chainlesschain 0.162.124 → 0.162.126

package/src/lib/llm-config-defaults.js

@@ -17,6 +17,43 @@
  *    lesson as the --settings "opus"→404 vision trap.
  *  - No configured provider → unchanged (runner defaults apply: ollama).
  */
+/**
+ * Reconcile a MISLABELED llm config/options object. The `baseUrl` is the
+ * authoritative signal of which provider you actually reach, so when `provider`
+ * disagrees with the provider its `baseUrl` belongs to, the config is simply
+ * mislabeled — the recurring "provider:anthropic + volces baseUrl + model:haiku"
+ * corruption that makes runnable-provider relabel (and emit "provider 配置与
+ * baseUrl 不一致") on EVERY run because the on-disk config never gets fixed.
+ *
+ * Correct `provider` to match the endpoint, and if the model is foreign to the
+ * corrected provider, replace it with that provider's default. Pure: the input
+ * is never mutated — returns `{ llm, changed }` where `llm` is the original
+ * object (changed:false) or a corrected shallow copy (changed:true). Works for
+ * both a `config.llm` block and a resolved request-`options` (same shape).
+ *
+ * `inferProviderFromBaseUrl` returns null for unknown/custom hosts (proxies),
+ * so an intentionally-custom endpoint is left untouched.
+ */
+export async function reconcileConfigLlmProvider(cfgLlm = {}) {
+  if (!cfgLlm || !cfgLlm.provider || !cfgLlm.baseUrl) {
+    return { llm: cfgLlm, changed: false };
+  }
+  const { inferProviderFromBaseUrl, modelForeignToProvider } =
+    await import("./runnable-provider.js");
+  const inferred = inferProviderFromBaseUrl(cfgLlm.baseUrl);
+  if (!inferred || inferred === cfgLlm.provider) {
+    return { llm: cfgLlm, changed: false };
+  }
+  const corrected = { ...cfgLlm, provider: inferred };
+  if (modelForeignToProvider(inferred, cfgLlm.model)) {
+    const { selectModelForTask, TaskType } =
+      await import("./task-model-selector.js");
+    const def = selectModelForTask(inferred, TaskType.CHAT);
+    if (def) corrected.model = def;
+  }
+  return { llm: corrected, changed: true };
+}
+
 export function applyConfigLlmDefaults(options = {}, cfgLlm = {}, opts = {}) {
   // The IDE chat panel pins --provider/--model (read from config) but DROPS
   // --base-url/--api-key. With an explicit --provider the block below bails, so

package/src/lib/llm-pricing.js

@@ -96,9 +96,10 @@ const round = (n, dp = 6) => {
  *
  * Per provider, a user entry whose `match` equals a built-in pattern REPLACES
  * it; brand-new patterns are prepended so they win ties; unknown providers are
- * added. Malformed entries (missing match / non-numeric rate) are skipped so a
- * bad config line can't crash cost reporting. Returns a new table; never
- * mutates PRICE_TABLE or the input.
+ * added. Malformed entries (missing match / non-numeric / negative / Infinity
+ * rate) are skipped so a bad config line can't crash cost reporting or produce a
+ * negative cost that undercounts spend. Returns a new table; never mutates
+ * PRICE_TABLE or the input.
  *
  * @param {object} [overrides]
  * @param {object} [base=PRICE_TABLE]
@@ -123,8 +124,14 @@ export function mergePricing(overrides, base = PRICE_TABLE) {
           e &&
           typeof e.match === "string" &&
           e.match.trim() &&
+          // Rates must be finite AND non-negative — a negative price would
+          // produce a negative cost that undercounts spend (and could keep a
+          // CostBudget under its cap). `>= 0` also rejects NaN (NaN >= 0 is
+          // false); isFinite additionally rejects Infinity.
           Number.isFinite(Number(e.in)) &&
-          Number.isFinite(Number(e.out)),
+          Number(e.in) >= 0 &&
+          Number.isFinite(Number(e.out)) &&
+          Number(e.out) >= 0,
       )
       .map((e) => ({
         match: e.match.toLowerCase(),

package/src/lib/llm-providers.js

@@ -181,12 +181,22 @@ export class LLMProviderRegistry {
       .prepare("SELECT * FROM llm_providers WHERE custom = 1")
       .all();
     for (const row of rows) {
+      // Tolerate a corrupt `models` TEXT column: `|| "[]"` only covers null,
+      // not malformed JSON, and an unguarded throw here would abort the whole
+      // custom-provider load (and the registry constructor) over one bad row.
+      let models = [];
+      try {
+        const parsed = JSON.parse(row.models || "[]");
+        if (Array.isArray(parsed)) models = parsed;
+      } catch {
+        /* corrupt models column — fall back to no models for this provider */
+      }
       this.providers.set(row.name, {
         name: row.name,
         displayName: row.display_name,
         baseUrl: row.base_url,
         apiKeyEnv: row.api_key_env,
-        models: JSON.parse(row.models || "[]"),
+        models,
         custom: true,
         free: false,
       });

package/src/lib/mcp-oauth.js

@@ -38,6 +38,10 @@ export const _deps = {
   now: () => Date.now(),
   // Backoff sleep seam (tests override with a no-op so the retry doesn't wait).
   sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  // Visible-warning seam (silent under vitest; tests override to assert).
+  warn: (msg) => {
+    if (!process.env.VITEST) process.stderr.write(msg);
+  },
 };
 
 /** Discovery/token requests retry ONCE after a transient error (CC 2.1.191). */
@@ -194,6 +198,12 @@ export async function discoverAuthMetadata(
   { resourceMetadataUrl } = {},
 ) {
   const origin = new URL(serverUrl).origin;
+  // Discovery itself carries no secrets, but its responses dictate the
+  // authorization/token endpoints — so a cleartext-remote discovery is a
+  // downgrade vector (a MITM could inject endpoints). Refuse a non-loopback
+  // http MCP URL up front (loopback http stays allowed for local dev), matching
+  // the endpoint enforcement below.
+  assertSecureEndpoint(origin, "MCP server URL");
   // 1. protected-resource metadata (RFC 9728) → authorization_servers[]
   let authServer = origin;
   try {
@@ -209,6 +219,12 @@ export async function discoverAuthMetadata(
   } catch {
     // no protected-resource doc → assume the origin is its own auth server
   }
+  // The authorization-server location can come from the REMOTE protected-
+  // resource doc, so a malicious/MITM'd doc could point discovery at a
+  // cleartext host. Refuse a non-loopback http authServer before fetching its
+  // metadata (the discovered endpoints are HTTPS-checked too, but this fails
+  // closed earlier and blocks the downgrade).
+  assertSecureEndpoint(authServer, "authorization server");
   // 2. authorization-server metadata (RFC 8414)
   const candidates = [
     `${authServer}/.well-known/oauth-authorization-server`,
@@ -359,17 +375,56 @@ export function tokenStorePath() {
   return pathDefault.join(_deps.homedir(), ".chainlesschain", "mcp-oauth.json");
 }
 
-export function loadTokenStore() {
-  const file = tokenStorePath();
+/**
+ * Read the token store, distinguishing "absent / empty" (ok) from "exists but
+ * unreadable / corrupt" (ok:false). The distinction matters on the WRITE path:
+ * a read-modify-write that treats an unreadable store as `{}` would overwrite
+ * and silently destroy every other server's token.
+ */
+function _readStore(file) {
+  if (!_deps.fs.existsSync(file)) return { ok: true, store: {} };
   try {
-    if (!_deps.fs.existsSync(file)) return {};
     const data = JSON.parse(_deps.fs.readFileSync(file, "utf-8"));
-    return data && typeof data === "object" ? data : {};
+    return { ok: true, store: data && typeof data === "object" ? data : {} };
+  } catch (err) {
+    return { ok: false, store: {}, err };
+  }
+}
+
+const _warnedCorruptStore = new Set();
+function _warnCorruptStoreOnce(file, err, archived) {
+  if (_warnedCorruptStore.has(file)) return;
+  _warnedCorruptStore.add(file);
+  _deps.warn(
+    `⚠️  MCP OAuth token store at ${file} is unreadable (${err?.message || "parse error"}). ` +
+      `Saved MCP logins are unavailable${archived ? `; the unreadable file was preserved as ${archived}` : ""} — ` +
+      "re-run `cc mcp login <url>` for the servers you use.\n",
+  );
+}
+
+/** Move an unreadable store aside so a fresh write doesn't destroy it. Returns
+ *  the archive path, or "" when it couldn't be moved (best-effort). */
+function _archiveCorruptStore(file) {
+  if (typeof _deps.fs.renameSync !== "function") return "";
+  const ts = typeof _deps.now === "function" ? _deps.now() : Date.now();
+  const dest = `${file}.corrupt-${ts}`;
+  try {
+    _deps.fs.renameSync(file, dest);
+    return dest;
   } catch {
-    return {};
+    return "";
   }
 }
 
+export function loadTokenStore() {
+  const file = tokenStorePath();
+  const r = _readStore(file);
+  // Read callers (getStoredToken) treat an unreadable store as "no token", but
+  // the user should still know their saved logins silently vanished.
+  if (!r.ok) _warnCorruptStoreOnce(file, r.err, "");
+  return r.store;
+}
+
 export function getStoredToken(serverUrl) {
   return loadTokenStore()[serverKey(serverUrl)] || null;
 }
@@ -515,7 +570,15 @@ function withStoreLock(file, fn) {
 export function saveStoredToken(serverUrl, record) {
   const file = tokenStorePath();
   return withStoreLock(file, () => {
-    const store = loadTokenStore(); // re-read inside the lock (latest state)
+    const r = _readStore(file); // re-read inside the lock (latest state)
+    if (!r.ok) {
+      // The existing store is unreadable. Writing a fresh single-entry store
+      // here would silently destroy every other server's token — move the
+      // unreadable file aside first so it can be recovered, and surface it.
+      const archived = _archiveCorruptStore(file);
+      _warnCorruptStoreOnce(file, r.err, archived);
+    }
+    const store = r.store;
     store[serverKey(serverUrl)] = { server: serverKey(serverUrl), ...record };
     _writeStoreSecure(file, store);
     return store[serverKey(serverUrl)];
@@ -548,13 +611,28 @@ export function isTokenExpired(record, { skewMs = 60_000 } = {}) {
 /**
  * Return a valid bearer token for a server, refreshing if expired. Returns the
  * access_token string, or null if there's no stored token / refresh failed.
+ *
+ * `forceRefresh` bypasses the local-expiry check and exchanges the refresh
+ * token unconditionally. Use it when the server REJECTED a stored token that
+ * still looked unexpired locally (mid-session 401/403 from a rotated/revoked
+ * grant): the cached access_token is known-bad, so reusing it is pointless —
+ * we either mint a fresh one or return null to signal "re-login needed".
+ *
+ * @param {string} serverUrl
+ * @param {{ forceRefresh?: boolean }} [opts]
  */
-export async function ensureValidToken(serverUrl) {
+export async function ensureValidToken(
+  serverUrl,
+  { forceRefresh = false } = {},
+) {
   const record = getStoredToken(serverUrl);
   if (!record) return null;
-  if (!isTokenExpired(record)) return record.access_token;
+  if (!forceRefresh && !isTokenExpired(record)) return record.access_token;
   if (!record.refresh_token || !record.endpoints?.token_endpoint) {
-    return record.access_token || null; // can't refresh → use what we have
+    // Can't refresh. On a forced refresh the cached token is known-rejected, so
+    // hand back null (caller should stop retrying and prompt re-login); on the
+    // proactive path keep the existing behaviour of using what we have.
+    return forceRefresh ? null : record.access_token || null;
   }
   try {
     const tok = await refreshAccessToken(
@@ -564,7 +642,7 @@ export async function ensureValidToken(serverUrl) {
     const updated = saveStoredToken(serverUrl, { ...record, ...tok });
     return updated.access_token;
   } catch {
-    return record.access_token || null;
+    return forceRefresh ? null : record.access_token || null;
   }
 }
 

package/src/lib/mcp-serve.js

@@ -108,6 +108,35 @@ export function buildTools({ root, readOnly = false, deps = _deps }) {
       },
       handler: ({ path: rel }) => {
         const abs = confine(root, rel, deps);
+        // Bounded read: pull at most MAX_READ_BYTES+1 bytes into memory. The
+        // old `readFileSync(abs)` loaded the WHOLE file before truncating, so
+        // MAX_READ_BYTES only capped the RESPONSE — a multi-GB file under the
+        // serve root would OOM the process. The +1 byte detects "longer than
+        // the cap" without reading the rest. Fall back to readFileSync only
+        // when the fd API isn't available on an injected fs.
+        if (typeof fs.openSync === "function") {
+          const fd = fs.openSync(abs, "r");
+          try {
+            const buf = Buffer.alloc(MAX_READ_BYTES + 1);
+            const n = fs.readSync(fd, buf, 0, MAX_READ_BYTES + 1, 0);
+            const truncated = n > MAX_READ_BYTES;
+            const text = buf
+              .slice(0, truncated ? MAX_READ_BYTES : n)
+              .toString("utf-8");
+            if (!truncated) return ok(text);
+            let total = null;
+            try {
+              total = fs.statSync(abs).size;
+            } catch {
+              /* size is best-effort for the message */
+            }
+            return ok(
+              `${text}\n… [truncated${total != null ? ` ${total} bytes` : ""}]`,
+            );
+          } finally {
+            fs.closeSync(fd);
+          }
+        }
         const buf = fs.readFileSync(abs);
         const truncated = buf.length > MAX_READ_BYTES;
         const text = (truncated ? buf.slice(0, MAX_READ_BYTES) : buf).toString(

package/src/lib/orchestrator.js

@@ -82,6 +82,16 @@ export class Orchestrator extends EventEmitter {
     this.ciCommand = options.ciCommand || "npm test";
     this.verbose = options.verbose || false;
 
+    // Cap retained task history. Every addTask stores a record in _tasks and
+    // nothing ever removes it, so a long-running orchestrator (cron-watch /
+    // daemon) accumulates tasks without bound. Prune the oldest TERMINAL tasks
+    // beyond this cap (in-flight tasks are never dropped). Generous default;
+    // 0/invalid → 500.
+    this.maxTasks =
+      Number.isFinite(options.maxTasks) && options.maxTasks > 0
+        ? options.maxTasks
+        : 500;
+
     /** @type {Map<string, object>} taskId → task */
     this._tasks = new Map();
 
@@ -151,6 +161,7 @@ export class Orchestrator extends EventEmitter {
     };
 
     this._tasks.set(task.id, task);
+    this._pruneTasks();
     this.emit("task:added", task);
 
     if (this.notifier.isConfigured && task.notify) {
@@ -183,7 +194,7 @@ export class Orchestrator extends EventEmitter {
     return {
       tasks,
       pool: this._router.summary(),
-      cliCommand: this.cliCommand,
+      ciCommand: this.ciCommand,
       cronActive: this._cronTimer !== null,
     };
   }
@@ -278,7 +289,7 @@ export class Orchestrator extends EventEmitter {
   async _dispatch(task) {
     this.emit("agents:dispatched", { task, count: task.subtasks.length });
     this._log(
-      `Dispatching ${task.subtasks.length} subtask(s) to ${this.cliCommand} agents`,
+      `Dispatching ${task.subtasks.length} subtask(s) to ${this._router.summary().length} agent backend(s)`,
     );
 
     const results = await this._router.dispatch(task.subtasks, {
@@ -372,6 +383,11 @@ export class Orchestrator extends EventEmitter {
         cwd,
         encoding: "utf-8",
         timeout: 180_000,
+        // execSync defaults maxBuffer to 1 MB; a verbose-but-PASSING test run
+        // that prints more than that throws ENOBUFS, which the catch below
+        // would misreport as a CI failure (triggering needless retries +
+        // re-dispatch). Give CI output generous headroom.
+        maxBuffer: 64 * 1024 * 1024,
         stdio: "pipe",
       });
       return {
@@ -387,6 +403,26 @@ export class Orchestrator extends EventEmitter {
     }
   }
 
+  /**
+   * Bound retained task history to maxTasks. Evicts the oldest TERMINAL tasks
+   * first (Map preserves insertion order = FIFO); an in-flight task is never
+   * dropped, so a burst of concurrent runs can briefly exceed the cap rather
+   * than losing live work. The dropped records are completed/failed history
+   * the caller has already seen via task:complete / task:failed events.
+   */
+  _pruneTasks() {
+    if (this._tasks.size <= this.maxTasks) return;
+    for (const [id, t] of this._tasks) {
+      if (this._tasks.size <= this.maxTasks) break;
+      if (
+        t.status === TASK_STATUS.COMPLETED ||
+        t.status === TASK_STATUS.FAILED
+      ) {
+        this._tasks.delete(id);
+      }
+    }
+  }
+
   async _cronTick() {
     this.emit("cron:tick", { at: new Date().toISOString() });
     // Override this method or listen to the event to add input source polling

package/src/lib/permission-engine.js

@@ -4,6 +4,7 @@
  */
 
 import crypto from "crypto";
+import { safeJsonParse } from "./safe-json.js";
 
 function generateId() {
   return crypto.randomUUID();
@@ -160,7 +161,9 @@ export function getRoles(db) {
     .all();
   return rows.map((r) => ({
     ...r,
-    permissions: JSON.parse(r.permissions || "[]"),
+    // `|| "[]"` only guarded null — a corrupt permissions cell still threw out
+    // of the whole role list (and could break permission checks). Skip it.
+    permissions: safeJsonParse(r.permissions, []),
     isBuiltin: r.is_builtin === 1,
   }));
 }

package/src/lib/pipeline-orchestrator.js

@@ -553,7 +553,25 @@ export function retryStage(db, pipelineId, stageIndex) {
   const pipeline = _getPipelineRow(db, pipelineId);
   if (!pipeline) throw new Error(`Pipeline not found: ${pipelineId}`);
 
-  const stage = _getStageRow(db, pipelineId, stageIndex);
+  // A retry may only re-open the CURRENT stage or an EARLIER one. A forward
+  // jump would move current_stage past the intervening stages — skipping their
+  // approval GATES (CODE_REVIEW / DEPLOY) — and let a caller (`cc pipeline retry
+  // --stage N`, user-supplied) reach a later stage without the gates that guard
+  // it. Going backward is safe: advancing from there re-runs through every gate
+  // again. Mirrors the state-machine rigor of completeStage / approveGate.
+  const idx = Number(stageIndex);
+  if (!Number.isInteger(idx) || idx < 0) {
+    throw new Error(`Invalid stage index: ${stageIndex}`);
+  }
+  if (idx > pipeline.current_stage) {
+    throw new Error(
+      `Cannot retry stage ${idx}: it is ahead of the current stage ` +
+        `(${pipeline.current_stage}) — retrying forward would skip the ` +
+        `intervening stages and their approval gates`,
+    );
+  }
+
+  const stage = _getStageRow(db, pipelineId, idx);
   if (!stage) throw new Error(`Stage ${stageIndex} not found`);
 
   const now = _now();
@@ -572,7 +590,7 @@ export function retryStage(db, pipelineId, stageIndex) {
   });
   _updatePipelineFields(db, pipelineId, {
     status: PIPELINE_STATUS.RUNNING,
-    current_stage: stageIndex,
+    current_stage: idx,
     error_message: null,
     completed_at: null,
   });

package/src/lib/project-instructions.js

@@ -33,6 +33,7 @@
 import fsDefault from "fs";
 import pathDefault from "path";
 import osDefault from "os";
+import { credentialFileReason } from "./credential-guard.js";
 
 export const DEFAULT_MAX_FILE_BYTES = 48 * 1024; // per instruction/import file
 export const DEFAULT_MAX_TOTAL_BYTES = 192 * 1024; // whole block budget
@@ -321,6 +322,18 @@ export function loadProjectInstructions(opts = {}) {
       const resolved = path.resolve(baseDir, target);
       if (visited.has(resolved) || !isFile(fs, resolved)) continue; // silent:
       // non-files are decorative @tokens (npm scopes, emails), not imports.
+      // Refuse to import a credential / secret file. `cc agent` auto-loads
+      // project memory, so a cloned/untrusted repo's cc.md must NOT be able to
+      // pull `@~/.ssh/id_rsa` / `@../.env` into the LLM-bound system prompt
+      // (mirrors the read_file/run_shell credential guard).
+      const credReason = credentialFileReason(resolved);
+      if (credReason) {
+        visited.add(resolved); // don't re-warn on a second reference
+        warnings.push(
+          `refused @import of ${resolved} — ${credReason}; project memory must not pull secrets into the prompt`,
+        );
+        continue;
+      }
       visited.add(resolved);
       queue.push({ abs: resolved, scope: "import", depth: depth + 1 });
     }

package/src/lib/repl-bang-memorize.js

@@ -25,6 +25,11 @@ import { findProjectRoot } from "./project-instructions.js";
 export const BANG_TIMEOUT_MS = 120_000;
 export const BANG_MAX_BUFFER = 10 * 1024 * 1024;
 export const BANG_OUTPUT_CAP = 30_000;
+// A `#` note is a terse one-liner, but readline accepts a long pasted line and
+// the note lands verbatim in cc.md — which is auto-loaded into EVERY future
+// session's system prompt. Without a cap, an accidental fat paste silently
+// bloats every later session's context. Truncate to a sane single-note size.
+export const MEMO_NOTE_MAX = 4_000;
 
 export const _deps = {
   spawnSync: spawnSyncDefault,
@@ -138,7 +143,10 @@ export function appendMemoryNote(rawLine, opts = {}) {
   const fs = opts.deps?.fs || _deps.fs;
   const path = opts.deps?.path || _deps.path;
   const cwd = opts.cwd || process.cwd();
-  const note = String(rawLine).replace(/^#/, "").trim();
+  let note = String(rawLine).replace(/^#/, "").trim();
+  if (note.length > MEMO_NOTE_MAX) {
+    note = `${note.slice(0, MEMO_NOTE_MAX)} …[truncated]`;
+  }
   const stamp = opts.date || new Date().toISOString().slice(0, 10);
 
   const root =

package/src/lib/repl-denials.js

@@ -0,0 +1,137 @@
+/**
+ * repl-denials — record + render the policy denials seen during an agent run,
+ * so the interactive REPL's `/permissions denials` can review what got blocked
+ * AND a headless run (`cc agent -p`) can print an end-of-run summary (Claude-
+ * Code 2.1.193 parity: "auto-mode denial reasons … /permissions recent
+ * denials"). The helpers are generic (not REPL-specific) and shared by both.
+ *
+ * A *denial* is a tool call the agent was NOT allowed to run — blocked by the
+ * shell policy, an ApprovalGate tier, a settings permission rule, or a hook. It
+ * is distinct from a tool that ran and *failed* (non-zero exit, missing file):
+ * those carry an `error` but none of the denial markers below, so they are not
+ * recorded here.
+ *
+ * Pure + dependency-free so it unit-tests without the REPL runtime.
+ */
+
+/** Keep the most recent N denials per session (bounded ring buffer). */
+export const MAX_RECENT_DENIALS = 20;
+
+/** Error-message prefixes agent-core attaches to a blocked tool call. */
+const DENIAL_PREFIX = /^\s*\[(Shell Policy|Permission|ApprovalGate|Hook)\]/;
+
+/** Map a `[Prefix]` to a short `via` label when no structured field carries one. */
+function viaFromPrefix(errStr) {
+  const m = DENIAL_PREFIX.exec(errStr);
+  if (!m) return null;
+  return (
+    {
+      "Shell Policy": "shell-policy",
+      Permission: "settings",
+      ApprovalGate: "gate",
+      Hook: "hook",
+    }[m[1]] || "policy"
+  );
+}
+
+/**
+ * Classify a tool-result as a policy denial and extract a structured record,
+ * or return null when it is not a denial. Detection prefers the structured
+ * markers agent-core attaches (`approval.decision` / `policy.decision` /
+ * `shellCommandPolicy.allowed`) and falls back to the error-message prefix.
+ *
+ * @param {object} ev  { tool, result, error, argsSummary }
+ * @returns {{tool:string,summary:string,reason:string,via:string,rule:(string|null)}|null}
+ */
+export function classifyDenial(ev = {}) {
+  const { tool, result, error, argsSummary } = ev;
+  const errStr = String(error || (result && result.error) || "").trim();
+  const approval = result && result.approval;
+  const policy = result && result.policy;
+  const shellPol = result && result.shellCommandPolicy;
+  const denied =
+    (approval && approval.decision === "deny") ||
+    (policy && policy.decision === "deny") ||
+    (shellPol && shellPol.allowed === false) ||
+    DENIAL_PREFIX.test(errStr);
+  if (!denied) return null;
+  const via =
+    (approval && approval.via) ||
+    (policy && policy.via) ||
+    (shellPol ? "shell-policy" : viaFromPrefix(errStr)) ||
+    "policy";
+  const rule = (policy && policy.rule) || (shellPol && shellPol.ruleId) || null;
+  return {
+    tool: tool || "?",
+    summary: String(
+      argsSummary || (shellPol && shellPol.normalizedCommand) || "",
+    ).slice(0, 200),
+    reason: errStr || "(denied)",
+    via,
+    rule,
+  };
+}
+
+/** Two denials are "the same" attempt when tool + command + rule + via match. */
+function sameDenial(a, b) {
+  return (
+    a &&
+    b &&
+    a.tool === b.tool &&
+    a.summary === b.summary &&
+    a.via === b.via &&
+    a.rule === b.rule
+  );
+}
+
+/**
+ * Append a denial to a bounded most-recent-last ring buffer (mutates + returns
+ * it). Drops the oldest entries beyond `max`. No-op on a bad log/record.
+ *
+ * Consecutive identical denials are COALESCED: a model that hits a policy block
+ * usually retries the same command several times, which would otherwise flood
+ * the cap and evict other distinct denials. A repeat bumps the last entry's
+ * `count` and refreshes its `at` instead of appending.
+ */
+export function recordDenial(log, record, max = MAX_RECENT_DENIALS) {
+  if (!Array.isArray(log) || !record) return log;
+  const last = log[log.length - 1];
+  if (sameDenial(last, record)) {
+    last.count = (last.count || 1) + 1;
+    if (typeof record.at === "number") last.at = record.at;
+    return log;
+  }
+  log.push(record);
+  while (log.length > max) log.shift();
+  return log;
+}
+
+/**
+ * Render the denial log most-recent-first for `/permissions denials`. Times are
+ * relative ("12s ago") when a record carries a numeric `at`; `now` is injectable
+ * for deterministic tests.
+ *
+ * @param {Array} log
+ * @param {{now?:number}} [opts]
+ * @returns {string}
+ */
+export function formatDenials(log, opts = {}) {
+  const now = typeof opts.now === "number" ? opts.now : Date.now();
+  if (!Array.isArray(log) || log.length === 0) {
+    return "  (no tool calls were denied this session)";
+  }
+  const lines = [`  Recent denials (most recent first, ${log.length}):`];
+  for (let i = log.length - 1; i >= 0; i--) {
+    const d = log[i] || {};
+    const ago =
+      typeof d.at === "number"
+        ? ` · ${Math.max(0, Math.round((now - d.at) / 1000))}s ago`
+        : "";
+    const where = d.rule ? `${d.via}:${d.rule}` : d.via || "policy";
+    const what = d.summary ? `${d.tool} ${d.summary}` : d.tool || "?";
+    const times = d.count > 1 ? ` ×${d.count}` : "";
+    lines.push(`  • ${what}${times}  [${where}${ago}]`);
+    if (d.reason) lines.push(`      ${d.reason}`);
+  }
+  return lines.join("\n");
+}

package/src/lib/runnable-provider.js

@@ -31,7 +31,13 @@ export function isAuthError(err) {
         : null;
   if (status === 401 || status === 403) return true;
   const msg = String(err.message || err).toLowerCase();
-  return /\b401\b|\b403\b|unauthorized|forbidden|authentication failed|api[\s_-]*key required|invalid api[\s_-]*key|incorrect api[\s_-]*key|expired/.test(
+  // `expired` must be AUTH-scoped (key/token/credential/secret), not bare:
+  // a TLS "certificate has expired" or "cache expired" is an infra error, and
+  // misclassifying it as auth would trigger an env-key VENDOR hijack on a
+  // keyless provider — masking the real problem (the same anti-hijack spirit
+  // as the rest of this module). A genuine 401/403 is still caught by status
+  // and the explicit auth phrases below.
+  return /\b401\b|\b403\b|unauthorized|forbidden|authentication failed|api[\s_-]*key required|invalid api[\s_-]*key|incorrect api[\s_-]*key|(?:api[\s_-]*key|token|credentials?|secret)[\s_-]*(?:has\s+|is\s+|was\s+)?expired|expired[\s_-]+(?:api[\s_-]*key|token|credentials?|secret)/.test(
     msg,
   );
 }

package/src/lib/safe-json.js

@@ -0,0 +1,22 @@
+/**
+ * safeJsonParse — JSON.parse that returns `fallback` instead of throwing on
+ * malformed (or null/empty) input.
+ *
+ * Use it for DB columns parsed inside a list `.map()` / loop: an unguarded
+ * `JSON.parse(row.col)` lets ONE corrupt cell throw out of the whole function,
+ * crashing the entire list load (the unguarded-JSON.parse-in-list-loop bug
+ * class — a single bad row should be skipped, not fail every other row).
+ *
+ * @param {unknown} text      the raw string (or null/undefined)
+ * @param {*} [fallback=null] returned on null/empty/parse failure
+ * @returns {*}
+ */
+export function safeJsonParse(text, fallback = null) {
+  if (text == null || text === "") return fallback;
+  try {
+    const v = JSON.parse(text);
+    return v == null ? fallback : v;
+  } catch {
+    return fallback;
+  }
+}