chainlesschain 0.162.124 → 0.162.126

package/src/harness/jsonl-session-store.js

@@ -21,7 +21,32 @@ function getSessionsDir() {
   return dir;
 }
 
+/**
+ * A session id must be a single safe path segment. Ids are generated as
+ * `session-<ts>-<hex>`, but also arrive from CLI args (`cc agent --resume <id>`,
+ * `cc insights <id>`, `cc session show <id>`), so an id like `../../etc/x` would
+ * otherwise let sessionPath() read / append / delete a .jsonl OUTSIDE the
+ * sessions dir. Reject any separator or `..` (mirrors goal-store's
+ * isUnsafeGoalId / FileUploadService.isUnsafeSegment).
+ */
+export function isUnsafeSessionId(id) {
+  return (
+    id == null ||
+    id === "" ||
+    typeof id !== "string" ||
+    id.includes("/") ||
+    id.includes("\\") ||
+    id.includes("..")
+  );
+}
+
 export function sessionPath(sessionId) {
+  // Fail closed for path building: every write/delete goes through here, so a
+  // traversal id can never escape the sessions dir. Reads guard separately and
+  // degrade to not-found instead of throwing.
+  if (isUnsafeSessionId(sessionId)) {
+    throw new Error(`unsafe session id: ${String(sessionId).slice(0, 60)}`);
+  }
   return join(getSessionsDir(), `${sessionId}.jsonl`);
 }
 
@@ -69,6 +94,7 @@ export function appendCompactEvent(sessionId, stats) {
 }
 
 export function readEvents(sessionId) {
+  if (isUnsafeSessionId(sessionId)) return []; // traversal id → treat as empty
   const filePath = sessionPath(sessionId);
   if (!existsSync(filePath)) return [];
 
@@ -87,20 +113,36 @@ export function readEvents(sessionId) {
   return events;
 }
 
+/**
+ * A replayable chat message must be a `{ role, content }` object — guard
+ * against a corrupt / partially-written / hand-edited event whose `data` is
+ * missing, null, or not a message (it would otherwise inject `undefined` into
+ * the resumed history and break the next LLM request).
+ */
+function isReplayableMessage(m) {
+  return Boolean(m) && typeof m === "object" && typeof m.role === "string";
+}
+
 export function rebuildMessages(sessionId) {
   const events = readEvents(sessionId);
   const messages = [];
   let lastCompactIndex = -1;
 
+  // A `compact` event carries the pre-compaction snapshot in data.messages. A
+  // malformed compact line (type present but data null / messages not an array)
+  // must not crash the resume — skip it and look further back.
   for (let i = events.length - 1; i >= 0; i--) {
-    if (events[i].type === "compact" && events[i].data.messages) {
+    const e = events[i];
+    if (e && e.type === "compact" && Array.isArray(e.data?.messages)) {
       lastCompactIndex = i;
       break;
     }
   }
 
-  if (lastCompactIndex >= 0 && events[lastCompactIndex].data.messages) {
-    messages.push(...events[lastCompactIndex].data.messages);
+  if (lastCompactIndex >= 0) {
+    for (const m of events[lastCompactIndex].data.messages) {
+      if (isReplayableMessage(m)) messages.push(m);
+    }
   }
 
   const startIndex = lastCompactIndex >= 0 ? lastCompactIndex + 1 : 0;
@@ -108,9 +150,11 @@ export function rebuildMessages(sessionId) {
   for (let i = startIndex; i < events.length; i++) {
     const event = events[i];
     if (
-      event.type === "user_message" ||
-      event.type === "assistant_message" ||
-      event.type === "system"
+      event &&
+      (event.type === "user_message" ||
+        event.type === "assistant_message" ||
+        event.type === "system") &&
+      isReplayableMessage(event.data)
     ) {
       messages.push(event.data);
     }
@@ -119,6 +163,19 @@ export function rebuildMessages(sessionId) {
   return messages;
 }
 
+/** ISO string for a numeric ms timestamp, or "" when missing / non-finite /
+ * invalid — `new Date(undefined).toISOString()` (and `new Date("garbage")`)
+ * throw "Invalid time value", and one corrupt event must not crash a whole
+ * `cc session list` / `cc session search`. Exported so command-layer readers of
+ * the same (hand-editable) JSONL share the guard. */
+export function toIsoSafe(ts) {
+  if (ts == null) return ""; // null/undefined → "" (Number(null) is 0 = epoch)
+  const n = Number(ts);
+  if (!Number.isFinite(n)) return "";
+  const d = new Date(n);
+  return Number.isNaN(d.getTime()) ? "" : d.toISOString();
+}
+
 export function listJsonlSessions(options = {}) {
   const dir = getSessionsDir();
   if (!existsSync(dir)) return [];
@@ -141,12 +198,8 @@ export function listJsonlSessions(options = {}) {
         provider: startEvent?.data?.provider || "",
         model: startEvent?.data?.model || "",
         message_count: messageCount,
-        created_at: startEvent
-          ? new Date(startEvent.timestamp).toISOString()
-          : "",
-        updated_at: lastEvent
-          ? new Date(lastEvent.timestamp).toISOString()
-          : "",
+        created_at: toIsoSafe(startEvent?.timestamp),
+        updated_at: toIsoSafe(lastEvent?.timestamp),
         _lastTs: lastEvent?.timestamp || 0,
         _eventCount: events.length,
       };
@@ -184,6 +237,7 @@ export function forkSession(sourceId) {
 }
 
 export function sessionExists(sessionId) {
+  if (isUnsafeSessionId(sessionId)) return false; // never resolve a traversal id
   return existsSync(sessionPath(sessionId));
 }
 
@@ -266,6 +320,15 @@ export function migrateLegacySessionFile(filePath, options = {}) {
 }
 
 export function validateJsonlSession(sessionId) {
+  if (isUnsafeSessionId(sessionId)) {
+    return {
+      sessionId,
+      valid: false,
+      reason: "invalid session id",
+      malformedLines: 0,
+      eventCount: 0,
+    };
+  }
   const filePath = sessionPath(sessionId);
   if (!existsSync(filePath)) {
     return {
@@ -335,6 +398,21 @@ function performLegacySessionMigration(sourcePath, options) {
   const legacy = normalizeLegacySession(parsed, basename(sourcePath, ".json"));
   const sessionId = legacy.id;
 
+  // A legacy file carries its OWN `id` (payload.id), so a crafted file could
+  // name a traversal target like "../../evil". sessionPath() throws on write
+  // (the backstop), but fail-fast HERE with a clear reason so the migration
+  // doesn't burn retry attempts on a deterministic error.
+  if (isUnsafeSessionId(sessionId)) {
+    return {
+      file: sourcePath,
+      sessionId,
+      migrated: false,
+      failed: true,
+      dryRun: Boolean(options.dryRun),
+      reason: "unsafe session id in legacy file",
+    };
+  }
+
   if (!options.force && sessionExists(sessionId)) {
     return {
       file: sourcePath,

package/src/harness/mcp-client.js

@@ -814,19 +814,18 @@ export class MCPClient extends EventEmitter {
       const contentType = response.headers?.get
         ? String(response.headers.get("content-type") || "").toLowerCase()
         : "";
+      // Bound the response body the same way the stdio path bounds its line
+      // buffer (per-server maxBufferChars override; 0 disables).
+      const cap = Number.isFinite(entry.config?.maxBufferChars)
+        ? entry.config.maxBufferChars
+        : MCP_MAX_BUFFER_CHARS;
 
       let envelope;
       if (contentType.includes("text/event-stream")) {
-        envelope = await _extractSseResponse(response, id);
+        envelope = await _extractSseResponse(response, id, cap);
       } else {
-        envelope =
-          typeof response.json === "function"
-            ? await response.json()
-            : JSON.parse(
-                typeof response.text === "function"
-                  ? await response.text()
-                  : "",
-              );
+        const text = await _readBodyCapped(response, cap);
+        envelope = text ? JSON.parse(text) : null;
       }
 
       if (!envelope || typeof envelope !== "object") {
@@ -957,28 +956,70 @@ export class MCPClient extends EventEmitter {
 }
 
 /**
- * Parse a `text/event-stream` HTTP response body and return the first
- * JSON-RPC envelope whose id matches `requestId`. Tolerates multiple
- * `data:` chunks, comments, and non-JSON-RPC events.
+ * Read an HTTP response body to text with a hard size cap, mirroring the stdio
+ * transport's MCP_MAX_BUFFER_CHARS guard. The per-call timeout bounds TIME but
+ * not MEMORY: a malicious/buggy HTTP MCP server could stream a multi-GB body
+ * within the timeout and OOM the client. When the body is a readable stream
+ * (real fetch) we accumulate with a running cap and cancel on overflow; for a
+ * non-stream response (test mocks) we fall back to text() + a post-hoc check.
+ * A declared Content-Length over the cap is rejected before any read. cap<=0
+ * disables the limit.
  */
-async function _extractSseResponse(response, requestId) {
-  let text;
-  if (typeof response.text === "function") {
-    text = await response.text();
-  } else if (response.body && typeof response.body.getReader === "function") {
+async function _readBodyCapped(response, cap) {
+  if (
+    cap > 0 &&
+    response.headers &&
+    typeof response.headers.get === "function"
+  ) {
+    const declared = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > cap) {
+      throw new Error(
+        `MCP HTTP response exceeds the ${cap}-byte cap (content-length ${declared})`,
+      );
+    }
+  }
+  if (response.body && typeof response.body.getReader === "function") {
     const reader = response.body.getReader();
     const decoder = new TextDecoder("utf-8");
     const chunks = [];
-    while (true) {
+    let total = 0;
+    for (;;) {
       const { value, done } = await reader.read();
       if (done) break;
+      total += value && value.length ? value.length : 0;
+      if (cap > 0 && total > cap) {
+        try {
+          await reader.cancel();
+        } catch {
+          /* best-effort — the throw below is what matters */
+        }
+        throw new Error(
+          `MCP HTTP response exceeded the ${cap}-byte cap (runaway server)`,
+        );
+      }
       chunks.push(decoder.decode(value, { stream: true }));
     }
     chunks.push(decoder.decode());
-    text = chunks.join("");
-  } else {
-    throw new Error("SSE response is not readable");
+    return chunks.join("");
+  }
+  if (typeof response.text !== "function") {
+    throw new Error("HTTP response is not readable");
   }
+  const text = await response.text();
+  if (cap > 0 && text.length > cap) {
+    throw new Error(`MCP HTTP response exceeded the ${cap}-char cap`);
+  }
+  return text;
+}
+
+/**
+ * Parse a `text/event-stream` HTTP response body and return the first
+ * JSON-RPC envelope whose id matches `requestId`. Tolerates multiple
+ * `data:` chunks, comments, and non-JSON-RPC events. `cap` bounds the body
+ * size (see _readBodyCapped).
+ */
+async function _extractSseResponse(response, requestId, cap = 0) {
+  const text = await _readBodyCapped(response, cap);
 
   // Split into events on blank line, parse each event's concatenated `data:` lines.
   const events = text.split(/\r?\n\r?\n/);

package/src/harness/prompt-compressor.js

@@ -12,6 +12,12 @@
 import { createHash } from "node:crypto";
 import { feature, featureVariant } from "../lib/feature-flags.js";
 
+// Bounds for the fuzzy near-dup pass in _deduplicate (see there). Generous
+// enough that real near-dups are still caught; small enough that compaction of
+// a long, tool-heavy history stays sub-second instead of O(n²·content).
+const DEDUP_JACCARD_MAX_CHARS = 4000;
+const DEDUP_FUZZY_WINDOW = 100;
+
 export function estimateTokens(text) {
   if (!text) return 0;
   const chineseChars = (text.match(/[\u4e00-\u9fa5]/g) || []).length;
@@ -320,8 +326,18 @@ export class PromptCompressor {
     const last = [...messages].reverse().find((m) => m.role === "user");
     const rest = messages.filter((m) => m.role !== "system" && m !== last);
 
+    // Bound the fuzzy pass so it stays usable on the very conversations
+    // compaction targets (long + tool-heavy). The naive version compared every
+    // message against EVERY prior one (O(n²)) and ran jaccard over full content
+    // (O(content) per compare) — 300 msgs × ~8 KB tool results blocked ~3.4 s.
+    //  • Exact dedup (the md5 hash set) still covers ALL messages.
+    //  • The fuzzy near-dup compare uses a capped prefix (char-set jaccard is
+    //    alphabet-bounded, so a prefix barely changes the decision) and only the
+    //    most-recent kept entries (near-dups cluster; this can only UNDER-dedup,
+    //    never drop a genuinely-distinct message).
     const seen = new Map();
     const deduped = [];
+    const recent = []; // rolling window of recent kept {capped} contents
 
     for (const msg of rest) {
       const content = getContent(msg);
@@ -329,12 +345,13 @@ export class PromptCompressor {
 
       if (seen.has(hash)) continue;
 
+      const capped =
+        content.length > DEDUP_JACCARD_MAX_CHARS
+          ? content.slice(0, DEDUP_JACCARD_MAX_CHARS)
+          : content;
       let isDup = false;
-      for (const [, existing] of seen) {
-        if (
-          jaccardSimilarity(content, getContent(existing)) >=
-          this.similarityThreshold
-        ) {
+      for (const prev of recent) {
+        if (jaccardSimilarity(capped, prev) >= this.similarityThreshold) {
           isDup = true;
           break;
         }
@@ -343,6 +360,8 @@ export class PromptCompressor {
       if (!isDup) {
         seen.set(hash, msg);
         deduped.push(msg);
+        recent.push(capped);
+        if (recent.length > DEDUP_FUZZY_WINDOW) recent.shift();
       }
     }
 

package/src/harness/worktree-isolator.js

@@ -462,7 +462,11 @@ export function applyWorktreeAutomationCandidate(
     const commitMessage =
       options.commitMessage ||
       `Resolve ${filePath} via ${candidate.label || candidateId}`;
-    gitExec(`commit -m "${commitMessage.replace(/"/g, '\\"')}"`, worktree.path);
+    // Free-text message → argv (no shell) so `$()` / backticks / quotes in a
+    // caller-supplied commitMessage can't inject a command. The prior
+    // `-m "${msg.replace(/"/g,'\\"')}"` only neutralized double quotes — the
+    // same gap already fixed in mergeWorktree.
+    gitExecArgs(["commit", "-m", commitMessage], worktree.path);
 
     const diff = diffWorktree(repoDir, branchName, { baseBranch });
     const filesChanged = diff.summary?.filesChanged || 0;
@@ -546,6 +550,11 @@ function _hasUncommittedChanges(worktreePath) {
     const output = execSync("git status --porcelain", {
       cwd: worktreePath,
       encoding: "utf-8",
+      // A worktree with many dirty files produces >1 MB of porcelain output and
+      // would ENOBUFS on the default cap — the catch below then reports "clean"
+      // (fail-OPEN), which could let a caller discard a worktree full of
+      // uncommitted work. Give it the same 64 MB headroom as gitExec.
+      maxBuffer: 64 * 1024 * 1024,
     });
     return output.trim().length > 0;
   } catch (_e) {

package/src/lib/agent-core.js

@@ -28,6 +28,8 @@ export {
   listBackgroundShellTasks,
   killBackgroundShellTask,
   killAllBackgroundShellTasks,
+  reapIdleBackgroundShellTasks,
+  _ingestSearchOutput,
   writeFileVerified,
   formatProviderHttpError,
   _accumulateOllamaStream,

package/src/lib/audit-logger.js

@@ -4,6 +4,7 @@
  */
 
 import crypto from "crypto";
+import { safeJsonParse } from "./safe-json.js";
 
 /**
  * Event types for audit logging.
@@ -232,7 +233,8 @@ export function queryLogs(db, filters = {}) {
   const rows = db.prepare(sql).all(...params);
   return rows.map((r) => ({
     ...r,
-    details: r.details ? JSON.parse(r.details) : null,
+    // One corrupt details cell must not throw out of the whole query.
+    details: safeJsonParse(r.details, null),
     success: r.success === 1,
   }));
 }

package/src/lib/autonomous-agent.js

@@ -48,6 +48,12 @@ export class CLIAutonomousAgent extends EventEmitter {
     this._initialized = false;
     this._maxIterations = 20;
     this._maxRetries = 3;
+    // Cap retained goal history. submitGoal stores every goal in _goals and
+    // nothing removes it; the REPL keeps one long-lived agent for the whole
+    // session, so goals (each holding steps/errors/result) accumulate without
+    // bound — and listGoals() returns the whole growing Map. Prune the oldest
+    // TERMINAL goals beyond this cap; running/pending/paused goals are kept.
+    this._maxGoals = 200;
   }
 
   /**
@@ -58,12 +64,14 @@ export class CLIAutonomousAgent extends EventEmitter {
     toolExecutor,
     hookManager,
     maxIterations,
+    maxGoals,
     iterationBudget,
   } = {}) {
     this._llmChat = llmChat || null;
     this._toolExecutor = toolExecutor || null;
     this._hookManager = hookManager || null;
     if (maxIterations) this._maxIterations = maxIterations;
+    if (Number.isFinite(maxGoals) && maxGoals > 0) this._maxGoals = maxGoals;
     this._iterationBudget = iterationBudget || null; // shared budget from caller
     this._initialized = true;
   }
@@ -96,6 +104,7 @@ export class CLIAutonomousAgent extends EventEmitter {
     };
 
     this._goals.set(goalId, goal);
+    this._pruneGoals();
     this.emit("goal:submitted", { goalId, description });
 
     // Start the ReAct loop asynchronously
@@ -108,6 +117,26 @@ export class CLIAutonomousAgent extends EventEmitter {
     return { goalId };
   }
 
+  /**
+   * Bound retained goal history to _maxGoals. Evicts the oldest TERMINAL goals
+   * (completed/failed/cancelled) FIFO; a still-active goal (pending/running/
+   * paused) is never dropped, so a burst of concurrent goals can briefly exceed
+   * the cap rather than losing live work.
+   */
+  _pruneGoals() {
+    if (this._goals.size <= this._maxGoals) return;
+    for (const [id, g] of this._goals) {
+      if (this._goals.size <= this._maxGoals) break;
+      if (
+        g.status === GoalStatus.COMPLETED ||
+        g.status === GoalStatus.FAILED ||
+        g.status === GoalStatus.CANCELLED
+      ) {
+        this._goals.delete(id);
+      }
+    }
+  }
+
   /**
    * Pause a running goal.
    */

package/src/lib/chat-core.js

@@ -13,8 +13,8 @@ import { BUILT_IN_PROVIDERS } from "./llm-providers.js";
 import { appendTokenUsage } from "../harness/jsonl-session-store.js";
 import {
   isRetryableStreamError,
-  STREAM_RETRY_MAX,
   STREAM_RETRY_BASE_MS,
+  resolveStreamRetryMax,
 } from "./stream-retry.js";
 
 // A streaming chat call must not hang forever if the API accepts the connection
@@ -513,6 +513,9 @@ export async function* chatStream(messages, options) {
   // any token still terminates the generator cleanly.
   const streamPromise = (async () => {
     try {
+      // Budget honors CC_MAX_RETRIES / CLAUDE_CODE_MAX_RETRIES (capped 15),
+      // same as the agent path.
+      const maxRetries = resolveStreamRetryMax();
       let attempt = 0;
       for (;;) {
         try {
@@ -524,7 +527,7 @@ export async function* chatStream(messages, options) {
           // zero-output retry safety (cc agent parity). Stall aborts (180s) and
           // HTTP/auth errors are not retryable and surface immediately.
           if (
-            attempt >= STREAM_RETRY_MAX ||
+            attempt >= maxRetries ||
             tokensEmitted > 0 ||
             !isRetryableStreamError(err)
           ) {

package/src/lib/chat-intent-service.js

@@ -22,6 +22,40 @@ import { firstBalancedJson } from "./json-schema-output.js";
 
 const DEFAULT_INTENT_TIMEOUT_MS = 15000;
 
+/**
+ * Resolve the per-call intent-classification budget. `llmOptions.intentTimeoutMs`
+ * overrides the default; an explicit 0 disables the cap; NaN/negative/absent →
+ * default.
+ */
+function resolveIntentTimeout(llmOptions) {
+  const raw = llmOptions?.intentTimeoutMs;
+  if (raw === 0) return 0; // explicit disable
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : DEFAULT_INTENT_TIMEOUT_MS;
+}
+
+/**
+ * Bound an LLM call to the intent budget. chat-core has its OWN stall guard, but
+ * it only fires on SILENCE (no bytes for 180s) — a slow trickling stream never
+ * trips it, so without this the declared 15s intent budget was never enforced
+ * and classification could block for minutes. Racing the deadline makes it fail
+ * fast into the caller's graceful rule/verbatim fallback. `ms <= 0` disables.
+ * The losing background request is harmless (chat-core releases its own socket);
+ * the timer is unref'd so it never holds the process open.
+ */
+function withIntentTimeout(promise, ms) {
+  if (!(Number(ms) > 0)) return promise;
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(
+      () => reject(new Error(`intent LLM call timed out after ${ms}ms`)),
+      Number(ms),
+    );
+    if (timer && typeof timer.unref === "function") timer.unref();
+  });
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+
 /**
  * Build the V5 understandIntent system + user prompt pair.
  *
@@ -123,17 +157,20 @@ export async function understandIntent({
   );
 
   try {
-    const fullContent = await chatWithStreaming(
-      [
-        { role: "system", content: systemPrompt },
-        { role: "user", content: userPrompt },
-      ],
-      {
-        ...llmOptions,
-        // Lower temperature → more deterministic JSON output.
-        temperature: 0.3,
-        maxTokens: 500,
-      },
+    const fullContent = await withIntentTimeout(
+      chatWithStreaming(
+        [
+          { role: "system", content: systemPrompt },
+          { role: "user", content: userPrompt },
+        ],
+        {
+          ...llmOptions,
+          // Lower temperature → more deterministic JSON output.
+          temperature: 0.3,
+          maxTokens: 500,
+        },
+      ),
+      resolveIntentTimeout(llmOptions),
     );
 
     const jsonText = extractJson(fullContent);
@@ -204,6 +241,11 @@ export async function* understandIntentStream({
   );
   let buffer = "";
   try {
+    // Incremental token yielding makes a per-call deadline awkward to apply
+    // here; this streaming variant is instead bounded by chat-core's own
+    // silence-based stall guard (CC_CHAT_STALL_MS, default 180s). The awaited
+    // understandIntent / classifyFollowupIntent paths enforce the tighter
+    // intent budget (resolveIntentTimeout) directly.
     for await (const event of chatStream(
       [
         { role: "system", content: systemPrompt },
@@ -319,7 +361,12 @@ const FOLLOWUP_RULES = {
       /(颜色|字体|大小|位置|标题).*(是|用|为)/,
       /^.{1,20}(应该|具体)(是|为)/,
       /^数据(来源|是)/,
-      /.*(用|采用).*(字体|颜色|大小)/,
+      // De-catastrophized: the old `/.*(用|采用).*(字体…)/` had a leading greedy
+      // `.*` overlapping `(用)`, causing exponential backtracking (a 2 KB input
+      // of "用" took ~3 s). `.test()` already searches anywhere, so the leading
+      // `.*` is redundant; a lazy middle drops it to quadratic, and the input
+      // cap in ruleBasedClassify bounds that.
+      /(用|采用)[\s\S]*?(字体|颜色|大小)/,
     ],
   },
   CANCEL_TASK: {
@@ -334,8 +381,15 @@ const FOLLOWUP_RULES = {
   },
 };
 
+// A follow-up intent (continue / modify / clarify / cancel) is determinable
+// from the start of the message; cap the text the heuristic regexes see so a
+// huge paste can't drive their (quadratic) backtracking into a DoS. The full
+// input is still forwarded to the LLM path / downstream — only this local
+// classification is truncated.
+const MAX_CLASSIFY_INPUT = 2000;
+
 function ruleBasedClassify(userInput) {
-  const input = (userInput || "").trim();
+  const input = (userInput || "").trim().slice(0, MAX_CLASSIFY_INPUT);
 
   if (input.length === 0) {
     return {
@@ -440,16 +494,19 @@ ${
 
 async function llmBasedClassify(userInput, context, llmOptions) {
   const { systemPrompt, userPrompt } = buildFollowupPrompts(userInput, context);
-  const fullContent = await chatWithStreaming(
-    [
-      { role: "system", content: systemPrompt },
-      { role: "user", content: userPrompt },
-    ],
-    {
-      ...llmOptions,
-      temperature: 0.1,
-      maxTokens: 300,
-    },
+  const fullContent = await withIntentTimeout(
+    chatWithStreaming(
+      [
+        { role: "system", content: systemPrompt },
+        { role: "user", content: userPrompt },
+      ],
+      {
+        ...llmOptions,
+        temperature: 0.1,
+        maxTokens: 300,
+      },
+    ),
+    resolveIntentTimeout(llmOptions),
   );
   const jsonText = extractJson(fullContent);
   if (!jsonText) throw new Error("LLM response missing JSON");
@@ -528,5 +585,7 @@ export const _internal = {
   buildFollowupPrompts,
   extractJson,
   ruleBasedClassify,
+  resolveIntentTimeout,
+  withIntentTimeout,
   DEFAULT_INTENT_TIMEOUT_MS,
 };