@cnwenf/occ 2.1.341 → 2.1.342

package/README.md

@@ -5,7 +5,7 @@
 [![npm version](https://img.shields.io/npm/v/@cnwenf/occ.svg)](https://www.npmjs.com/package/@cnwenf/occ)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 [![Runtime: Bun](https://img.shields.io/badge/Runtime-Bun-%23000000.svg)](https://bun.sh/)
-[![Tracks: Claude Code 2.1.274](https://img.shields.io/badge/Tracks-Claude%20Code%202.1.274-blueviolet.svg)](https://docs.anthropic.com/en/docs/claude-code)
+[![Tracks: Claude Code 2.1.276](https://img.shields.io/badge/Tracks-Claude%20Code%202.1.276-blueviolet.svg)](https://docs.anthropic.com/en/docs/claude-code)
 
 [简体中文](./README.zh-CN.md) · **English**
 
@@ -13,7 +13,7 @@
 
 ## What is OCC
 
-**Open C Code (OCC)** is an open-source coding agent. Its capabilities are aligned with [Claude Code](https://docs.anthropic.com/en/docs/claude-code) (currently tracking `2.1.274` — 2.1.270 fully aligned; 2.1.271–2.1.274 partial: the latest OCC-127 round landed the 2.1.274 MCP auth-stub description secret-leak fix — the byte-verified display-sanitizer family (NFKC + invisible-character stripping, quote/angle-bracket neutralization, bearer/token-family redaction, code-point-safe truncation) with the origin-only unexpanded endpoint — and confirmed NO-OP with behavioral tests for the 2.1.274 bash special-variable assignment/loop and worktree nested-expansion hardening (OCC's existing guards already ask/refuse every risky vector, byte-verified parity with the official); prior rounds landed the 2.1.273 gateway-hint request headers (default on for the first-party api.anthropic.com endpoint, off for third-party/custom endpoints; tri-bool `CLAUDE_CODE_GATEWAY_HINT_HEADERS` override), the spinner doubled-ellipsis guard, the shell-mode `!` insert fix, and the subshell-hidden dangerous-`rm` bypass fix (per-segment analysis in the always-on catastrophic-rm deny guard), per `docs/upstream-version-gap-occ127.md`; remaining 2.1.273/2.1.274 entries are triaged there as NO-OP (surfaces OCC trims) or STAGED (per-site forensics needed); still not landed from the 2.1.270→2.1.272 delta: `/config` panel fullscreen mouse support (PORTABLE-LARGE scope) and the spinner status ladder "deep in thought"/"picking the thought back up" (STAGED), plus the pre-existing sandbox per-command `allowed_domains` gap; prior alignment through 2.1.270 landed via OCC-122/OCC-123/OCC-84/OCC-124/OCC-85/OCC-125/OCC-126). The code is fully open, auditable, backdoor-free, and your data stays under your control.
+**Open C Code (OCC)** is an open-source coding agent. Its capabilities are aligned with [Claude Code](https://docs.anthropic.com/en/docs/claude-code) (currently tracking `2.1.276` — 2.1.276 fully aligned; 2.1.271–2.1.275 partial: the latest OCC-90 round landed the byte-verified 2.1.276 advisor proxy-400 fix — advisor-model resolution now gated on a first-party `ANTHROPIC_BASE_URL` (official module #489 `!Ia()||` gate), the growthbook experiment key corrected to `tengu_sage_compass2`, strict firstParty advisor enablement with the `CLAUDE_CODE_ENABLE_EXPERIMENTAL_ADVISOR_TOOL` env override and the `_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL` arm — plus removal of the dead `src/services/api/src/` stub tree and a full 96-entry triage of 2.1.275, per `docs/upstream-version-gap-occ129.md`; prior rounds landed the 2.1.274 MCP auth-stub description secret-leak fix (byte-verified display-sanitizer family port) with NO-OP behavioral verification of the 2.1.274 bash special-variable and worktree nested-expansion hardening (OCC-127), the 2.1.273 gateway-hint request headers, the spinner doubled-ellipsis guard, the shell-mode `!` insert fix, and the subshell-hidden dangerous-`rm` bypass fix, per `docs/upstream-version-gap-occ127.md`; still not landed from the 2.1.270→2.1.272 delta: `/config` panel fullscreen mouse support (PORTABLE-LARGE) and the spinner status ladder (STAGED), plus the pre-existing sandbox per-command `allowed_domains` gap; prior alignment through 2.1.270 landed via OCC-122/OCC-123/OCC-84/OCC-124/OCC-85/OCC-125/OCC-126). The code is fully open, auditable, backdoor-free, and your data stays under your control.
 
 If you worry that a closed-source CLI might hide backdoors, or that your code and credentials are uploaded to unauditable services, OCC is for you: all source is open and unobfuscated, the build is reproducible from source, and API credentials are sent only to endpoints you configure.
 
@@ -62,7 +62,7 @@ Requires a valid Anthropic API Key (or AWS Bedrock / Google Vertex / Azure Found
 | **Auditability** | Line-by-line reviewable | No |
 | **Telemetry** | Minimal (analytics stubbed) | Standard |
 | **Data sovereignty** | Credentials stay on your machine; requests only to endpoints you configure | Anthropic endpoints |
-| **Capability parity** | Tracks CC `2.1.274` (2.1.270 fully aligned; 2.1.271–2.1.274 partial) | Reference implementation |
+| **Capability parity** | Tracks CC `2.1.276` (2.1.276 fully aligned; 2.1.271–2.1.275 partial) | Reference implementation |
 | **Providers** | Anthropic Direct, Bedrock, Vertex, Azure | Anthropic, Bedrock, Vertex |
 | **Cost** | Free & open-source (MIT) | Subscription |
 | **Build** | Reproducible from source | N/A |
@@ -143,7 +143,7 @@ Requires [Bun](https://bun.sh/) >= 1.3.11 (use `bun upgrade` — older Bun cause
 
 ```bash
 bun install
-bun run dev          # run from source; version prints 2.1.274 (dev polyfill; build overrides with pkg.version) when working
+bun run dev          # run from source; version prints 2.1.276 (dev polyfill; build overrides with pkg.version) when working
 bun run build        # output: dist/cli.js (~26 MB, single-file bundle)
 bun test             # test suite (Bun test runner)
 bun run lint         # Biome lint (formatter disabled to avoid large diffs)
@@ -157,7 +157,7 @@ For architecture, entry/bootstrap, tool system, UI layer, and module-status deta
 
 ## Status
 
-- Tracks Claude Code **`2.1.274`** (2.1.270 fully aligned; 2.1.271–2.1.274 partial — the latest OCC-127 round landed the 2.1.274 MCP auth-stub description secret-leak fix (byte-verified display-sanitizer family port) and verified the 2.1.274 bash special-variable and worktree nested-expansion hardening as NO-OP with behavioral tests; prior rounds landed the 2.1.273 gateway-hint request headers, the spinner doubled-ellipsis guard, the shell-mode `!` insert fix, and the subshell-hidden dangerous-`rm` bypass fix — see `docs/upstream-version-gap-occ127.md`; remaining 2.1.273/2.1.274 entries are triaged there as NO-OP or STAGED; still not landed from the 2.1.270→2.1.272 delta: `/config` fullscreen mouse support (PORTABLE-LARGE) and the spinner status ladder (STAGED), plus the pre-existing sandbox per-command `allowed_domains` gap; prior alignment through 2.1.270 landed via OCC-122/OCC-123/OCC-84, OCC-124 + OCC-85, OCC-125, and OCC-126 — see `docs/upstream-version-gap-occ124.md`, `docs/upstream-version-gap-occ125.md`, and `docs/upstream-version-gap-occ126.md`).
+- Tracks Claude Code **`2.1.276`** (2.1.276 fully aligned; 2.1.271–2.1.275 partial — the latest OCC-90 round landed the byte-verified 2.1.276 advisor proxy-400 fix (first-party `ANTHROPIC_BASE_URL` gate on advisor resolution, `tengu_sage_compass2` growthbook key, strict firstParty enablement, `_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL` arm) and removed the dead `src/services/api/src/` stub tree — see `docs/upstream-version-gap-occ129.md`; prior rounds landed the 2.1.274 MCP auth-stub description secret-leak fix with NO-OP verification of the bash special-variable and worktree nested-expansion hardening (OCC-127, `docs/upstream-version-gap-occ127.md`), the 2.1.273 gateway-hint request headers, the spinner doubled-ellipsis guard, the shell-mode `!` insert fix, and the subshell-hidden dangerous-`rm` bypass fix; still not landed from the 2.1.270→2.1.272 delta: `/config` fullscreen mouse support (PORTABLE-LARGE) and the spinner status ladder (STAGED), plus the pre-existing sandbox per-command `allowed_domains` gap; prior alignment through 2.1.270 landed via OCC-122/OCC-123/OCC-84, OCC-124 + OCC-85, OCC-125, and OCC-126 — see `docs/upstream-version-gap-occ124.md`, `docs/upstream-version-gap-occ125.md`, and `docs/upstream-version-gap-occ126.md`).
 - Published to npm as [`@cnwenf/occ`](https://www.npmjs.com/package/@cnwenf/occ).
 - Many modules are intentionally stubbed or feature-flagged off — see "Disabled / stubbed" above.
 

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-globalThis.MACRO={"VERSION":"2.1.341","BINARY_NAME":"occ","BUILD_TIME":"2026-09-18T01:06:37.948Z","FEEDBACK_CHANNEL":"","ISSUES_EXPLAINER":"","NATIVE_PACKAGE_URL":"","PACKAGE_URL":"@cnwenf/occ","VERSION_CHANGELOG":""};
+globalThis.MACRO={"VERSION":"2.1.342","BINARY_NAME":"occ","BUILD_TIME":"2026-09-18T19:34:48.042Z","FEEDBACK_CHANNEL":"","ISSUES_EXPLAINER":"","NATIVE_PACKAGE_URL":"","PACKAGE_URL":"@cnwenf/occ","VERSION_CHANGELOG":""};
 // @bun
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
@@ -96737,6 +96737,9 @@ function getAPIProviderForStatsig() {
   return getAPIProvider();
 }
 function isFirstPartyAnthropicBaseUrl() {
+  if (isEnvTruthy(process.env._CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL)) {
+    return true;
+  }
   const baseUrl = process.env.ANTHROPIC_BASE_URL;
   if (!baseUrl) {
     return true;
@@ -264309,15 +264312,21 @@ function isAdvisorBlock(param) {
   return param.type === "advisor_tool_result" || param.type === "server_tool_use" && param.name === "advisor";
 }
 function getAdvisorConfig() {
-  return getFeatureValue_CACHED_MAY_BE_STALE("tengu_sage_compass", {});
+  return getFeatureValue_CACHED_MAY_BE_STALE("tengu_sage_compass2", {});
 }
 function isAdvisorEnabled() {
   if (isEnvTruthy(process.env.CLAUDE_CODE_DISABLE_ADVISOR_TOOL)) {
     return false;
   }
-  if (!shouldIncludeFirstPartyOnlyBetas()) {
+  if (getAPIProvider() !== "firstParty") {
+    return false;
+  }
+  if (isEnvTruthy(process.env.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS)) {
     return false;
   }
+  if (isEnvTruthy(process.env.CLAUDE_CODE_ENABLE_EXPERIMENTAL_ADVISOR_TOOL)) {
+    return true;
+  }
   return getAdvisorConfig().enabled ?? false;
 }
 function canUserConfigureAdvisor() {
@@ -264366,8 +264375,8 @@ Give the advice serious weight. If you follow a step and it fails empirically, o
 If you've already retrieved data pointing one way and the advisor points another: don't silently switch. Surface the conflict in one more advisor call -- "I found X, you suggest Y, which constraint breaks the tie?" The advisor saw your evidence but may have underweighted it; a reconcile call is cheaper than committing to the wrong branch.`;
 var init_advisor = __esm(() => {
   init_growthbook();
-  init_betas2();
   init_envUtils();
+  init_providers();
   init_settings2();
 });
 
@@ -634936,7 +634945,7 @@ async function* queryModel(messages, systemPrompt, thinkingConfig, tools, signal
     betas.push(ADVISOR_BETA_HEADER);
   }
   let advisorModel;
-  if (isAgenticQuery && isAdvisorEnabled()) {
+  if (isAgenticQuery && isAdvisorEnabled() && isFirstPartyAnthropicBaseUrl()) {
     let advisorOption = options.advisorModel;
     const advisorExperiment = getExperimentAdvisorModels();
     if (advisorExperiment !== undefined) {
@@ -832330,7 +832339,7 @@ var _FEATURE_ALLOWLIST = new Set([
 var feature2 = (name3) => _FEATURE_ALLOWLIST.has(name3);
 if (typeof globalThis.MACRO === "undefined") {
   globalThis.MACRO = {
-    VERSION: "2.1.274",
+    VERSION: "2.1.276",
     BINARY_NAME: "occ",
     BUILD_TIME: new Date().toISOString(),
     FEEDBACK_CHANNEL: "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cnwenf/occ",
-  "version": "2.1.341",
+  "version": "2.1.342",
   "license": "MIT",
   "type": "module",
   "bin": {