chainlesschain 0.162.124 → 0.162.126

package/src/repl/agent-repl.js

@@ -29,6 +29,11 @@ import {
   analyzeContinuation,
   joinContinuation,
 } from "../lib/repl-multiline.js";
+import {
+  classifyDenial,
+  recordDenial,
+  formatDenials,
+} from "../lib/repl-denials.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   createSession,
@@ -84,6 +89,7 @@ import { formatBackgroundTasks } from "./tasks-status.js";
 import { expandFileRefsAsync } from "../runtime/file-ref-expander.js";
 import { prepareVisionTurn } from "../lib/image-input.js";
 import { composeSystemPrompt } from "../runtime/system-prompt.js";
+import { installPipeSafety } from "../runtime/pipe-safety.js";
 import {
   makeFallbackChatFn,
   normalizeFallbackModels,
@@ -117,6 +123,14 @@ let _settingsHooks = null;
 // `!command` auto-triggers an assistant response to its output. undefined =
 // unset → defaults OFF (opt-in) in shouldRespondToBashCommands.
 let _respondToBash;
+// .claude/settings.json `autoMode.classifyAllShell` (Claude-Code 2.1.193): route
+// the built-in verification allowlist through the shell-policy classifier (→
+// ApprovalGate confirm) instead of fast-pathing it. false = unset → off.
+let _classifyAllShell = false;
+// Bounded log of tool calls the agent was BLOCKED from running this session
+// (shell-policy / ApprovalGate / settings rule / hook). Surfaced by
+// `/permissions denials` (Claude-Code 2.1.193 "recent denials"). In-memory only.
+const _recentDenials = [];
 
 /**
  * Fire settings.json Notification hooks (observe-only) — the agent needs the
@@ -179,13 +193,17 @@ async function executeTool(name, args) {
     permissionRules: _permissionRules,
     permissionConfirm: _permissionConfirm,
     settingsHooks: _settingsHooks,
+    classifyAllShell: _classifyAllShell,
   });
 }
 
 /**
  * Agentic loop — wraps agent-core's async generator with REPL display output.
+ * Exported so its event-translation contract (checkpoint-mark accuracy for
+ * `/rewind`, content/usage extraction, forced-off in-loop compaction) is
+ * unit-testable via the `options._coreLoop` injection seam.
  */
-async function agentLoop(messages, options) {
+export async function agentLoop(messages, options) {
   // Resume-degenerate role merge (Claude Code 2.1.187 parity), gated by the
   // one-shot `mergeRoles` flag so it fires only on the first model call after
   // resuming a session whose prior run produced no assistant response. Collapse
@@ -211,12 +229,19 @@ async function agentLoop(messages, options) {
           `\n  ⚠️  ${info.message || `已从 "${info.from}" 切换到 "${info.to}"`}\n`,
         ),
       ));
-  // The REPL runs its own auto-compaction (after each turn, with metrics +
-  // persisted compact events), so opt out of the agent loop's in-loop
-  // compaction to avoid compacting the same history twice.
-  for await (const event of coreAgentLoop(messages, {
-    autoCompact: false,
+  // `_coreLoop` is an injectable seam (defaults to agent-core's loop) so the
+  // wrapper's event translation can be unit-tested without a live model.
+  const runCoreLoop = options._coreLoop || coreAgentLoop;
+  // The tool-result event carries no args; remember the last tool-executing
+  // pair so a recorded denial can show what was attempted (/permissions denials).
+  let _lastExec = null;
+  for await (const event of runCoreLoop(messages, {
     ...options,
+    // FORCE in-loop compaction off — the REPL runs its OWN post-turn compaction
+    // (with metrics + persisted compact events), so letting agent-core compact
+    // too would trim the same history twice. Placed AFTER the spread so a
+    // caller's options.autoCompact can never silently re-enable the double pass.
+    autoCompact: false,
     onProviderFallback,
   })) {
     if (event.type === "checkpoint") {
@@ -235,6 +260,7 @@ async function agentLoop(messages, options) {
         chalk.gray(`  ⎌ checkpoint ${event.id} (before ${event.tool})\n`),
       );
     } else if (event.type === "tool-executing") {
+      _lastExec = { tool: event.tool, args: event.args };
       process.stdout.write(
         chalk.gray(
           `  [${event.tool}] ${formatToolArgs(event.tool, event.args)}\n`,
@@ -245,6 +271,24 @@ async function agentLoop(messages, options) {
         process.stdout.write(
           chalk.red(`  Error: ${event.error || event.result?.error}\n`),
         );
+        // Record policy denials (not plain tool failures) into the caller's
+        // denial log for review via `/permissions denials` (Claude-Code 2.1.193
+        // recent denials). Caller passes the session log (mirrors checkpointMarks)
+        // so the wrapper stays unit-testable.
+        if (Array.isArray(options.denialLog)) {
+          const denial = classifyDenial({
+            tool: event.tool,
+            result: event.result,
+            error: event.error,
+            argsSummary:
+              _lastExec && _lastExec.tool === event.tool
+                ? formatToolArgs(event.tool, _lastExec.args)
+                : "",
+          });
+          if (denial) {
+            recordDenial(options.denialLog, { ...denial, at: Date.now() });
+          }
+        }
         // Parity with Desktop AIChatPage's `Switch to Trusted` button:
         // when the deny came from ApprovalGate (not shell-policy), surface
         // the exact CLI command the user can run to relax the per-session
@@ -297,6 +341,27 @@ async function agentLoop(messages, options) {
  * Start the agentic REPL
  */
 export async function startAgentRepl(options = {}) {
+  // EPIPE guard: if the REPL's stdout is piped and the consumer closes (e.g.
+  // `cc agent | head`), the async stream `error` would otherwise crash the
+  // process. Route a broken pipe into the REPL's own graceful shutdown (the
+  // rl "close" handler — MCP disconnect, kill background tasks) when the
+  // interface exists, else exit cleanly. `_replClosing` makes it fire once so a
+  // cleanup write that also EPIPEs can't loop. `_replRl` is set when rl is built.
+  let _replRl = null;
+  let _replClosing = false;
+  installPipeSafety(undefined, () => {
+    if (_replClosing) return;
+    _replClosing = true;
+    if (_replRl) {
+      try {
+        _replRl.close(); // triggers the graceful "close" cleanup → process.exit
+        return;
+      } catch {
+        /* fall through to a bare exit */
+      }
+    }
+    process.exit(0);
+  });
   let model = options.model || "qwen2.5:7b";
   let provider = options.provider || "ollama";
   // Extended thinking (Anthropic; opt-in via --think/--ultrathink). Carried from
@@ -481,6 +546,11 @@ export async function startAgentRepl(options = {}) {
     _respondToBash = readBooleanSetting("respondToBashCommands", {
       cwd: process.cwd(),
     });
+    // Claude-Code 2.1.193 autoMode.classifyAllShell (default OFF when unset).
+    _classifyAllShell =
+      readBooleanSetting("autoMode.classifyAllShell", {
+        cwd: process.cwd(),
+      }) === true;
     const total =
       loaded.rules.allow.length +
       loaded.rules.ask.length +
@@ -516,12 +586,21 @@ export async function startAgentRepl(options = {}) {
   // PostToolUse). The interactive _permissionConfirm above doubles as the
   // confirmer for a hook `ask` decision.
   try {
-    const { loadHooks } = await import("../lib/settings-hooks.cjs");
+    const { loadHooks, projectHookTrustNotice } =
+      await import("../lib/settings-hooks.cjs");
     const loaded = loadHooks({ cwd: process.cwd() });
     _settingsHooks =
       loaded.hooks && Object.keys(loaded.hooks).length > 0
         ? loaded.hooks
         : null;
+    // First-run trust notice for an untrusted/cloned repo's shell-running
+    // hooks (Claude-Code 2.1.195 parity). Best-effort, stderr-only.
+    try {
+      const notice = projectHookTrustNotice({ cwd: process.cwd() });
+      if (notice) process.stderr.write(notice + "\n");
+    } catch {
+      /* trust notice is best-effort */
+    }
   } catch (_err) {
     _settingsHooks = null;
   }
@@ -779,6 +858,10 @@ export async function startAgentRepl(options = {}) {
           // (parity with headless; auto-detect already works via process.env).
           ide: options.ide,
           pdh: options.pdh,
+          // IDEA built-in MCP (server `idea`): auto-connect when the JetBrains
+          // plugin injected CHAINLESSCHAIN_JETBRAINS_MCP_URL. --jetbrains forces,
+          // --no-jetbrains disables.
+          jetbrains: options.jetbrains,
           cwd: process.cwd(),
           // advertise the session id to spawned stdio MCP servers
           sessionId,
@@ -1030,6 +1113,9 @@ export async function startAgentRepl(options = {}) {
     terminal: true,
     completer: atCompleter,
   });
+  // Let the EPIPE guard route a broken pipe through this interface's graceful
+  // "close" cleanup instead of a bare exit.
+  _replRl = rl;
 
   // Vim-mode plumbing: capture readline's OWN keypress listeners now so we can
   // suspend them while in NORMAL mode (the engine drives editing then) and
@@ -1453,7 +1539,7 @@ export async function startAgentRepl(options = {}) {
         `  ${chalk.cyan("/cost")}       Session token spend + estimated $ (per model & category)`,
       );
       logger.log(
-        `  ${chalk.cyan("/permissions")} Allow/ask/deny rules; set/cycle tier (/permissions <tier> · Shift+Tab cycles)`,
+        `  ${chalk.cyan("/permissions")} Allow/ask/deny rules; set/cycle tier (/permissions <tier> · Shift+Tab); /permissions denials to review blocked calls`,
       );
       logger.log(
         `  ${chalk.cyan("/export")}     Save this conversation to a Markdown file (/export [path])`,
@@ -3005,6 +3091,13 @@ export async function startAgentRepl(options = {}) {
     // parity): what the agent runs unprompted, asks about, or is blocked from.
     if (trimmed === "/permissions" || trimmed.startsWith("/permissions ")) {
       const arg = trimmed.slice("/permissions".length).trim();
+      if (arg === "denials" || arg === "denied") {
+        // Review what the agent was BLOCKED from running this session
+        // (Claude-Code 2.1.193 "recent denials").
+        logger.log(formatDenials(_recentDenials));
+        prompt();
+        return;
+      }
       if (arg) {
         // Set this session's approval tier mid-session (Claude-Code
         // permission-mode / Shift+Tab parity; mirrors `cc session policy --set`).
@@ -3050,6 +3143,13 @@ export async function startAgentRepl(options = {}) {
           "  Set tier mid-session: /permissions <strict|trusted|autopilot>",
         ),
       );
+      if (_recentDenials.length) {
+        logger.log(
+          chalk.gray(
+            `  ${_recentDenials.length} tool call(s) denied this session — /permissions denials to review`,
+          ),
+        );
+      }
       prompt();
       return;
     }
@@ -3482,11 +3582,13 @@ export async function startAgentRepl(options = {}) {
         autoCheckpoint,
         checkpointSession: sessionId,
         checkpointMarks: _checkpointMarks,
+        denialLog: _recentDenials,
         prepareCall,
         approvalGate: _approvalGate,
         permissionRules: _permissionRules,
         permissionConfirm: _permissionConfirm,
         settingsHooks: _settingsHooks,
+        classifyAllShell: _classifyAllShell,
         // Interactive session: gate run_code through the ApprovalGate (like
         // run_shell) so a strict tier prompts before arbitrary code runs.
         interactiveApproval: true,

package/src/runtime/__tests__/message-roles.test.js

@@ -51,13 +51,38 @@ describe("mergeConsecutiveMessages", () => {
     // A multi-tool turn produces back-to-back `tool` results — folding them
     // would drop tool_call_ids and corrupt the tool-call pairing.
     const msgs = [
-      { role: "assistant", content: "", tool_calls: [{ id: "a" }, { id: "b" }] },
+      {
+        role: "assistant",
+        content: "",
+        tool_calls: [{ id: "a" }, { id: "b" }],
+      },
       { role: "tool", content: "r1", tool_call_id: "a" },
       { role: "tool", content: "r2", tool_call_id: "b" },
     ];
     expect(mergeConsecutiveMessages(msgs)).toEqual(msgs);
   });
 
+  it("never merges a structured assistant tool-call turn (tool_calls preserved)", () => {
+    // Two consecutive assistants where the SECOND carries tool_calls — folding
+    // would drop them (orphaning the result) and the strict API would 400.
+    const msgs = [
+      { role: "assistant", content: "let me check" },
+      { role: "assistant", content: "", tool_calls: [{ id: "c1" }] },
+      { role: "tool", content: "result", tool_call_id: "c1" },
+    ];
+    expect(mergeConsecutiveMessages(msgs)).toEqual(msgs);
+  });
+
+  it("never folds two consecutive assistants when the FIRST has tool_calls", () => {
+    // e.g. after a compaction dropped the tool results — merging would mutate
+    // the structured turn's content and keep its now-unanswered tool_calls.
+    const msgs = [
+      { role: "assistant", content: "", tool_calls: [{ id: "a" }] },
+      { role: "assistant", content: "fallback text" },
+    ];
+    expect(mergeConsecutiveMessages(msgs)).toEqual(msgs);
+  });
+
   it("never merges system messages (leading base + context pair kept distinct)", () => {
     const msgs = [
       { role: "system", content: "base" },
@@ -202,14 +227,22 @@ describe("collapseConsecutiveMessagesInPlace", () => {
     const messages = [
       { role: "user", content: "u1" },
       { role: "user", content: "u2" },
-      { role: "assistant", content: "", tool_calls: [{ id: "a" }, { id: "b" }] },
+      {
+        role: "assistant",
+        content: "",
+        tool_calls: [{ id: "a" }, { id: "b" }],
+      },
       { role: "tool", content: "r1", tool_call_id: "a" },
       { role: "tool", content: "r2", tool_call_id: "b" },
     ];
     expect(collapseConsecutiveMessagesInPlace(messages)).toBe(true);
     expect(messages).toEqual([
       { role: "user", content: "u1\n\nu2" },
-      { role: "assistant", content: "", tool_calls: [{ id: "a" }, { id: "b" }] },
+      {
+        role: "assistant",
+        content: "",
+        tool_calls: [{ id: "a" }, { id: "b" }],
+      },
       { role: "tool", content: "r1", tool_call_id: "a" },
       { role: "tool", content: "r2", tool_call_id: "b" },
     ]);