -263,7 +265,7 @@ export class AgentRouter extends EventEmitter {
     const { cwd = process.cwd() } = options;
     if (this._backends.length === 0) {
       throw new Error(
-        "No agent backends available. Install Claude Code: npm i -g @anthropic-ai/claude-code",
+        "No agent backends available. Use cc agent for tool execution; orchestrate API backends produce text only.",
       );
     }
     const evolutionIngress =
@@ -277,8 +279,7 @@ export class AgentRouter extends EventEmitter {
       error.code = "CC_AGENT_EVOLUTION_INGRESS_FAILED";
       throw error;
     }
-    const backends =
-      this._backends.filter((backend) => !backend.isCLI);
+    const backends = this._backends.filter((backend) => !backend.isCLI);
 
     if (backends.length === 0) {
       const error = new Error(
@@ -475,6 +476,7 @@ export class AgentRouter extends EventEmitter {
         return {
           type,
           isCLI: true,
+          installed: cfg.installed ?? null,
           weight: cfg.weight || 1,
           _pool: pool,
           timeout: cfg.timeout || 300_000,
@@ -530,8 +532,34 @@ export class AgentRouter extends EventEmitter {
       kind: b.isCLI ? "cli" : "api",
       provider: b.provider || b.type,
       weight: b.weight,
+      installed: b.isCLI ? (b.installed ?? null) : null,
+      configured: true,
+      governanceAdmitted: b.isCLI ? false : null,
+      requiresAuthenticatedRun: true,
+      dispatchable: !b.isCLI,
+      runnable: false,
+      executionMode: b.isCLI ? "blocked" : "text-only",
+      blockedReason: b.isCLI
+        ? AGENT_ROUTER_ERROR.EXTERNAL_MODEL_INGRESS_UNATTESTED
+        : "API_TEXT_ONLY_NO_TOOL_EXECUTION",
+      alternative: "cc agent",
     }));
   }
+
+  /** Configuration preflight only; dispatch still authenticates each Run. */
+  assertDispatchAvailable() {
+    if (this._backends.some((backend) => !backend.isCLI)) return;
+    const error = new Error(
+      this._backends.length
+        ? "External Claude/Codex CLIs are blocked: per-request model governance is unattested. Use cc agent for tool execution."
+        : "No agent backends available. Use cc agent for tool execution.",
+    );
+    error.code = this._backends.length
+      ? AGENT_ROUTER_ERROR.EXTERNAL_MODEL_INGRESS_UNATTESTED
+      : "AGENT_ROUTER_NO_BACKENDS";
+    error.backends = this.summary();
+    throw error;
+  }
 }
 
 // ===== V2 Surface: Agent Router governance overlay (CLI v0.132.0) =====

package/src/lib/agent-sandbox.js

@@ -13,6 +13,9 @@ export const AGENT_SANDBOX_MODES = Object.freeze([
 ]);
 export const AGENT_SANDBOX_CAPABILITY_SCHEMA =
   "chainlesschain.agent-sandbox-capabilities/v1";
+const dockerEgressReceipts = new WeakMap();
+const PINNED_DOCKER_IMAGE =
+  /^[a-zA-Z0-9][a-zA-Z0-9./:_-]*@sha256:[a-f0-9]{64}$/;
 export const _deps = {
   spawnSync: (...args) => executionBroker.spawnSync(...args),
   host: () => ({
@@ -249,12 +252,21 @@ export function normalizeAgentSandbox(value, options = {}) {
   return {
     engine: effectiveSettings.engine || "docker",
     image: effectiveSettings.image || image,
+    ...(effectiveSettings.engine === "docker-egress"
+      ? { relayImage: effectiveSettings.relayImage || null }
+      : {}),
     cwd: path.resolve(options.cwd || process.cwd()),
     network: managedNetworkDisabled
       ? false
       : options.network === true || effectiveSettings.network === true,
     policy: normalizeSandboxPolicy(
-      effectiveSettings,
+      effectiveSettings.engine === "docker-egress"
+        ? {
+            ...effectiveSettings,
+            allowUnsandboxedCommands: false,
+            failIfUnavailable: true,
+          }
+        : effectiveSettings,
       options.cwd || process.cwd(),
     ),
   };
@@ -340,6 +352,149 @@ function addUniqueCapability(target, entry) {
   }
 }
 
+function egressBinding(sandbox) {
+  return JSON.stringify({
+    engine: sandbox.engine,
+    image: sandbox.image,
+    relayImage: sandbox.relayImage,
+    cwd: sandbox.cwd,
+    network: sandbox.network,
+    mode: sandbox.mode || null,
+    policy: sandbox.policy || {},
+  });
+}
+
+function assessDockerEgressCapabilities(sandbox, options, host) {
+  const policy = sandbox.policy || {};
+  const domainRules =
+    (policy.allowedDomains?.length || 0) + (policy.deniedDomains?.length || 0);
+  const requested = [
+    capability("isolation.container"),
+    capability("filesystem.workspace-read-write"),
+    capability("network.domain-policy", { entries: domainRules }),
+  ];
+  const unsupported = [];
+  const reject = (id, reason, message) =>
+    unsupported.push(capability(id, { reason, message }));
+  if (policy.excludedCommands?.length)
+    reject(
+      "execution.excluded-commands",
+      "docker_egress_exclusions_prohibited",
+      "Docker egress does not allow commands to bypass its execution route.",
+    );
+  if (host.platform !== "linux")
+    reject(
+      "backend.platform",
+      "docker_egress_requires_linux",
+      "Docker egress requires a Linux host.",
+    );
+  if (!["x64", "arm64"].includes(host.arch))
+    reject(
+      "backend.architecture",
+      "docker_egress_architecture_unsupported",
+      "Docker egress requires x64 or arm64.",
+    );
+  if (sandbox.mode === "strict" || sandbox.network !== true)
+    reject(
+      "network.domain-policy",
+      "docker_egress_network_disabled",
+      "Docker egress requires network=true and is prohibited in strict mode.",
+    );
+  if (!domainRules)
+    reject(
+      "network.domain-policy",
+      "docker_egress_domain_policy_required",
+      "Docker egress requires explicit domain rules.",
+    );
+  for (const field of ["image", "relayImage"]) {
+    if (
+      typeof sandbox[field] !== "string" ||
+      !PINNED_DOCKER_IMAGE.test(sandbox[field])
+    )
+      reject(
+        `backend.${field}`,
+        "docker_egress_image_digest_required",
+        `Docker egress ${field} must be pinned to a sha256 digest.`,
+      );
+  }
+  for (const field of ["allowRead", "denyRead", "allowWrite", "denyWrite"]) {
+    if (policy[field]?.length)
+      reject(
+        `filesystem.${field}`,
+        "docker_fine_grained_filesystem_unsupported",
+        "Docker egress does not support additional or masked filesystem paths.",
+      );
+  }
+  const enforceable = unsupported.length
+    ? []
+    : [
+        capability("isolation.container", { enforcement: "docker-container" }),
+        capability("filesystem.workspace-read-write", {
+          enforcement: "docker-bind-mount",
+        }),
+        capability("network.domain-policy", {
+          enforcement: "docker-none-network-uds-proxy-seccomp",
+        }),
+      ];
+  const receipt = options.execution?.receipt;
+  const registered =
+    receipt && typeof receipt === "object"
+      ? dockerEgressReceipts.get(receipt)
+      : null;
+  const started =
+    unsupported.length === 0 &&
+    registered?.binding === egressBinding(sandbox) &&
+    registered.host.platform === host.platform &&
+    registered.host.arch === host.arch;
+  const attempted = started || options.execution?.attempted === true;
+  const outcomeUnknown = options.execution?.outcomeUnknown === true;
+  const checked = started || options.availability != null;
+  const available = started
+    ? true
+    : checked
+      ? options.availability?.available === true
+      : null;
+  return {
+    schema: AGENT_SANDBOX_CAPABILITY_SCHEMA,
+    host: {
+      platform: String(host.platform),
+      release: String(host.release),
+      arch: String(host.arch),
+    },
+    backend: {
+      engine: "docker-egress",
+      isolationLevel: "container",
+      availabilityChecked: checked,
+      available,
+      reason: started
+        ? null
+        : outcomeUnknown
+          ? "docker_egress_outcome_unknown"
+          : options.availability?.reason || null,
+    },
+    status: unsupported.length
+      ? "unsupported"
+      : started
+        ? "applied"
+        : outcomeUnknown
+          ? "outcome-unknown"
+          : attempted
+            ? "failed-to-start"
+            : checked && !available
+              ? "unavailable"
+              : "ready",
+    execution: {
+      observed: Boolean(started || options.execution),
+      attempted,
+      started: Boolean(started),
+    },
+    requested,
+    enforceable,
+    applied: started ? enforceable.map((entry) => ({ ...entry })) : [],
+    unsupported,
+  };
+}
+
 /**
  * Describe the exact legacy agent-shell sandbox request without claiming that
  * a command has run. `enforceable` is backend capability; `applied` is only
@@ -351,6 +506,8 @@ export function assessAgentSandboxCapabilities(sandbox, options = {}) {
     release: os.release(),
     arch: process.arch,
   };
+  if (sandbox?.engine === "docker-egress")
+    return assessDockerEgressCapabilities(sandbox, options, host);
   const execution = options.execution || null;
   const availability = options.availability || null;
   const requested = [];
@@ -594,6 +751,22 @@ function attachSandboxCapabilityReport(
 }
 
 export function executeSandboxedShell(command, sandbox, options = {}) {
+  if (sandbox?.engine === "docker-egress") {
+    return {
+      stdout: "",
+      stderr: "Docker egress requires the asynchronous execution route",
+      exitCode: 1,
+      failedToStart: true,
+      sandboxCapabilities: assessAgentSandboxCapabilities(sandbox, {
+        host: _deps.host(),
+        execution: { attempted: true },
+        availability: {
+          available: false,
+          reason: "docker_egress_async_execution_required",
+        },
+      }),
+    };
+  }
   if (!sandbox || !["docker", "bubblewrap"].includes(sandbox.engine)) {
     throw new Error("A supported agent sandbox configuration is required");
   }
@@ -783,7 +956,7 @@ function executeBubblewrapShell(command, sandbox, options, hostCwd, policy) {
 export function isolationLevel(sandbox) {
   if (!sandbox) return "policy-only";
   if (sandbox.engine === "bubblewrap") return "os-sandbox";
-  if (sandbox.engine === "docker") return "container";
+  if (["docker", "docker-egress"].includes(sandbox.engine)) return "container";
   return "policy-only";
 }
 
@@ -836,6 +1009,11 @@ export function assertSandboxAvailable(sandbox, deps = _deps) {
   if (!sandbox || sandbox.policy?.failIfUnavailable !== true) return;
   const probe = probeSandboxAvailability(sandbox, deps);
   if (!probe.available) {
+    if (sandbox.engine === "docker-egress") {
+      throw new Error(
+        "Docker egress is unavailable; this backend never falls back to unsandboxed execution.",
+      );
+    }
     throw new Error(
       `sandbox.failIfUnavailable: ${sandbox.engine} sandbox is unavailable (${probe.reason}) — refusing to start. Install/start ${sandbox.engine === "bubblewrap" ? "bubblewrap" : "Docker"}, or unset failIfUnavailable to allow per-command degradation.`,
     );
@@ -860,5 +1038,127 @@ export function sandboxSummary(sandbox) {
     },
   };
   if (sandbox.mode) summary.mode = sandbox.mode;
+  if (sandbox.engine === "docker-egress")
+    summary.relayImage = sandbox.relayImage;
   return summary;
 }
+
+/** Own the asynchronous session and mint execution evidence only after its
+ * real implementation reports a terminal result and cleanup completes. */
+export async function executeDockerEgressShell(command, sandbox, options = {}) {
+  if (sandbox?.engine !== "docker-egress")
+    throw new TypeError("docker-egress configuration is required");
+  const host = _deps.host();
+  const snapshot = JSON.parse(JSON.stringify(sandbox));
+  const preflight = assessAgentSandboxCapabilities(snapshot, { host });
+  let startAuthorized = false;
+  let observedResult;
+  const failure = () => ({
+    stdout:
+      startAuthorized && typeof observedResult?.stdout === "string"
+        ? observedResult.stdout
+        : "",
+    stderr: startAuthorized
+      ? "Docker egress execution outcome or cleanup could not be verified; do not retry automatically."
+      : preflight.unsupported.length
+        ? preflight.unsupported.map((entry) => entry.message).join("; ")
+        : "Docker egress execution is unavailable or did not complete safely.",
+    exitCode: 1,
+    ...(startAuthorized
+      ? {
+          executionOutcome: observedResult
+            ? "completed-cleanup-unknown"
+            : "unknown",
+          retrySafe: false,
+        }
+      : { failedToStart: true }),
+    sandboxCapabilities: assessAgentSandboxCapabilities(snapshot, {
+      host,
+      execution: { attempted: true, outcomeUnknown: startAuthorized },
+      ...(startAuthorized
+        ? {}
+        : {
+            availability: {
+              available: false,
+              reason: "docker_egress_execution_unavailable",
+            },
+          }),
+    }),
+  });
+  if (preflight.unsupported.length) return failure();
+  let session;
+  let authorityError;
+  try {
+    const { startDockerEgressSession } =
+      await import("./sandbox-docker-egress.js");
+    session = await startDockerEgressSession({
+      brokerSocketPath: options.brokerSocketPath,
+      relayImage: snapshot.relayImage,
+      targetImage: snapshot.image,
+      workspaceRoot: options.cwd || snapshot.cwd,
+      auditContext: options.auditContext,
+    });
+    try {
+      options.onSession?.(session);
+    } catch (error) {
+      authorityError = error;
+      throw error;
+    }
+    const result = await session.run(command, {
+      timeoutMs: options.timeoutMs || options.timeout,
+      auditContext: options.auditContext,
+      env: options.env,
+      async beforeStart() {
+        try {
+          if (egressBinding(sandbox) !== egressBinding(snapshot))
+            throw Object.assign(
+              new Error("Sandbox policy changed during Docker startup"),
+              { code: "CC_SHELL_POLICY_AUTHORITY_CHANGED" },
+            );
+          await options.beforeStart?.();
+          if (egressBinding(sandbox) !== egressBinding(snapshot))
+            throw Object.assign(
+              new Error("Sandbox policy changed during Docker startup"),
+              { code: "CC_SHELL_POLICY_AUTHORITY_CHANGED" },
+            );
+          startAuthorized = true;
+        } catch (error) {
+          authorityError = error;
+          throw error;
+        }
+      },
+    });
+    observedResult = result;
+    await session.close();
+    if (
+      !startAuthorized ||
+      !Number.isInteger(result?.exitCode) ||
+      typeof result.stdout !== "string" ||
+      typeof result.stderr !== "string"
+    ) {
+      throw new Error("Docker egress execution proof is incomplete");
+    }
+    const receipt = Object.freeze({ kind: "docker-egress-execution/v1" });
+    dockerEgressReceipts.set(receipt, {
+      binding: egressBinding(snapshot),
+      host: { ...host },
+    });
+    return {
+      ...result,
+      sandboxCapabilities: assessAgentSandboxCapabilities(snapshot, {
+        host,
+        execution: { attempted: true, receipt },
+      }),
+    };
+  } catch (error) {
+    if (session) {
+      try {
+        await session.close();
+      } catch (cleanupError) {
+        error.cleanupError = cleanupError;
+      }
+    }
+    if (authorityError) throw authorityError;
+    return failure();
+  }
+}

package/src/lib/app-server/server.js

@@ -1463,6 +1463,20 @@ export class CcAppServer {
       contextRevision: Number.isSafeInteger(event.context_revision)
         ? event.context_revision
         : null,
+      // Preserve the MCP form/URL vocabulary for native host review. This is
+      // question metadata, not an approval decision or host execution authority.
+      ...(event.metadata?.kind === "mcp_elicitation"
+        ? {
+            metadata: {
+              kind: "mcp_elicitation",
+              mode: event.metadata.mode || "form",
+              server: event.metadata.server ?? null,
+              requestedSchema: event.metadata.requestedSchema ?? null,
+              url: event.metadata.url ?? null,
+              elicitationId: event.metadata.elicitationId ?? null,
+            },
+          }
+        : {}),
       expiresAt: new Date(this.now() + this.requestTimeoutMs).toISOString(),
     };
   }

package/src/lib/background-agent-supervisor.js

@@ -2174,14 +2174,22 @@ function isBackgroundAgentAfterCursor(state, cursor) {
   return String(state.id).localeCompare(cursor.id) > 0;
 }
 
+function observeBackgroundAgentList(options, source, entryCount) {
+  // Optional in-process measurement only; telemetry failures cannot change a read.
+  try {
+    options.indexObserver?.(Object.freeze({ source, entryCount }));
+  } catch {
+    // Keep observers outside the authoritative result.
+  }
+}
+
 /**
  * Return one stable, bounded page from the newest-first background session
  * feed. The cursor is an opaque ordering fence, not an authority token.
  *
- * State files are still read to preserve the current authoritative lifecycle
- * reconciliation. A future read-only index may reduce that I/O, but this API
- * immediately bounds the object graph and protocol response retained by a
- * caller.
+ * The index still enumerates and stats every authority file; selected rows are
+ * read again for lifecycle reconciliation. It reduces content reads, not the
+ * O(N) inventory fence. indexObserver receives the chosen read path and count.
  */
 export function listBackgroundAgentsPage(options = {}) {
   const limit = normalizeBackgroundAgentPageLimit(options.limit);
@@ -2223,6 +2231,7 @@ export function listBackgroundAgentsPage(options = {}) {
       projected.length > sessions.length
         ? encodeBackgroundAgentPageCursor(sessions.at(-1), options.all)
         : null;
+    observeBackgroundAgentList(options, indexed.source, indexed.entries.length);
     return Object.freeze({
       sessions: Object.freeze(sessions),
       nextCursor,
@@ -2238,6 +2247,7 @@ export function listBackgroundAgentsPage(options = {}) {
     eligible.length > sessions.length
       ? encodeBackgroundAgentPageCursor(sessions.at(-1), options.all)
       : null;
+  observeBackgroundAgentList(options, "full-scan", eligible.length);
   return Object.freeze({
     sessions: Object.freeze(sessions),
     nextCursor,

package/src/lib/causal-observability.js

@@ -8,6 +8,10 @@
 
 import crypto from "node:crypto";
 import { PRICE_TABLE, priceRollup } from "./llm-pricing.js";
+import {
+  projectUsagePricingContext,
+  mergeUsagePricingBucket,
+} from "./usage-pricing-context.js";
 import { canonicalDeliveryJson } from "./delivery-evidence.js";
 import { createSessionTranscriptStructureProjection } from "./session-transcript-structure.js";
 
@@ -251,7 +255,64 @@ function normalizePricingTable(table = PRICE_TABLE) {
       ) {
         throw new Error("pricing rates must be finite non-negative numbers");
       }
-      return { match, in: input, out: output };
+      const result = { match, in: input, out: output };
+      if (Object.hasOwn(entry, "explicitOverride")) {
+        if (typeof entry.explicitOverride !== "boolean")
+          throw new Error("pricing explicitOverride must be boolean");
+        result.explicitOverride = entry.explicitOverride;
+      }
+      if (Object.hasOwn(entry, "exact")) {
+        if (typeof entry.exact !== "boolean")
+          throw new Error("pricing exact must be boolean");
+        result.exact = entry.exact;
+      }
+      if (Object.hasOwn(entry, "terms")) {
+        const terms = entry.terms;
+        const nonNegative = (value) => {
+          if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
+            throw new Error("invalid pricing multiplier");
+          return value;
+        };
+        assertKnownOwnKeys(
+          terms,
+          new Set([
+            "cacheReadMultiplier",
+            "cacheWriteMultiplier",
+            "longContext",
+            "serviceMultipliers",
+          ]),
+          "pricing terms",
+        );
+        assertKnownOwnKeys(
+          terms.longContext,
+          new Set(["threshold", "inputMultiplier", "outputMultiplier"]),
+          "pricing long context",
+        );
+        const threshold = nonNegative(terms.longContext.threshold);
+        if (!Number.isSafeInteger(threshold))
+          throw new Error("invalid pricing threshold");
+        assertKnownOwnKeys(
+          terms.serviceMultipliers,
+          new Set(["standard", "default", "auto", "batch", "flex", "fast"]),
+          "pricing service multipliers",
+        );
+        result.terms = {
+          cacheReadMultiplier: nonNegative(terms.cacheReadMultiplier),
+          cacheWriteMultiplier: nonNegative(terms.cacheWriteMultiplier),
+          longContext: {
+            threshold,
+            inputMultiplier: nonNegative(terms.longContext.inputMultiplier),
+            outputMultiplier: nonNegative(terms.longContext.outputMultiplier),
+          },
+          serviceMultipliers: Object.fromEntries(
+            Object.entries(terms.serviceMultipliers).map(([key, value]) => [
+              key,
+              nonNegative(value),
+            ]),
+          ),
+        };
+      }
+      return result;
     });
     normalized.set(providerKey, normalizedEntries);
   }
@@ -672,6 +733,7 @@ function strictUsage(event) {
     totalTokens: expectedTotal,
     cacheReadTokens,
     cacheCreationTokens,
+    ...projectUsagePricingContext(raw),
   };
 }
 
@@ -1101,6 +1163,7 @@ export function createVerifiedSessionObservabilityProjection(
           }),
         );
         addUsageSums(row, usage, "session usage model");
+        mergeUsagePricingBucket(row, usage);
       }
 
       if (event?.type === "tool_call") {

package/src/lib/checkpoint-summary-projection.js

@@ -0,0 +1,98 @@
+import {
+  buildExtractiveHandoff,
+  formatStructuredHandoff,
+} from "../harness/structured-handoff.js";
+import {
+  DURABLE_SYSTEM_MESSAGE_KINDS,
+  getDurableSystemMessageProvenance,
+  markDurableSystemMessage,
+  projectCanonicalResumeMessages,
+} from "./session-message-provenance.js";
+
+export const HISTORY_SUMMARY_SCHEMA =
+  "chainlesschain.session-history-summary/v1";
+
+function summaryMessage(messages, action, turnId) {
+  const handoff = buildExtractiveHandoff(messages, {
+    maxFallbackSourceChars: 24_000,
+  });
+  return markDurableSystemMessage(
+    {
+      role: "system",
+      content:
+        `[Conversation Summary: ${action} ${turnId}]\n` +
+        formatStructuredHandoff(handoff),
+    },
+    DURABLE_SYSTEM_MESSAGE_KINDS.CHECKPOINT_SUMMARY,
+  );
+}
+
+/**
+ * Deterministic v1 rewrite shared by the planner and verified history reader.
+ * Source indexes describe the conservative dependency of each output, not a
+ * claim that the bounded extractive summary quotes every source. Changes to
+ * this transform/formatter require a new history schema or a v1 reader.
+ */
+export function projectCheckpointSummary({
+  messages,
+  action,
+  turnId,
+  start,
+  end,
+}) {
+  if (
+    !Array.isArray(messages) ||
+    typeof turnId !== "string" ||
+    !turnId ||
+    !Number.isSafeInteger(start) ||
+    !Number.isSafeInteger(end) ||
+    start < 0 ||
+    start >= end ||
+    end > messages.length ||
+    !["summary-from", "summary-to"].includes(action)
+  )
+    throw new TypeError("Invalid checkpoint summary source range");
+  const copied = (begin, finish) =>
+    messages.slice(begin, finish).map((message, index) => ({
+      message,
+      sourceIndexes: [begin + index],
+    }));
+  const summarized = (entries) => ({
+    message: summaryMessage(
+      entries.map((entry) => entry.message),
+      action,
+      turnId,
+    ),
+    sourceIndexes: entries.flatMap((entry) => entry.sourceIndexes),
+  });
+  if (action === "summary-from") {
+    if (end !== messages.length || messages[start]?.role !== "user")
+      throw new TypeError("Invalid checkpoint summary suffix");
+    return [...copied(0, start), summarized(copied(start, end))];
+  }
+  if (
+    start !== (messages[0]?.role === "system" ? 1 : 0) ||
+    (end < messages.length && messages[end]?.role !== "user")
+  )
+    throw new TypeError("Invalid checkpoint summary prefix");
+
+  const prefix = messages.slice(start, end);
+  // Validate/sanitize before inspecting roles. Unmarked systems must neither
+  // survive the rewrite nor be quoted into a newly authorized summary.
+  const canonical = projectCanonicalResumeMessages(prefix, { strict: true });
+  const indexes = prefix.flatMap((message, index) =>
+    message.role !== "system" || getDurableSystemMessageProvenance(message)
+      ? [start + index]
+      : [],
+  );
+  const entries = canonical.map((message, index) => ({
+    message,
+    sourceIndexes: [indexes[index]],
+  }));
+  return [
+    ...copied(0, start),
+    ...entries.filter((entry) => entry.message.role === "system"),
+    summarized(entries.filter((entry) => entry.message.role !== "system")),
+    ...copied(end, messages.length),
+  ];
+}