chainlesschain 0.162.125 → 0.162.126

package/src/gateways/ws/ws-session-gateway.js

@@ -123,6 +123,33 @@ export class WSSessionManager {
     this.maxPendingPatches = Number.isFinite(options.maxPendingPatches)
       ? options.maxPendingPatches
       : 50;
+    // The entry-count caps above bound how MANY patches are kept, but a SINGLE
+    // proposed patch (a client-reachable `patch-propose`) could still carry an
+    // unbounded number of files, each with unbounded before/after/diff content
+    // — all held in memory AND serialized to disk by _persistSessionState. One
+    // file with a multi-GB diff string is enough to OOM. Bound a single patch's
+    // payload: cap the file count and truncate each content field.
+    this.maxPatchFiles = Number.isFinite(options.maxPatchFiles)
+      ? options.maxPatchFiles
+      : 200;
+    this.maxPatchContentChars = Number.isFinite(options.maxPatchContentChars)
+      ? options.maxPatchContentChars
+      : 512 * 1024; // 512 KB per before/after/diff field
+  }
+
+  /**
+   * Truncate a patch content field (before/after/diff) to maxPatchContentChars,
+   * appending a visible marker. Preserves the null-vs-string distinction (a null
+   * field stays null — it signals create/delete ops). Pure.
+   */
+  _capPatchContent(value) {
+    if (value == null) return null;
+    const s = String(value);
+    if (s.length <= this.maxPatchContentChars) return s;
+    return (
+      s.slice(0, this.maxPatchContentChars) +
+      `\n…[truncated for storage: field was ${s.length} chars]`
+    );
   }
 
   _normalizeEnabledToolNames(enabledToolNames) {
@@ -854,8 +881,13 @@ export class WSSessionManager {
     const session = this.sessions.get(sessionId);
     if (!session) return null;
 
-    const files = Array.isArray(payload.files) ? payload.files : [];
-    if (files.length === 0) return null;
+    const rawFiles = Array.isArray(payload.files) ? payload.files : [];
+    if (rawFiles.length === 0) return null;
+    // Cap the per-patch file count; a proposal touching more than this is
+    // pathological for review. Excess files are dropped (count recorded below)
+    // so one message can't pin unbounded memory / disk.
+    const files = rawFiles.slice(0, this.maxPatchFiles);
+    const droppedFiles = rawFiles.length - files.length;
 
     const patchId = `patch-${this._generateId()}`;
     const now = new Date().toISOString();
@@ -866,9 +898,9 @@ export class WSSessionManager {
         index,
         path: file.path || `unknown-${index}`,
         op,
-        before: file.before == null ? null : String(file.before),
-        after: file.after == null ? null : String(file.after),
-        diff: file.diff == null ? null : String(file.diff),
+        before: this._capPatchContent(file.before),
+        after: this._capPatchContent(file.after),
+        diff: this._capPatchContent(file.diff),
         stats,
       };
     });
@@ -895,6 +927,8 @@ export class WSSessionManager {
         fileCount: normalizedFiles.length,
         added: totalStats.added,
         removed: totalStats.removed,
+        // Surfaced so the reviewer/UI knows the proposal was capped for storage.
+        ...(droppedFiles > 0 ? { droppedFiles } : {}),
       },
     };
 

package/src/harness/jsonl-session-store.js

@@ -113,20 +113,36 @@ export function readEvents(sessionId) {
   return events;
 }
 
+/**
+ * A replayable chat message must be a `{ role, content }` object — guard
+ * against a corrupt / partially-written / hand-edited event whose `data` is
+ * missing, null, or not a message (it would otherwise inject `undefined` into
+ * the resumed history and break the next LLM request).
+ */
+function isReplayableMessage(m) {
+  return Boolean(m) && typeof m === "object" && typeof m.role === "string";
+}
+
 export function rebuildMessages(sessionId) {
   const events = readEvents(sessionId);
   const messages = [];
   let lastCompactIndex = -1;
 
+  // A `compact` event carries the pre-compaction snapshot in data.messages. A
+  // malformed compact line (type present but data null / messages not an array)
+  // must not crash the resume — skip it and look further back.
   for (let i = events.length - 1; i >= 0; i--) {
-    if (events[i].type === "compact" && events[i].data.messages) {
+    const e = events[i];
+    if (e && e.type === "compact" && Array.isArray(e.data?.messages)) {
       lastCompactIndex = i;
       break;
     }
   }
 
-  if (lastCompactIndex >= 0 && events[lastCompactIndex].data.messages) {
-    messages.push(...events[lastCompactIndex].data.messages);
+  if (lastCompactIndex >= 0) {
+    for (const m of events[lastCompactIndex].data.messages) {
+      if (isReplayableMessage(m)) messages.push(m);
+    }
   }
 
   const startIndex = lastCompactIndex >= 0 ? lastCompactIndex + 1 : 0;
@@ -134,9 +150,11 @@ export function rebuildMessages(sessionId) {
   for (let i = startIndex; i < events.length; i++) {
     const event = events[i];
     if (
-      event.type === "user_message" ||
-      event.type === "assistant_message" ||
-      event.type === "system"
+      event &&
+      (event.type === "user_message" ||
+        event.type === "assistant_message" ||
+        event.type === "system") &&
+      isReplayableMessage(event.data)
     ) {
       messages.push(event.data);
     }
@@ -145,6 +163,19 @@ export function rebuildMessages(sessionId) {
   return messages;
 }
 
+/** ISO string for a numeric ms timestamp, or "" when missing / non-finite /
+ * invalid — `new Date(undefined).toISOString()` (and `new Date("garbage")`)
+ * throw "Invalid time value", and one corrupt event must not crash a whole
+ * `cc session list` / `cc session search`. Exported so command-layer readers of
+ * the same (hand-editable) JSONL share the guard. */
+export function toIsoSafe(ts) {
+  if (ts == null) return ""; // null/undefined → "" (Number(null) is 0 = epoch)
+  const n = Number(ts);
+  if (!Number.isFinite(n)) return "";
+  const d = new Date(n);
+  return Number.isNaN(d.getTime()) ? "" : d.toISOString();
+}
+
 export function listJsonlSessions(options = {}) {
   const dir = getSessionsDir();
   if (!existsSync(dir)) return [];
@@ -167,12 +198,8 @@ export function listJsonlSessions(options = {}) {
         provider: startEvent?.data?.provider || "",
         model: startEvent?.data?.model || "",
         message_count: messageCount,
-        created_at: startEvent
-          ? new Date(startEvent.timestamp).toISOString()
-          : "",
-        updated_at: lastEvent
-          ? new Date(lastEvent.timestamp).toISOString()
-          : "",
+        created_at: toIsoSafe(startEvent?.timestamp),
+        updated_at: toIsoSafe(lastEvent?.timestamp),
         _lastTs: lastEvent?.timestamp || 0,
         _eventCount: events.length,
       };

package/src/harness/worktree-isolator.js

@@ -550,6 +550,11 @@ function _hasUncommittedChanges(worktreePath) {
     const output = execSync("git status --porcelain", {
       cwd: worktreePath,
       encoding: "utf-8",
+      // A worktree with many dirty files produces >1 MB of porcelain output and
+      // would ENOBUFS on the default cap — the catch below then reports "clean"
+      // (fail-OPEN), which could let a caller discard a worktree full of
+      // uncommitted work. Give it the same 64 MB headroom as gitExec.
+      maxBuffer: 64 * 1024 * 1024,
     });
     return output.trim().length > 0;
   } catch (_e) {

package/src/lib/agent-core.js

@@ -29,6 +29,7 @@ export {
   killBackgroundShellTask,
   killAllBackgroundShellTasks,
   reapIdleBackgroundShellTasks,
+  _ingestSearchOutput,
   writeFileVerified,
   formatProviderHttpError,
   _accumulateOllamaStream,

package/src/lib/audit-logger.js

@@ -4,6 +4,7 @@
  */
 
 import crypto from "crypto";
+import { safeJsonParse } from "./safe-json.js";
 
 /**
  * Event types for audit logging.
@@ -232,7 +233,8 @@ export function queryLogs(db, filters = {}) {
   const rows = db.prepare(sql).all(...params);
   return rows.map((r) => ({
     ...r,
-    details: r.details ? JSON.parse(r.details) : null,
+    // One corrupt details cell must not throw out of the whole query.
+    details: safeJsonParse(r.details, null),
     success: r.success === 1,
   }));
 }

package/src/lib/chat-core.js

@@ -13,8 +13,8 @@ import { BUILT_IN_PROVIDERS } from "./llm-providers.js";
 import { appendTokenUsage } from "../harness/jsonl-session-store.js";
 import {
   isRetryableStreamError,
-  STREAM_RETRY_MAX,
   STREAM_RETRY_BASE_MS,
+  resolveStreamRetryMax,
 } from "./stream-retry.js";
 
 // A streaming chat call must not hang forever if the API accepts the connection
@@ -513,6 +513,9 @@ export async function* chatStream(messages, options) {
   // any token still terminates the generator cleanly.
   const streamPromise = (async () => {
     try {
+      // Budget honors CC_MAX_RETRIES / CLAUDE_CODE_MAX_RETRIES (capped 15),
+      // same as the agent path.
+      const maxRetries = resolveStreamRetryMax();
       let attempt = 0;
       for (;;) {
         try {
@@ -524,7 +527,7 @@ export async function* chatStream(messages, options) {
           // zero-output retry safety (cc agent parity). Stall aborts (180s) and
           // HTTP/auth errors are not retryable and surface immediately.
           if (
-            attempt >= STREAM_RETRY_MAX ||
+            attempt >= maxRetries ||
             tokensEmitted > 0 ||
             !isRetryableStreamError(err)
           ) {

package/src/lib/chat-intent-service.js

@@ -22,6 +22,40 @@ import { firstBalancedJson } from "./json-schema-output.js";
 
 const DEFAULT_INTENT_TIMEOUT_MS = 15000;
 
+/**
+ * Resolve the per-call intent-classification budget. `llmOptions.intentTimeoutMs`
+ * overrides the default; an explicit 0 disables the cap; NaN/negative/absent →
+ * default.
+ */
+function resolveIntentTimeout(llmOptions) {
+  const raw = llmOptions?.intentTimeoutMs;
+  if (raw === 0) return 0; // explicit disable
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : DEFAULT_INTENT_TIMEOUT_MS;
+}
+
+/**
+ * Bound an LLM call to the intent budget. chat-core has its OWN stall guard, but
+ * it only fires on SILENCE (no bytes for 180s) — a slow trickling stream never
+ * trips it, so without this the declared 15s intent budget was never enforced
+ * and classification could block for minutes. Racing the deadline makes it fail
+ * fast into the caller's graceful rule/verbatim fallback. `ms <= 0` disables.
+ * The losing background request is harmless (chat-core releases its own socket);
+ * the timer is unref'd so it never holds the process open.
+ */
+function withIntentTimeout(promise, ms) {
+  if (!(Number(ms) > 0)) return promise;
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(
+      () => reject(new Error(`intent LLM call timed out after ${ms}ms`)),
+      Number(ms),
+    );
+    if (timer && typeof timer.unref === "function") timer.unref();
+  });
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+
 /**
  * Build the V5 understandIntent system + user prompt pair.
  *
@@ -123,17 +157,20 @@ export async function understandIntent({
   );
 
   try {
-    const fullContent = await chatWithStreaming(
-      [
-        { role: "system", content: systemPrompt },
-        { role: "user", content: userPrompt },
-      ],
-      {
-        ...llmOptions,
-        // Lower temperature → more deterministic JSON output.
-        temperature: 0.3,
-        maxTokens: 500,
-      },
+    const fullContent = await withIntentTimeout(
+      chatWithStreaming(
+        [
+          { role: "system", content: systemPrompt },
+          { role: "user", content: userPrompt },
+        ],
+        {
+          ...llmOptions,
+          // Lower temperature → more deterministic JSON output.
+          temperature: 0.3,
+          maxTokens: 500,
+        },
+      ),
+      resolveIntentTimeout(llmOptions),
     );
 
     const jsonText = extractJson(fullContent);
@@ -204,6 +241,11 @@ export async function* understandIntentStream({
   );
   let buffer = "";
   try {
+    // Incremental token yielding makes a per-call deadline awkward to apply
+    // here; this streaming variant is instead bounded by chat-core's own
+    // silence-based stall guard (CC_CHAT_STALL_MS, default 180s). The awaited
+    // understandIntent / classifyFollowupIntent paths enforce the tighter
+    // intent budget (resolveIntentTimeout) directly.
     for await (const event of chatStream(
       [
         { role: "system", content: systemPrompt },
@@ -452,16 +494,19 @@ ${
 
 async function llmBasedClassify(userInput, context, llmOptions) {
   const { systemPrompt, userPrompt } = buildFollowupPrompts(userInput, context);
-  const fullContent = await chatWithStreaming(
-    [
-      { role: "system", content: systemPrompt },
-      { role: "user", content: userPrompt },
-    ],
-    {
-      ...llmOptions,
-      temperature: 0.1,
-      maxTokens: 300,
-    },
+  const fullContent = await withIntentTimeout(
+    chatWithStreaming(
+      [
+        { role: "system", content: systemPrompt },
+        { role: "user", content: userPrompt },
+      ],
+      {
+        ...llmOptions,
+        temperature: 0.1,
+        maxTokens: 300,
+      },
+    ),
+    resolveIntentTimeout(llmOptions),
   );
   const jsonText = extractJson(fullContent);
   if (!jsonText) throw new Error("LLM response missing JSON");
@@ -540,5 +585,7 @@ export const _internal = {
   buildFollowupPrompts,
   extractJson,
   ruleBasedClassify,
+  resolveIntentTimeout,
+  withIntentTimeout,
   DEFAULT_INTENT_TIMEOUT_MS,
 };

package/src/lib/config-manager.js

@@ -11,6 +11,16 @@ import { getConfigPath } from "./paths.js";
 import { DEFAULT_CONFIG } from "../constants.js";
 import { withFileLock } from "./with-file-lock.js";
 
+// Warn at most once per config path per process. Injectable seam: the default
+// stays silent under vitest so test output isn't polluted; tests override
+// `_deps.warn` to assert it fired.
+const _warnedConfigPaths = new Set();
+export const _deps = {
+  warn: (msg) => {
+    if (!process.env.VITEST) process.stderr.write(msg);
+  },
+};
+
 export function loadConfig() {
   const configPath = getConfigPath();
   if (!existsSync(configPath)) {
@@ -20,7 +30,21 @@ export function loadConfig() {
     const raw = readFileSync(configPath, "utf-8");
     const parsed = JSON.parse(raw);
     return deepMerge(structuredClone(DEFAULT_CONFIG), parsed);
-  } catch {
+  } catch (err) {
+    // The file EXISTS but couldn't be read/parsed (a typo, trailing comma, or
+    // truncated write). Silently returning defaults drops the user's entire
+    // config — provider, model, baseUrl, API key — and falls back to the
+    // default provider, producing a baffling "configured X but it runs Y / says
+    // no API key". Warn once so the failure is visible; still fall back so cc
+    // keeps working.
+    if (!_warnedConfigPaths.has(configPath)) {
+      _warnedConfigPaths.add(configPath);
+      _deps.warn(
+        `⚠️  Could not read config at ${configPath} (${err.message}). ` +
+          `Using defaults — your saved settings (provider / model / API key) are being IGNORED. ` +
+          `Fix the JSON to restore them.\n`,
+      );
+    }
     return { ...structuredClone(DEFAULT_CONFIG) };
   }
 }

package/src/lib/credential-guard.js

@@ -149,7 +149,10 @@ export function credentialFileReasonResolved(targetPath, opts = {}) {
 // ── secret ENV-VAR + command detection ──────────────────────────────────────
 
 // Content-reader commands: when one of these is aimed at a credential file, the
-// file's bytes land in the agent's tool output.
+// file's bytes land in the agent's tool output. Includes text processors
+// (awk/sed), encoders (base64), and field/byte slicers — all of which dump a
+// file's content just like `cat`, so an agent told to "read the .env" can't
+// route around the guard with `base64 .env` / `awk '{print}' .env`.
 const READ_COMMANDS = new Set([
   "cat",
   "tac",
@@ -165,8 +168,31 @@ const READ_COMMANDS = new Set([
   "xxd",
   "od",
   "strings",
+  "awk",
+  "gawk",
+  "mawk",
+  "sed",
+  "base64",
+  "base32",
+  "cut",
+  "rev",
+  "sort",
+  "uniq",
+  "tr",
+  "fold",
+  "expand",
+  "unexpand",
+  "column",
+  "paste",
+  "pr",
 ]);
 
+// grep-family is a content-reader too, but its FIRST non-flag arg is the search
+// PATTERN (which may itself look credential-ish, e.g. `grep "id_rsa" notes.txt`)
+// — so it is handled separately, checking only the FILE args after the pattern,
+// to keep the guard precise (no false positive on the pattern).
+const GREP_COMMANDS = new Set(["grep", "egrep", "fgrep", "rg", "ag"]);
+
 // Commands whose job is to print a value into output — the exfil surface for a
 // secret env var (a tool that merely CONSUMES `$API_KEY` does not echo it).
 const PRINT_COMMANDS = new Set([
@@ -281,6 +307,22 @@ export function commandReadsCredentials(command) {
       }
     }
 
+    // (b2) grep-family: skip the search pattern (first non-flag arg) and check
+    //      only the file args, so `grep KEY .env` is caught but `grep "id_rsa"
+    //      notes.txt` (searching FOR that text) is not a false positive.
+    if (GREP_COMMANDS.has(first)) {
+      for (const tok of nonFlagArgs.slice(1)) {
+        const r = credentialFileReason(tok);
+        if (r)
+          return {
+            reason: `reads ${r}`,
+            kind: "file",
+            target: tok,
+            segment: seg,
+          };
+      }
+    }
+
     // (c) printing / reading a secret-looking env var (via $VAR / %VAR% / env:).
     if (PRINT_COMMANDS.has(first) || READ_COMMANDS.has(first)) {
       const vars = referencedSecretVars(seg);

package/src/lib/git-integration.js

@@ -105,6 +105,11 @@ export function gitExec(args, cwd) {
     return execSync(`git ${args}`, {
       cwd,
       encoding: "utf-8",
+      // git diff/log/worktree-list output on a large repo easily exceeds
+      // execSync's 1 MB default → ENOBUFS. Match gitExecArgs' 64 MB ceiling so
+      // a big diff/log doesn't spuriously fail (e.g. worktree-diff's --numstat
+      // pass, which isn't wrapped in a degrade-gracefully try/catch).
+      maxBuffer: 64 * 1024 * 1024,
       stdio: ["pipe", "pipe", "pipe"],
     }).trim();
   } catch (err) {

package/src/lib/interaction-adapter.js

@@ -159,7 +159,15 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
         },
         options.timeoutMs || 5 * 60 * 1000,
       );
-      this._pending.set(requestId, { resolve, reject, timeoutId });
+      // `kind` tags what KIND of response settles this request ("question" vs
+      // "host-tool"). Checked in _resolvePending so a peer's session-answer can
+      // never resolve a host-tool call with a plain string (or vice versa).
+      this._pending.set(requestId, {
+        resolve,
+        reject,
+        timeoutId,
+        kind: options.kind || null,
+      });
 
       this._sendWs({
         ...message,
@@ -170,12 +178,15 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
   }
 
   _ask(questionType, question, extra = {}) {
-    return this._request({
-      type: "question",
-      questionType,
-      question,
-      ...extra,
-    });
+    return this._request(
+      {
+        type: "question",
+        questionType,
+        question,
+        ...extra,
+      },
+      { kind: "question" },
+    );
   }
 
   async askInput(question, options = {}) {
@@ -200,7 +211,7 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
    * Resolves the corresponding pending promise.
    */
   resolveAnswer(requestId, answer) {
-    this._resolvePending(requestId, answer);
+    this._resolvePending(requestId, answer, "question");
   }
 
   async requestHostTool(toolName, args = {}, extra = {}) {
@@ -211,12 +222,12 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
         args,
         ...extra,
       },
-      { timeoutMs: extra.timeoutMs || 60 * 1000 },
+      { timeoutMs: extra.timeoutMs || 60 * 1000, kind: "host-tool" },
     );
   }
 
   resolveHostTool(requestId, payload) {
-    this._resolvePending(requestId, payload);
+    this._resolvePending(requestId, payload, "host-tool");
   }
 
   rejectAllPending(reason = createAbortError("Interaction interrupted")) {
@@ -310,11 +321,21 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
     }
   }
 
-  _resolvePending(requestId, payload) {
+  _resolvePending(requestId, payload, expectedKind = null) {
     const pending = this._pending.get(requestId);
     if (!pending) {
       return;
     }
+    // Kind guard: a question-answer must not settle a host-tool request (or
+    // vice versa). On a mismatch, IGNORE the message — leave the request pending
+    // so its correct resolver (or its timeout) can still settle it. Prevents a
+    // peer from resolving a host-tool call with a plain question string, or a
+    // question with a structured tool payload (type confusion of the awaited
+    // value). Backward-compatible: callers passing no expectedKind, and
+    // pre-kind pending entries, behave exactly as before.
+    if (expectedKind && pending.kind && pending.kind !== expectedKind) {
+      return;
+    }
 
     this._pending.delete(requestId);
     if (pending.timeoutId) {

package/src/lib/jsonl-session-store.js

@@ -32,4 +32,5 @@ export {
   sessionPath,
   isUnsafeSessionId,
   appendTokenUsage,
+  toIsoSafe,
 } from "../harness/jsonl-session-store.js";

package/src/lib/llm-config-defaults.js

@@ -17,6 +17,43 @@
  *    lesson as the --settings "opus"→404 vision trap.
  *  - No configured provider → unchanged (runner defaults apply: ollama).
  */
+/**
+ * Reconcile a MISLABELED llm config/options object. The `baseUrl` is the
+ * authoritative signal of which provider you actually reach, so when `provider`
+ * disagrees with the provider its `baseUrl` belongs to, the config is simply
+ * mislabeled — the recurring "provider:anthropic + volces baseUrl + model:haiku"
+ * corruption that makes runnable-provider relabel (and emit "provider 配置与
+ * baseUrl 不一致") on EVERY run because the on-disk config never gets fixed.
+ *
+ * Correct `provider` to match the endpoint, and if the model is foreign to the
+ * corrected provider, replace it with that provider's default. Pure: the input
+ * is never mutated — returns `{ llm, changed }` where `llm` is the original
+ * object (changed:false) or a corrected shallow copy (changed:true). Works for
+ * both a `config.llm` block and a resolved request-`options` (same shape).
+ *
+ * `inferProviderFromBaseUrl` returns null for unknown/custom hosts (proxies),
+ * so an intentionally-custom endpoint is left untouched.
+ */
+export async function reconcileConfigLlmProvider(cfgLlm = {}) {
+  if (!cfgLlm || !cfgLlm.provider || !cfgLlm.baseUrl) {
+    return { llm: cfgLlm, changed: false };
+  }
+  const { inferProviderFromBaseUrl, modelForeignToProvider } =
+    await import("./runnable-provider.js");
+  const inferred = inferProviderFromBaseUrl(cfgLlm.baseUrl);
+  if (!inferred || inferred === cfgLlm.provider) {
+    return { llm: cfgLlm, changed: false };
+  }
+  const corrected = { ...cfgLlm, provider: inferred };
+  if (modelForeignToProvider(inferred, cfgLlm.model)) {
+    const { selectModelForTask, TaskType } =
+      await import("./task-model-selector.js");
+    const def = selectModelForTask(inferred, TaskType.CHAT);
+    if (def) corrected.model = def;
+  }
+  return { llm: corrected, changed: true };
+}
+
 export function applyConfigLlmDefaults(options = {}, cfgLlm = {}, opts = {}) {
   // The IDE chat panel pins --provider/--model (read from config) but DROPS
   // --base-url/--api-key. With an explicit --provider the block below bails, so