chainlesschain 0.166.84 → 0.166.86

package/src/lib/packer/pack-update-applier.js

@@ -207,7 +207,7 @@ export async function scheduleReplace(ctx = {}) {
       : null;
 
     if (platform === "win32") {
-      return scheduleWindowsTransaction({
+      return await scheduleWindowsTransaction({
         operation: "update",
         resolvedNewPath,
         layout,
@@ -681,7 +681,7 @@ function rollbackFailedPosixUpdate(ctx) {
   }
 }
 
-function scheduleWindowsTransaction(ctx) {
+async function scheduleWindowsTransaction(ctx) {
   const {
     operation,
     resolvedNewPath,
@@ -771,26 +771,39 @@ function scheduleWindowsTransaction(ctx) {
 
     let ready = false;
     let childError = null;
+    let childExited = false;
+    const onChildExit = () => {
+      childExited = true;
+    };
+    const hasChildFailed = () =>
+      Boolean(childError) ||
+      childExited ||
+      child.exitCode != null ||
+      child.signalCode != null;
     if (typeof child.once === "function") {
       // Native spawn failures are normally emitted asynchronously. Attach
-      // before the synchronous readiness wait so both the no-ready and the
+      // before yielding for readiness so both the no-ready and the
       // post-transfer paths always consume the ChildProcess error event.
       child.once("error", (error) => {
         childError = error;
       });
+      child.once("exit", onChildExit);
     }
     try {
       ready =
         Boolean(
-          waitForReadyImpl({
+          await waitForReadyImpl({
             readyPath,
             transactionId,
             timeoutMs: WINDOWS_SIDECAR_READY_TIMEOUT_MS,
             child,
+            hasChildFailed,
           }),
-        ) && !childError;
+        ) && !hasChildFailed();
     } catch {
       ready = false;
+    } finally {
+      child.removeListener?.("exit", onChildExit);
     }
     if (!ready) {
       try {
@@ -840,6 +853,11 @@ function scheduleWindowsTransaction(ctx) {
 function windowsGenerationJournalHelperSource() {
   return String.raw`param()
 $ErrorActionPreference = 'Stop'
+# The journal contains only JSON primitives. Use the inbox .NET serializer and
+# file/path APIs so each phase does not repeat PowerShell module discovery.
+# Keep the same synchronous atomic replacement and durable flush protocol.
+[void][Reflection.Assembly]::Load('System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35')
+$Serializer = [Web.Script.Serialization.JavaScriptSerializer]::new()
 $Action = [string]$env:JOURNAL_ACTION
 $JournalPath = [string]$env:JOURNAL_FILE
 $RetiredPath = [string]$env:JOURNAL_RETIRED
@@ -859,7 +877,7 @@ if (($Phase -eq 'committed') -ne ($Decision -eq 'commit')) { throw 'Invalid phas
 if ($Action -eq 'write' -and $Phase -eq 'prepared') {
   if ([IO.File]::Exists($JournalPath)) { throw 'A generation journal already exists' }
   $Bytes = [Convert]::FromBase64String([string]$env:JOURNAL_INITIAL_BASE64)
-  $Journal = [Text.Encoding]::UTF8.GetString($Bytes) | ConvertFrom-Json
+  $Journal = $Serializer.DeserializeObject([Text.Encoding]::UTF8.GetString($Bytes))
   $ParentSource = @'
 using System;
 using System.Runtime.InteropServices;
@@ -887,10 +905,10 @@ public static class CcParentProcess {
 }
 '@
   Add-Type -TypeDefinition $ParentSource -Language CSharp
-  $Journal | Add-Member -NotePropertyName ownerPid -NotePropertyValue ([CcParentProcess]::Get())
+  $Journal.Add('ownerPid', [CcParentProcess]::Get())
 } else {
   if (-not [IO.File]::Exists($JournalPath)) { throw 'Generation journal is missing' }
-  $Journal = Get-Content -Raw -LiteralPath $JournalPath | ConvertFrom-Json
+  $Journal = $Serializer.DeserializeObject([IO.File]::ReadAllText($JournalPath, [Text.Encoding]::UTF8))
 }
 
 $ValidBefore = {
@@ -918,7 +936,7 @@ if ($Action -eq 'retire') {
   if ([string]$Journal.phase -ne $Phase -or [string]$Journal.decision -ne $Decision) {
     throw 'Generation journal decision changed before retirement'
   }
-  $ReplacedPath = Join-Path (Split-Path -Parent $JournalPath) ('.chainlesschain.journal-retired-previous-' + [guid]::NewGuid().ToString('N'))
+  $ReplacedPath = [IO.Path]::Combine([IO.Path]::GetDirectoryName($JournalPath), ('.chainlesschain.journal-retired-previous-' + [guid]::NewGuid().ToString('N')))
   try {
     if ([IO.File]::Exists($RetiredPath)) {
       [IO.File]::Replace($JournalPath, $RetiredPath, $ReplacedPath, $true)
@@ -972,11 +990,11 @@ if ($Phase -ne 'prepared') {
 $Journal.phase = $Phase
 $Journal.decision = $Decision
 $Journal.updatedAt = [DateTimeOffset]::UtcNow.ToString('o')
-$Directory = Split-Path -Parent $JournalPath
-$StagingPath = Join-Path $Directory ('.chainlesschain.journal-' + [guid]::NewGuid().ToString('N'))
-$ReplacedPath = Join-Path $Directory ('.chainlesschain.journal-previous-' + [guid]::NewGuid().ToString('N'))
+$Directory = [IO.Path]::GetDirectoryName($JournalPath)
+$StagingPath = [IO.Path]::Combine($Directory, ('.chainlesschain.journal-' + [guid]::NewGuid().ToString('N')))
+$ReplacedPath = [IO.Path]::Combine($Directory, ('.chainlesschain.journal-previous-' + [guid]::NewGuid().ToString('N')))
 try {
-  $Payload = $Journal | ConvertTo-Json -Compress -Depth 8
+  $Payload = $Serializer.Serialize($Journal)
   $PayloadBytes = [Text.UTF8Encoding]::new($false).GetBytes($Payload + [Environment]::NewLine)
   $Stream = [IO.File]::Open($StagingPath, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)
   try {
@@ -1982,7 +2000,7 @@ export async function rollbackLastKnownGood(ctx = {}) {
       : null;
 
     if (platform === "win32") {
-      const result = scheduleWindowsTransaction({
+      const result = await scheduleWindowsTransaction({
         operation: "rescue",
         resolvedNewPath: rescueStagingPath,
         layout,
@@ -2752,10 +2770,15 @@ function restartVerifiedExecutable(targetPath, restart, spawnImpl) {
   }
 }
 
-function waitForWindowsSidecarReady({ readyPath, transactionId, timeoutMs }) {
+async function waitForWindowsSidecarReady({
+  readyPath,
+  transactionId,
+  timeoutMs,
+  hasChildFailed,
+}) {
   const deadline = Date.now() + timeoutMs;
-  const waitCell = new Int32Array(new SharedArrayBuffer(4));
   while (Date.now() < deadline) {
+    if (hasChildFailed()) return false;
     const stat = lstatOrNull(readyPath);
     if (stat) {
       try {
@@ -2769,7 +2792,8 @@ function waitForWindowsSidecarReady({ readyPath, transactionId, timeoutMs }) {
         return false;
       }
     }
-    Atomics.wait(waitCell, 0, 0, 25);
+    // Yield so native spawn errors and early exits can abort the handshake.
+    await new Promise((resolve) => setTimeout(resolve, 25));
   }
   return false;
 }

package/src/lib/packer/pkg-config-generator.js

@@ -20,6 +20,104 @@
 import fs from "node:fs";
 import { createRequire } from "node:module";
 import path from "node:path";
+import { linuxSubreaperTargetArchitectures } from "./pkg-targets.js";
+import {
+  LINUX_SUBREAPER_SOURCE_DIGEST,
+  MAX_SUBREAPER_IMAGE_BYTES,
+  MAX_SUBREAPER_MANIFEST_BYTES,
+  subreaperDigest,
+  validateLinuxSubreaperArtifact,
+} from "../process-execution-broker/linux-subreaper-artifact.js";
+
+function linuxSubreaperAssets(cliRoot, targets) {
+  const architectures = linuxSubreaperTargetArchitectures(targets);
+  if (!architectures.length) return [];
+  const root = fs.realpathSync(cliRoot);
+  const assets = [];
+  function read(relative, maximum) {
+    const file = path.join(root, relative);
+    let directory = path.dirname(file);
+    while (directory !== root) {
+      const stat = fs.lstatSync(directory);
+      if (stat.isSymbolicLink() || !stat.isDirectory())
+        throw new Error("Invalid standalone Linux helper directory");
+      directory = path.dirname(directory);
+    }
+    const before = fs.lstatSync(file, { bigint: true });
+    if (
+      !before.isFile() ||
+      before.isSymbolicLink() ||
+      before.nlink !== 1n ||
+      before.size < 1n ||
+      before.size > BigInt(maximum)
+    )
+      throw new Error("Invalid standalone Linux helper asset");
+    const fd = fs.openSync(
+      file,
+      fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0),
+    );
+    try {
+      const opened = fs.fstatSync(fd, { bigint: true });
+      if (
+        opened.dev !== before.dev ||
+        opened.ino !== before.ino ||
+        opened.size !== before.size
+      )
+        throw new Error("Standalone Linux helper asset changed");
+      const bytes = Buffer.alloc(Number(opened.size));
+      let offset = 0;
+      while (offset < bytes.length) {
+        const count = fs.readSync(
+          fd,
+          bytes,
+          offset,
+          bytes.length - offset,
+          offset,
+        );
+        if (count <= 0) throw new Error("Short standalone Linux helper asset");
+        offset += count;
+      }
+      const after = fs.fstatSync(fd, { bigint: true });
+      if (
+        after.size !== before.size ||
+        after.mtimeNs !== before.mtimeNs ||
+        after.ctimeNs !== before.ctimeNs ||
+        after.nlink !== 1n
+      )
+        throw new Error("Standalone Linux helper asset changed");
+      assets.push(file);
+      return bytes;
+    } finally {
+      fs.closeSync(fd);
+    }
+  }
+  try {
+    const source = read(
+      "src/lib/process-execution-broker/linux-subreaper-supervisor.c",
+      128 * 1024,
+    );
+    if (
+      subreaperDigest(
+        Buffer.from(source.toString("utf8").replace(/\r\n/g, "\n")),
+      ) !== LINUX_SUBREAPER_SOURCE_DIGEST
+    )
+      throw new Error("Standalone Linux helper source digest mismatch");
+    for (const arch of architectures) {
+      const directory = `src/assets/linux-subreaper/linux-${arch}`;
+      validateLinuxSubreaperArtifact(
+        read(`${directory}/manifest.json`, MAX_SUBREAPER_MANIFEST_BYTES),
+        read(`${directory}/supervisor`, MAX_SUBREAPER_IMAGE_BYTES),
+        { arch },
+      );
+    }
+    return assets.map(posixify);
+  } catch (cause) {
+    throw new Error(
+      "Standalone Linux targets require valid precompiled process supervision assets for every target architecture",
+      { cause },
+    );
+  }
+}
 
 function capsuleBuilderAssets(cliRoot) {
   const requireFromCli = createRequire(path.join(cliRoot, "package.json"));
@@ -108,6 +206,13 @@ export function generatePkgConfig(ctx) {
     updatePublicKey = null,
   } = ctx;
 
+  // pkg silently turns an empty target list into a host build. Require an
+  // explicit target so asset admission and the emitted build cannot diverge.
+  if (!Array.isArray(targets) || targets.length === 0)
+    throw new Error(
+      "Standalone builds require at least one explicit pkg target",
+    );
+
   const bakedTokenMode =
     typeof runtime.token === "string" ? runtime.token : "auto";
   const bakedHost =
@@ -432,6 +537,7 @@ export function generatePkgConfig(ctx) {
     `${posixify(cliRoot)}/src/lib/process-execution-broker/macos-mcp-launcher-protocol.json`,
     `${posixify(cliRoot)}/install/install.ps1`,
     ...capsuleBuilderAssets(cliRoot).map(posixify),
+    ...linuxSubreaperAssets(cliRoot, targets),
   ];
   if (prebuildsDir) assets.push(`${posixify(prebuildsDir)}/**/*`);
   // Project mode: bundle the collected .chainlesschain/ snapshot as an asset.
@@ -450,8 +556,8 @@ export function generatePkgConfig(ctx) {
         `${posixify(cliRoot)}/src/**/*.js`,
         `${posixify(cliRoot)}/src/**/*.cjs`,
         `${posixify(cliRoot)}/bin/**/*.js`,
-      ],
-      assets,
+      ].map((pattern) => pkgRelativePath(pkgConfigDir, pattern)),
+      assets: assets.map((pattern) => pkgRelativePath(pkgConfigDir, pattern)),
       targets,
       outputPath: path.dirname(outputPath),
       compress: compress ? "GZip" : "None",
@@ -476,3 +582,14 @@ export function generatePkgConfig(ctx) {
 function posixify(p) {
   return p.replace(/\\/g, "/");
 }
+
+function pkgRelativePath(directory, pattern) {
+  // pkg's walker joins every pattern to its config directory, even when the
+  // pattern is absolute. Emit relative globs so assets are actually embedded.
+  const relative = path.relative(directory, pattern);
+  if (path.isAbsolute(relative) || path.win32.isAbsolute(relative))
+    throw new Error(
+      "Standalone build assets and temporary config must be on the same filesystem drive",
+    );
+  return posixify(relative);
+}

package/src/lib/packer/pkg-runner.js

@@ -16,6 +16,10 @@ import path from "node:path";
 import { createRequire } from "node:module";
 import { PackError, EXIT } from "./errors.js";
 import executionBroker from "../process-execution-broker/index.js";
+import {
+  createPackerBuildPolicy,
+  PACKER_BUILD_TIMEOUT_MS,
+} from "../process-execution-broker/packer-build-policy.js";
 
 export const _deps = {
   spawnSync: (...args) => executionBroker.spawnSync(...args),
@@ -55,6 +59,9 @@ export function runPkg(ctx) {
     origin: "packer:pkg",
     scope: "pack",
     policy: "allow",
+    sandboxPolicy: createPackerBuildPolicy("packer:pkg"),
+    timeout: PACKER_BUILD_TIMEOUT_MS,
+    killSignal: "SIGKILL",
     shell: false,
     cwd: path.dirname(pkgConfigFile),
     stdio: "inherit",

package/src/lib/packer/pkg-targets.js

@@ -0,0 +1,83 @@
+// Only resolve the platform/architecture needed to admit helper assets. Loading
+// pkg's config module also loads pkg-fetch, whose Linux host probe runs ldd at
+// import time. Target admission must remain free of subprocess side effects.
+// Keep these token aliases aligned with the installed pkg parser via the
+// differential tests. Linux, Alpine and linuxstatic need the same static ELF.
+// ARM32 hosts require an explicit supported target architecture: unlike pkg,
+// admission never invokes uname to infer a different ABI from the kernel.
+const PLATFORMS = new Set([
+  "alpine",
+  "freebsd",
+  "linux",
+  "linuxstatic",
+  "macos",
+  "win",
+]);
+const ARCHITECTURES = new Set([
+  "x64",
+  "x86",
+  "armv7",
+  "arm64",
+  "ppc64",
+  "s390x",
+  "riscv64",
+  "loong64",
+]);
+const PLATFORM_ALIASES = new Map([
+  ["darwin", "macos"],
+  ["lin", "linux"],
+  ["mac", "macos"],
+  ["osx", "macos"],
+  ["win32", "win"],
+  ["windows", "win"],
+]);
+const ARCHITECTURE_ALIASES = new Map([
+  ["ia32", "x86"],
+  ["x86_64", "x64"],
+]);
+
+export function linuxSubreaperTargetArchitectures(
+  targets,
+  { platform = process.platform, arch = process.arch } = {},
+) {
+  if (
+    !Array.isArray(targets) ||
+    targets.length === 0 ||
+    targets.some(
+      (target) =>
+        typeof target !== "string" || !target.trim().replace(/-/g, ""),
+    )
+  ) {
+    throw new Error("Standalone builds require explicit nonempty pkg targets");
+  }
+  const architectures = new Set();
+  for (const rawTarget of targets) {
+    const target = rawTarget.trim();
+    let targetPlatform = PLATFORM_ALIASES.get(platform) || platform;
+    let targetArch = ARCHITECTURE_ALIASES.get(arch) || arch;
+    if (target !== "host") {
+      for (const token of target.split("-")) {
+        if (!token || token === "latest" || token.startsWith("node")) continue;
+        const resolvedPlatform = PLATFORM_ALIASES.get(token) || token;
+        if (PLATFORMS.has(resolvedPlatform)) {
+          targetPlatform = resolvedPlatform;
+          continue;
+        }
+        const resolvedArch = ARCHITECTURE_ALIASES.get(token) || token;
+        if (ARCHITECTURES.has(resolvedArch)) {
+          targetArch = resolvedArch;
+          continue;
+        }
+        throw new Error(`Unknown token '${token}' in '${target}'`);
+      }
+    }
+    if (!["linux", "alpine", "linuxstatic"].includes(targetPlatform)) continue;
+    if (targetArch !== "x64" && targetArch !== "arm64") {
+      throw new Error(
+        `Unsupported standalone Linux process supervision architecture: ${targetArch}`,
+      );
+    }
+    architectures.add(targetArch);
+  }
+  return [...architectures];
+}

package/src/lib/packer/web-panel-builder.js

@@ -12,6 +12,10 @@ import fs from "node:fs";
 import path from "node:path";
 import { PackError, EXIT } from "./errors.js";
 import executionBroker from "../process-execution-broker/index.js";
+import {
+  createPackerBuildPolicy,
+  PACKER_BUILD_TIMEOUT_MS,
+} from "../process-execution-broker/packer-build-policy.js";
 
 export const _deps = {
   spawnSync: (...args) => executionBroker.spawnSync(...args),
@@ -61,6 +65,9 @@ export function ensureWebPanel(ctx) {
       origin: "packer:web-panel-build",
       scope: "pack",
       policy: "allow",
+      sandboxPolicy: createPackerBuildPolicy("packer:web-panel-build"),
+      timeout: PACKER_BUILD_TIMEOUT_MS,
+      killSignal: "SIGKILL",
       shell: false,
       cwd: cliRoot,
       stdio: "inherit",

package/src/lib/permission-authority.js

@@ -1,16 +1,19 @@
 /** Resolve static settings plus CLI-owned workspace-scoped permission rules. */
 
 import settingsLoader from "./settings-loader.cjs";
+import persistentSettings from "./settings-permission-authority.cjs";
 import path from "node:path";
 import {
   ScopedPermissionStore,
   getScopedPermissionRevision,
   subscribeScopedPermissionRevision,
+  projectScopedPermissionObservation,
 } from "./scoped-permission-store.js";
 
 const {
   applyManagedPermissionPolicy,
-  loadSettings,
+  inspectSettingsSources,
+  projectSettingsObservation,
   getSettingsPermissionRevision,
   subscribeSettingsPermissionRevision,
 } = settingsLoader;
@@ -47,9 +50,14 @@ const combinedAuthority = Object.freeze({
 });
 
 function freezeSnapshot(value) {
-  if (value && typeof value === "object") {
-    for (const child of Object.values(value)) freezeSnapshot(child);
-    Object.freeze(value);
+  const pending = [value];
+  const seen = new WeakSet();
+  while (pending.length) {
+    const current = pending.pop();
+    if (!current || typeof current !== "object" || seen.has(current)) continue;
+    seen.add(current);
+    for (const child of Object.values(current)) pending.push(child);
+    Object.freeze(current);
   }
   return value;
 }
@@ -80,15 +88,41 @@ export function loadPermissionAuthority({
   env = process.env,
   baseRules = null,
   scopedStore = null,
+  settingsAuthority: persistentAuthority = null,
 } = {}) {
   const settingsRevision = getSettingsPermissionRevision();
   const scopedRevision = baseRules ? null : getScopedPermissionRevision();
-  const loaded = loadSettings({
-    cwd,
-    settingsFile,
-    managedSettingsFile,
-    env,
-  });
+  const persistent = persistentAuthority
+    ? persistentSettings.readSettingsPermissionAuthority(persistentAuthority)
+    : null;
+  if (persistentAuthority) {
+    const bound =
+      persistentSettings.settingsPermissionAuthorityOptions(
+        persistentAuthority,
+      );
+    if (
+      path.resolve(cwd) !== bound.cwd ||
+      (settingsFile &&
+        path.resolve(cwd, settingsFile) !== bound.settingsFile) ||
+      (managedSettingsFile &&
+        path.resolve(managedSettingsFile) !== bound.managedSettingsFile)
+    )
+      throw new TypeError("persistent settings authority options mismatch");
+  }
+  const settingsObservation =
+    persistent?.observation ||
+    inspectSettingsSources({
+      cwd,
+      settingsFile,
+      managedSettingsFile,
+      env,
+    });
+  const loaded = persistent
+    ? persistentSettings.projectSettingsPermissionObservation(
+        settingsObservation,
+        { env },
+      )
+    : projectSettingsObservation(settingsObservation, { env });
   const sources = baseRules ? {} : { ...loaded.sources };
   let rules = baseRules
     ? applyManagedPermissionPolicy(baseRules, loaded.managed, sources)
@@ -98,7 +132,29 @@ export function loadPermissionAuthority({
   // Explicit caller rules retain their historical replacement semantics.
   // Managed-only policy also suppresses every user-owned scoped grant.
   if (!baseRules) {
-    scoped = (scopedStore || new ScopedPermissionStore({ cwd })).list();
+    const bound = persistentAuthority
+      ? persistentSettings.settingsPermissionAuthorityOptions(
+          persistentAuthority,
+        )
+      : null;
+    const store =
+      scopedStore ||
+      new ScopedPermissionStore({
+        cwd,
+        ...(bound
+          ? {
+              filePath: bound.scopedFile,
+              settingsAuthority: persistentAuthority,
+            }
+          : {}),
+      });
+    scoped = persistent
+      ? projectScopedPermissionObservation(
+          store,
+          persistentAuthority,
+          persistent.scopedObservation,
+        )
+      : store.list();
     const managedOnly =
       loaded.managed?.allowManagedPermissionRulesOnly === true;
     scoped = {
@@ -136,6 +192,17 @@ export function loadPermissionAuthority({
     error.code = "CC_SCOPED_PERMISSION_AUTHORITY_CHANGED";
     throw error;
   }
+  if (
+    persistent &&
+    persistentSettings.readSettingsPermissionAuthority(persistentAuthority)
+      .snapshot !== persistent.snapshot
+  ) {
+    const error = new Error(
+      "persistent settings changed while permission authority was loading",
+    );
+    error.code = "CC_SETTINGS_PERMISSION_AUTHORITY_CHANGED";
+    throw error;
+  }
   return freezeSnapshot({
     ...loaded,
     rules,
@@ -143,12 +210,18 @@ export function loadPermissionAuthority({
     scoped,
     hasRules: hasRules(rules),
     settingsRevision,
+    settingsObservation,
+    ...(persistent ? { persistentSettingsRevision: persistent.snapshot } : {}),
     ...(scopedRevision ? { scopedRevision } : {}),
   });
 }
 
 export function createPermissionRulesProvider(options = {}) {
-  const cwd = path.resolve(options.cwd || process.cwd());
+  const persistentAuthority = options.settingsAuthority ?? null;
+  const bound = persistentAuthority
+    ? persistentSettings.settingsPermissionAuthorityOptions(persistentAuthority)
+    : null;
+  const cwd = path.resolve(options.cwd || bound?.cwd || process.cwd());
   const captured = Object.freeze({
     cwd,
     settingsFile: options.settingsFile
@@ -164,15 +237,86 @@ export function createPermissionRulesProvider(options = {}) {
       ? freezeSnapshot(cloneRules(options.baseRules))
       : null,
     scopedStore: options.scopedStore || null,
+    settingsAuthority: persistentAuthority,
   });
+  if (
+    bound &&
+    (cwd !== bound.cwd ||
+      (captured.settingsFile && captured.settingsFile !== bound.settingsFile) ||
+      (captured.managedSettingsFile &&
+        captured.managedSettingsFile !== bound.managedSettingsFile))
+  )
+    throw new TypeError("persistent settings authority options mismatch");
   const provider = () => loadPermissionAuthority(captured);
+  const localAuthority = captured.baseRules
+    ? settingsAuthority
+    : combinedAuthority;
   providers.set(
     provider,
-    captured.baseRules ? settingsAuthority : combinedAuthority,
+    persistentAuthority
+      ? persistentProviderAuthority(persistentAuthority, localAuthority)
+      : localAuthority,
   );
   return Object.freeze(provider);
 }
 
+function persistentProviderAuthority(binding, localAuthority) {
+  let last = null;
+  function getSnapshot() {
+    const local = localAuthority.getSnapshot();
+    const durable =
+      persistentSettings.readSettingsPermissionAuthority(binding).snapshot;
+    if (last?.local !== local || last?.durable !== durable)
+      last = Object.freeze({ local, durable });
+    return last;
+  }
+  return Object.freeze({
+    getSnapshot,
+    assertWorkspace(cwd) {
+      if (
+        path.resolve(cwd) !==
+        persistentSettings.settingsPermissionAuthorityOptions(binding).cwd
+      )
+        throw Object.assign(
+          new Error("persistent permission authority workspace mismatch"),
+          { code: "CC_SETTINGS_AUTHORITY_BINDING_CHANGED" },
+        );
+    },
+    assertWritableRoots(roots) {
+      persistentSettings.assertSettingsPermissionWritableRoots(binding, roots);
+    },
+    subscribePolicyRevision(listener) {
+      if (typeof listener !== "function")
+        throw new TypeError("permission revision listener must be a function");
+      let known = getSnapshot();
+      const remove = localAuthority.subscribePolicyRevision(listener);
+      // Persistence prevents official ABA loss between polls. Timers provide
+      // bounded observation, not a promise that another process has stopped
+      // before synchronous addRule returns.
+      const timer = setInterval(() => {
+        let next;
+        try {
+          next = getSnapshot();
+        } catch {
+          next = null;
+        }
+        if (next === known) return;
+        known = next;
+        try {
+          listener(next);
+        } catch {
+          /* isolate observers */
+        }
+      }, 100);
+      timer.unref?.();
+      return () => {
+        clearInterval(timer);
+        remove();
+      };
+    },
+  });
+}
+
 // A legacy callback cannot advertise a trusted revision subscription simply
 // by copying properties onto itself. It still receives sampled revalidation.
 export function permissionRulesProviderAuthority(provider) {