ccqa 1.42.1 → 1.43.0

package/dist/bin/ccqa.mjs

@@ -872,6 +872,35 @@ async function runPool(items, concurrency, fn, opts = {}) {
 	return results;
 }
 //#endregion
+//#region src/claude/env-keys.ts
+/**
+* Variables that carry a credential the Claude Code process can use on its
+* own, with no login on the host: an API key, a gateway bearer token, or a
+* subscription token from `claude setup-token`.
+*/
+const CREDENTIAL_ENV_KEYS = [
+	"ANTHROPIC_API_KEY",
+	"ANTHROPIC_AUTH_TOKEN",
+	"CLAUDE_CODE_OAUTH_TOKEN"
+];
+/**
+* Standard Claude Code environment variables that select the API endpoint and
+* credentials. ccqa forwards whichever of these are set to the underlying
+* Claude Code process; it does not read or interpret their values.
+*
+* - `ANTHROPIC_BASE_URL`      — the API endpoint to send requests to.
+* - `ANTHROPIC_AUTH_TOKEN`    — sent as `Authorization: Bearer <token>`.
+* - `ANTHROPIC_API_KEY`       — API key, when used instead of a token.
+* - `ANTHROPIC_CUSTOM_HEADERS` — extra request headers.
+* - `CLAUDE_CODE_OAUTH_TOKEN` — long-lived subscription token from
+*   `claude setup-token`, the headless-CI counterpart of a login.
+*/
+const ENDPOINT_ENV_KEYS = [
+	"ANTHROPIC_BASE_URL",
+	"ANTHROPIC_CUSTOM_HEADERS",
+	...CREDENTIAL_ENV_KEYS
+];
+//#endregion
 //#region src/drift/auth.ts
 /**
 * Claude Code can also run against AWS Bedrock / Google Vertex AI, selected by
@@ -889,21 +918,20 @@ function cloudProviderEnabled() {
 }
 /**
 * Probe whether the host has any credential the Anthropic SDK can pick up:
-*   1. ANTHROPIC_API_KEY env var (CI / scripted use)
-*   2. CLAUDE_CODE_OAUTH_TOKEN env var (a long-lived subscription token from
-*      `claude setup-token`, the headless-CI counterpart of a login)
-*   3. CLAUDE_CODE_USE_BEDROCK / CLAUDE_CODE_USE_VERTEX (cloud-provider
-*      endpoints authenticated by the cloud SDK's credential chain)
-*   4. ~/.claude/.credentials.json (Claude Code login, file-based platforms)
-*   5. macOS Keychain item "Claude Code-credentials" (Claude Code login on
-*      darwin stores the OAuth credentials in the Keychain, not on disk)
+*   - one of CREDENTIAL_ENV_KEYS (API key, gateway bearer token, or the
+*     subscription token from `claude setup-token`)
+*   - CLAUDE_CODE_USE_BEDROCK / CLAUDE_CODE_USE_VERTEX (cloud-provider
+*     endpoints authenticated by the cloud SDK's credential chain)
+*   - ~/.claude/.credentials.json (Claude Code login, file-based platforms)
+*   - macOS Keychain item "Claude Code-credentials" (Claude Code login on
+*     darwin stores the OAuth credentials in the Keychain, not on disk)
 *
 * Claude-driven hooks are opt-in, so the caller only consults this after the
 * user has asked for analysis. We never throw — auth absence is a normal flow
 * that surfaces as "analysis skipped".
 */
 function driftAuthAvailable() {
-	for (const key of ["ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"]) {
+	for (const key of CREDENTIAL_ENV_KEYS) {
 		const value = process.env[key];
 		if (typeof value === "string" && value.length > 0) return { ok: true };
 	}
@@ -912,7 +940,7 @@ function driftAuthAvailable() {
 	if (process.platform === "darwin" && keychainHasClaudeCredentials()) return { ok: true };
 	return {
 		ok: false,
-		reason: "no ANTHROPIC_API_KEY / CLAUDE_CODE_OAUTH_TOKEN / Bedrock or Vertex env / claude login"
+		reason: `no ${CREDENTIAL_ENV_KEYS.join(" / ")} / Bedrock or Vertex env / claude login`
 	};
 }
 /**
@@ -1520,31 +1548,17 @@ function sum(costs) {
 }
 //#endregion
 //#region src/claude/invoke.ts
+/** The built-in tools an allow-list names: `Bash(*)` is `Bash`; `mcp__*` are not built-ins. */
+function builtinToolNames(allowedTools) {
+	const names = allowedTools.map((entry) => entry.replace(/\(.*\)$/, "")).filter((name) => !name.startsWith("mcp__"));
+	return [...new Set(names)];
+}
 function resolveModel(explicit) {
 	if (explicit) return explicit;
 	const envModel = process.env["CCQA_MODEL"];
 	return envModel && envModel.length > 0 ? envModel : void 0;
 }
 /**
-* Standard Claude Code environment variables that select the API endpoint and
-* credentials. ccqa forwards whichever of these are set to the underlying
-* Claude Code process; it does not read or interpret their values.
-*
-* - `ANTHROPIC_BASE_URL`      — the API endpoint to send requests to.
-* - `ANTHROPIC_AUTH_TOKEN`    — sent as `Authorization: Bearer <token>`.
-* - `ANTHROPIC_API_KEY`       — API key, when used instead of a token.
-* - `ANTHROPIC_CUSTOM_HEADERS` — extra request headers.
-* - `CLAUDE_CODE_OAUTH_TOKEN` — long-lived subscription token from
-*   `claude setup-token`, the headless-CI counterpart of a login.
-*/
-const ENDPOINT_ENV_KEYS = [
-	"ANTHROPIC_BASE_URL",
-	"ANTHROPIC_AUTH_TOKEN",
-	"ANTHROPIC_API_KEY",
-	"ANTHROPIC_CUSTOM_HEADERS",
-	"CLAUDE_CODE_OAUTH_TOKEN"
-];
-/**
 * When both credentials are present the OAuth token wins and the API key is
 * dropped. Left to the CLI the API key would win, which makes "switch a CI
 * job to the subscription token" require unwiring the key everywhere; with
@@ -1556,21 +1570,6 @@ function preferOauthToken(env) {
 	if (env["CLAUDE_CODE_OAUTH_TOKEN"]) delete env["ANTHROPIC_API_KEY"];
 }
 /**
-* Collects the endpoint/auth variables set in the current process environment
-* so they can be forwarded, verbatim, to every Claude Code invocation. Returns
-* only the keys that are actually set (non-empty), so unset variables never
-* override the SDK's own defaults. Credential precedence per preferOauthToken.
-*/
-function resolveEndpointEnv() {
-	const endpointEnv = {};
-	for (const key of ENDPOINT_ENV_KEYS) {
-		const value = process.env[key];
-		if (value && value.length > 0) endpointEnv[key] = value;
-	}
-	preferOauthToken(endpointEnv);
-	return endpointEnv;
-}
-/**
 * Drop endpoint variables that are present but empty, so an empty value never
 * reaches the Claude Code process as an override. "Set to nothing" is how a
 * caller that cannot omit the key says "use the default" — a CI job wiring
@@ -1591,18 +1590,14 @@ function withoutEmptyEndpointVars(env) {
 * resolved view: left to the CLI the API key would win, silently moving every
 * call from the subscription to metered billing when a CI job wires both
 * (which is exactly what happened before this function existed).
-*
-* Returns undefined when no endpoint variable is set and the caller passes no
-* env, so the SDK keeps its own default environment.
 */
 function buildInvocationEnv(env) {
-	const hasEndpointEnv = Object.keys(resolveEndpointEnv()).length > 0;
-	if (!env && !hasEndpointEnv) return void 0;
 	const merged = withoutEmptyEndpointVars({
 		...process.env,
 		...env
 	});
 	preferOauthToken(merged);
+	merged["CLAUDE_CODE_DISABLE_AUTO_MEMORY"] = "1";
 	return merged;
 }
 let nativeBinaryWarned = false;
@@ -1624,7 +1619,7 @@ function formatDuration$1(ms) {
 	return `${minutes} minute${minutes === 1 ? "" : "s"}`;
 }
 async function invokeClaudeStreaming(options, onEvent) {
-	const { prompt, systemPrompt, allowedTools, disableBuiltinTools = false, disableThinking = false, mcpServers, maxTurns, timeoutMs, env, model, cwd, onAbAction, onAbActionFailed, silenceBashLog = false, envScrubMap = [], relaxAbConstraints = false } = options;
+	const { prompt, systemPrompt, allowedTools, disableThinking = false, mcpServers, maxTurns, timeoutMs, env, model, cwd, onAbAction, onAbActionFailed, silenceBashLog = false, envScrubMap = [], relaxAbConstraints = false } = options;
 	const resolvedModel = resolveModel(model);
 	const mergedEnv = buildInvocationEnv(env);
 	const abortController = new AbortController();
@@ -1637,15 +1632,17 @@ async function invokeClaudeStreaming(options, onEvent) {
 	const sdkOptions = {
 		systemPrompt,
 		maxTurns,
-		allowedTools: allowedTools ?? ["Bash(*)"],
+		allowedTools,
+		tools: builtinToolNames(allowedTools),
+		strictMcpConfig: true,
+		settingSources: [],
 		permissionMode: "bypassPermissions",
 		allowDangerouslySkipPermissions: true,
 		abortController,
 		...resolvedModel ? { model: resolvedModel } : {},
 		...cwd ? { cwd } : {},
-		...mergedEnv ? { env: mergedEnv } : {},
+		env: mergedEnv,
 		...mcpServers ? { mcpServers } : {},
-		...disableBuiltinTools ? { tools: [] } : {},
 		...disableThinking ? { thinking: { type: "disabled" } } : {},
 		hooks: onAbAction || onAbActionFailed ? {
 			PreToolUse: [{ hooks: [async (input) => {
@@ -1774,8 +1771,9 @@ function extractInvocationCost(msg) {
 	const usage = m["usage"];
 	const modelUsage = m["modelUsage"];
 	const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : null;
+	const models = modelUsage && typeof modelUsage === "object" ? Object.keys(modelUsage) : [];
 	return {
-		totalCostUsd: num(m["total_cost_usd"]),
+		totalCostUsd: pricedForClaude(models) ? num(m["total_cost_usd"]) : null,
 		durationMs: num(m["duration_ms"]),
 		durationApiMs: num(m["duration_api_ms"]),
 		numTurns: num(m["num_turns"]),
@@ -1783,9 +1781,16 @@ function extractInvocationCost(msg) {
 		cacheCreationInputTokens: num(usage?.["cache_creation_input_tokens"]),
 		cacheReadInputTokens: num(usage?.["cache_read_input_tokens"]),
 		outputTokens: num(usage?.["output_tokens"]),
-		models: modelUsage && typeof modelUsage === "object" ? Object.keys(modelUsage) : []
+		models
 	};
 }
+/**
+* The SDK prices an unknown model id at a default Claude rate rather than
+* returning null, so a self-hosted model would report dollars nobody is billed.
+*/
+function pricedForClaude(models) {
+	return models.every((id) => /claude/i.test(id));
+}
 const BLOCKED_AB_SUBCOMMANDS = new Set([
 	"eval",
 	"js",
@@ -5015,12 +5020,11 @@ const DraftNamingSchema = z.object({
 * Returns null only when the invocation reported nothing at all (a mock run,
 * an SDK error, or a command that never called a model).
 *
-* The price is one segment among several, not a precondition. An endpoint the
-* SDK has no pricing table for — any Anthropic-compatible gateway in front of
-* a third-party model — reports usage but no `total_cost_usd`, and dropping
-* the whole line there would hide real consumption behind silence. Tokens come
-* from the API response rather than a price list, so they survive that case
-* and become the signal to read.
+* The price is one segment among several, not a precondition. A model that is
+* not a Claude model has no price (`extractInvocationCost` drops the SDK's
+* estimate), and dropping the whole line there would hide real consumption
+* behind silence. Tokens come from the API response rather than a price list,
+* so they survive that case and become the signal to read.
 *
 * `compact: false` (default for CLI logs) keeps raw numbers and adds a
 * `model=...` segment. `compact: true` (HTML chip) thousand-separates fresh
@@ -6353,6 +6357,14 @@ function resolveCovered(prepared, ranges) {
 const VENDOR = /(^|\/)node_modules\//;
 /** `(rsc)`, `(pages-dir-browser)`, ... — which build layer, not part of the path. */
 const LAYER = /^\([^)]*\)\//;
+/**
+* What follows `[project]/` is relative to the build's project root, not to
+* where the build ran. Only this one root is stripped: Turbopack's others
+* (`[output]`, `[externals]`) name generated code, not files on disk.
+*/
+const TURBOPACK_PROJECT = /^\[project\]\//;
+/** The ` [layer] (ecmascript)` suffix Turbopack appends when it names a module. */
+const MODULE_IDENTIFIER = / \[[^\]]*\]/;
 const DEPENDENCY = { kind: "dependency" };
 const UNRESOLVED = { kind: "unresolved" };
 /** `absolute` as a posix path under `root`, or undefined when it is not under it. */
@@ -6371,9 +6383,12 @@ function normalizeSourcePath(raw, roots) {
 		path = slash < 0 ? afterScheme : afterScheme.slice(from);
 	}
 	path = posix.normalize(path.replace(LAYER, ""));
+	const rooted = TURBOPACK_PROJECT.test(path);
+	if (rooted) path = path.replace(TURBOPACK_PROJECT, "");
 	if (path === "" || path === ".") return UNRESOLVED;
 	if (path.startsWith("<") || path.startsWith("[")) return UNRESOLVED;
-	const absolute = path.startsWith("/") ? path : resolve(roots.base, path);
+	if (rooted && MODULE_IDENTIFIER.test(path)) return UNRESOLVED;
+	const absolute = path.startsWith("/") ? path : resolve(rooted ? roots.root : roots.base, path);
 	const rel = toProjectRelative(roots.root, absolute);
 	if (rel === void 0) return UNRESOLVED;
 	return VENDOR.test(rel) ? DEPENDENCY : {
@@ -6575,18 +6590,14 @@ var FrontendResolution = class {
 	* nearly all of them misses on a deployment that pushes nothing.
 	*/
 	sourceMapLoaders(script, source) {
-		const loaders = [];
 		const reference = readSourceMappingUrl(source);
-		if (reference !== void 0) {
-			const inline = decodeInlineSourceMap(reference);
-			if (inline !== void 0) loaders.push(() => Promise.resolve(inline));
-			else {
-				const target = absoluteOrUndefined(reference, script.url);
-				if (target !== void 0) loaders.push(() => this.fetchText(target));
-			}
-		}
+		const inline = reference === void 0 ? void 0 : decodeInlineSourceMap(reference);
+		const mapUrl = reference !== void 0 && inline === void 0 ? absoluteOrUndefined(reference, script.url) : void 0;
+		const loaders = [];
+		if (inline !== void 0) loaders.push(() => Promise.resolve(inline));
+		if (mapUrl !== void 0) loaders.push(() => this.fetchText(mapUrl));
 		const stored = this.fetchStoredMap;
-		if (stored !== void 0) loaders.push(() => stored(script.url));
+		if (stored !== void 0) loaders.push(() => stored(mapUrl ?? script.url, script.url));
 		return loaders;
 	}
 };
@@ -7191,7 +7202,7 @@ var Engine = class {
 			coverageDir: opts.coverageDir,
 			roots: opts.roots,
 			fetchText: (url) => this.fetchThroughBrowser(url),
-			fetchStoredMap: (scriptUrl) => this.storedMapFor(scriptUrl),
+			fetchStoredMap: (mapUrl, scriptUrl) => this.storedMapFor(mapUrl, scriptUrl),
 			warn: opts.warn
 		});
 	}
@@ -7458,19 +7469,24 @@ var Engine = class {
 		}
 	}
 	/**
-	* The map a deploy stored for `scriptUrl`, if this run knows where to ask.
+	* The map a deploy stored for a script, if this run knows where to ask.
 	* Addressed by the path under the asset origin rather than the URL, so the
 	* push and the read agree without either knowing the other's host.
+	*
+	* The script's pointer names the map, but it may name it somewhere this run
+	* never declared — a map-only host. Guessing from the script is worse than
+	* the pointer and better than not asking, so it stays as the fallback.
 	*/
-	async storedMapFor(scriptUrl) {
+	async storedMapFor(mapUrl, scriptUrl) {
 		const stored = this.opts.fetchStoredSourceMap;
 		if (stored === void 0) return void 0;
-		const assetPath = assetPathOf(scriptUrl, [...this.opts.origins, ...this.opts.assetOrigins ?? []]);
-		if (assetPath === void 0) return void 0;
+		const origins = [...this.opts.origins, ...this.opts.assetOrigins ?? []];
+		const key = storeKeyOf(mapUrl, origins) ?? storeKeyOf(scriptUrl, origins);
+		if (key === void 0) return void 0;
 		try {
-			return await stored(`${assetPath}.map`);
+			return await stored(key);
 		} catch (err) {
-			this.opts.warn(`could not read the stored source map for ${assetPath}: ${message(err)}`);
+			this.opts.warn(`could not read the stored source map for ${key}: ${message(err)}`);
 			return;
 		}
 	}
@@ -7494,6 +7510,16 @@ function message(error) {
 * is part of what the browser asked for, so the push has to have used it too.
 * A URL from an origin the run never declared is not ours to look up.
 */
+/**
+* The key a stored map is read by: the asset path, with `.map` appended only
+* when it is missing. A push files each map under its own path, so a URL that
+* already names a map needs no suffix; only a script URL has to guess one.
+*/
+function storeKeyOf(url, origins) {
+	const assetPath = assetPathOf(url, origins);
+	if (assetPath === void 0) return void 0;
+	return assetPath.endsWith(".map") ? assetPath : `${assetPath}.map`;
+}
 function assetPathOf(url, origins) {
 	let parsed;
 	try {
@@ -13507,7 +13533,6 @@ async function runLiveExecutor(input) {
 				prompt: buildStepVerdictPrompt(step, transcript),
 				model: input.model,
 				allowedTools: [],
-				disableBuiltinTools: true,
 				disableThinking: true,
 				maxTurns: 1,
 				timeoutMs: VERDICT_TIMEOUT_MS
@@ -14682,7 +14707,7 @@ async function cleanupActions$1(actions, model) {
 	try {
 		const { result, isError } = await invokeClaudeStreaming({
 			prompt: buildCleanupPrompt(actions),
-			disableBuiltinTools: true,
+			allowedTools: [],
 			maxTurns: 1,
 			model
 		}, () => {});
@@ -16611,7 +16636,6 @@ async function updateAgentPrompt(args) {
 			prompt: userPrompt,
 			systemPrompt,
 			allowedTools: [],
-			disableBuiltinTools: true,
 			disableThinking: true,
 			...model ? { model } : {}
 		}, () => {});
@@ -30591,7 +30615,6 @@ function createLearningWorker(deps) {
 			prompt: buildLearningUserPrompt(cases.slice(0, LEARNING_MAX_CASES)),
 			systemPrompt: LEARNING_SYSTEM_PROMPT,
 			allowedTools: [],
-			disableBuiltinTools: true,
 			maxTurns: 1
 		}, () => {});
 		const guidance = result?.trim();

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.42.1",
+  "version": "1.43.0",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.42.1",
+  "version": "1.43.0",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {