chainlesschain 0.162.125 → 0.162.126

package/src/lib/social-graph.js

@@ -22,6 +22,7 @@
  */
 
 import { EventEmitter } from "events";
+import { safeJsonParse } from "./safe-json.js";
 
 /* ── Edge types ────────────────────────────────────────────── */
 
@@ -325,7 +326,8 @@ export function loadFromDb(db) {
     )
     .all();
   for (const row of rows) {
-    const metadata = row.metadata ? JSON.parse(row.metadata) : null;
+    // A single corrupt metadata cell must not crash the whole graph load.
+    const metadata = safeJsonParse(row.metadata, null);
     // Hydrate without re-emitting events (bulk load).
     _hydrateEdge({
       sourceDid: row.source_did,

package/src/lib/stream-retry.js

@@ -18,6 +18,33 @@ import { isAbortError } from "./abort-utils.js";
 export const STREAM_RETRY_MAX = 2;
 export const STREAM_RETRY_BASE_MS = 400;
 
+/**
+ * Hard ceiling on the *configurable* retry budget (Claude-Code 2.1.186:
+ * "CLAUDE_CODE_MAX_RETRIES capped at 15") — keeps a stray huge value from
+ * turning a dead endpoint into a multi-minute exponential-backoff hang.
+ */
+export const STREAM_RETRY_MAX_CAP = 15;
+
+/**
+ * Resolve the streaming-retry budget. Users can raise (or lower) the default
+ * via `CC_MAX_RETRIES` (native) or `CLAUDE_CODE_MAX_RETRIES` (Claude-Code
+ * parity); the value is clamped to `[0, STREAM_RETRY_MAX_CAP]`. Unset / blank /
+ * non-numeric falls back to the default `STREAM_RETRY_MAX`; a negative value
+ * clamps to 0 (retries disabled). `CC_MAX_RETRIES` wins when both are set.
+ *
+ * @param {Record<string,string|undefined>} [env=process.env]
+ * @returns {number}
+ */
+export function resolveStreamRetryMax(env = process.env) {
+  const raw = env.CC_MAX_RETRIES ?? env.CLAUDE_CODE_MAX_RETRIES;
+  if (raw == null || String(raw).trim() === "") return STREAM_RETRY_MAX;
+  const n = Number.parseInt(String(raw).trim(), 10);
+  if (!Number.isFinite(n)) return STREAM_RETRY_MAX;
+  if (n < 0) return 0;
+  if (n > STREAM_RETRY_MAX_CAP) return STREAM_RETRY_MAX_CAP;
+  return n;
+}
+
 /**
  * Is this error from a streaming chat request a transient API CONNECTION drop
  * that is safe to retry? True only for genuine network failures (reset /

package/src/lib/turn-context.js

@@ -30,6 +30,9 @@ function _git(cmd, cwd) {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "ignore"],
         timeout: 1500,
+        // `status --porcelain` on a dirty repo with many files can exceed the
+        // 1 MB execSync default → ENOBUFS → null → "(clean)" misreport below.
+        maxBuffer: 16 * 1024 * 1024,
       })
       .trim();
   } catch (_e) {
@@ -61,11 +64,18 @@ export function buildTurnContext({
   if (branch) {
     const head = _git("rev-parse --short HEAD", cwd);
     const status = _git("status --porcelain", cwd);
-    const dirty = status && status.length > 0;
-    const fileCount = dirty ? status.split("\n").filter(Boolean).length : 0;
-    lines.push(
-      `- git: ${branch}@${head || "?"}${dirty ? ` (${fileCount} uncommitted)` : " (clean)"}`,
-    );
+    // Distinguish "command failed" (null — timeout / huge output) from "" (truly
+    // clean): the old `status && …` reported a repo as "(clean)" whenever status
+    // couldn't be determined, which is a wrong signal to the model.
+    let stateLabel;
+    if (status === null) {
+      stateLabel = " (status unknown)";
+    } else if (status.length > 0) {
+      stateLabel = ` (${status.split("\n").filter(Boolean).length} uncommitted)`;
+    } else {
+      stateLabel = " (clean)";
+    }
+    lines.push(`- git: ${branch}@${head || "?"}${stateLabel}`);
   }
 
   if (sessionId) {

package/src/repl/agent-repl.js

@@ -29,6 +29,11 @@ import {
   analyzeContinuation,
   joinContinuation,
 } from "../lib/repl-multiline.js";
+import {
+  classifyDenial,
+  recordDenial,
+  formatDenials,
+} from "../lib/repl-denials.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   createSession,
@@ -118,6 +123,14 @@ let _settingsHooks = null;
 // `!command` auto-triggers an assistant response to its output. undefined =
 // unset → defaults OFF (opt-in) in shouldRespondToBashCommands.
 let _respondToBash;
+// .claude/settings.json `autoMode.classifyAllShell` (Claude-Code 2.1.193): route
+// the built-in verification allowlist through the shell-policy classifier (→
+// ApprovalGate confirm) instead of fast-pathing it. false = unset → off.
+let _classifyAllShell = false;
+// Bounded log of tool calls the agent was BLOCKED from running this session
+// (shell-policy / ApprovalGate / settings rule / hook). Surfaced by
+// `/permissions denials` (Claude-Code 2.1.193 "recent denials"). In-memory only.
+const _recentDenials = [];
 
 /**
  * Fire settings.json Notification hooks (observe-only) — the agent needs the
@@ -180,13 +193,17 @@ async function executeTool(name, args) {
     permissionRules: _permissionRules,
     permissionConfirm: _permissionConfirm,
     settingsHooks: _settingsHooks,
+    classifyAllShell: _classifyAllShell,
   });
 }
 
 /**
  * Agentic loop — wraps agent-core's async generator with REPL display output.
+ * Exported so its event-translation contract (checkpoint-mark accuracy for
+ * `/rewind`, content/usage extraction, forced-off in-loop compaction) is
+ * unit-testable via the `options._coreLoop` injection seam.
  */
-async function agentLoop(messages, options) {
+export async function agentLoop(messages, options) {
   // Resume-degenerate role merge (Claude Code 2.1.187 parity), gated by the
   // one-shot `mergeRoles` flag so it fires only on the first model call after
   // resuming a session whose prior run produced no assistant response. Collapse
@@ -212,12 +229,19 @@ async function agentLoop(messages, options) {
           `\n  ⚠️  ${info.message || `已从 "${info.from}" 切换到 "${info.to}"`}\n`,
         ),
       ));
-  // The REPL runs its own auto-compaction (after each turn, with metrics +
-  // persisted compact events), so opt out of the agent loop's in-loop
-  // compaction to avoid compacting the same history twice.
-  for await (const event of coreAgentLoop(messages, {
-    autoCompact: false,
+  // `_coreLoop` is an injectable seam (defaults to agent-core's loop) so the
+  // wrapper's event translation can be unit-tested without a live model.
+  const runCoreLoop = options._coreLoop || coreAgentLoop;
+  // The tool-result event carries no args; remember the last tool-executing
+  // pair so a recorded denial can show what was attempted (/permissions denials).
+  let _lastExec = null;
+  for await (const event of runCoreLoop(messages, {
     ...options,
+    // FORCE in-loop compaction off — the REPL runs its OWN post-turn compaction
+    // (with metrics + persisted compact events), so letting agent-core compact
+    // too would trim the same history twice. Placed AFTER the spread so a
+    // caller's options.autoCompact can never silently re-enable the double pass.
+    autoCompact: false,
     onProviderFallback,
   })) {
     if (event.type === "checkpoint") {
@@ -236,6 +260,7 @@ async function agentLoop(messages, options) {
         chalk.gray(`  ⎌ checkpoint ${event.id} (before ${event.tool})\n`),
       );
     } else if (event.type === "tool-executing") {
+      _lastExec = { tool: event.tool, args: event.args };
       process.stdout.write(
         chalk.gray(
           `  [${event.tool}] ${formatToolArgs(event.tool, event.args)}\n`,
@@ -246,6 +271,24 @@ async function agentLoop(messages, options) {
         process.stdout.write(
           chalk.red(`  Error: ${event.error || event.result?.error}\n`),
         );
+        // Record policy denials (not plain tool failures) into the caller's
+        // denial log for review via `/permissions denials` (Claude-Code 2.1.193
+        // recent denials). Caller passes the session log (mirrors checkpointMarks)
+        // so the wrapper stays unit-testable.
+        if (Array.isArray(options.denialLog)) {
+          const denial = classifyDenial({
+            tool: event.tool,
+            result: event.result,
+            error: event.error,
+            argsSummary:
+              _lastExec && _lastExec.tool === event.tool
+                ? formatToolArgs(event.tool, _lastExec.args)
+                : "",
+          });
+          if (denial) {
+            recordDenial(options.denialLog, { ...denial, at: Date.now() });
+          }
+        }
         // Parity with Desktop AIChatPage's `Switch to Trusted` button:
         // when the deny came from ApprovalGate (not shell-policy), surface
         // the exact CLI command the user can run to relax the per-session
@@ -503,6 +546,11 @@ export async function startAgentRepl(options = {}) {
     _respondToBash = readBooleanSetting("respondToBashCommands", {
       cwd: process.cwd(),
     });
+    // Claude-Code 2.1.193 autoMode.classifyAllShell (default OFF when unset).
+    _classifyAllShell =
+      readBooleanSetting("autoMode.classifyAllShell", {
+        cwd: process.cwd(),
+      }) === true;
     const total =
       loaded.rules.allow.length +
       loaded.rules.ask.length +
@@ -538,12 +586,21 @@ export async function startAgentRepl(options = {}) {
   // PostToolUse). The interactive _permissionConfirm above doubles as the
   // confirmer for a hook `ask` decision.
   try {
-    const { loadHooks } = await import("../lib/settings-hooks.cjs");
+    const { loadHooks, projectHookTrustNotice } =
+      await import("../lib/settings-hooks.cjs");
     const loaded = loadHooks({ cwd: process.cwd() });
     _settingsHooks =
       loaded.hooks && Object.keys(loaded.hooks).length > 0
         ? loaded.hooks
         : null;
+    // First-run trust notice for an untrusted/cloned repo's shell-running
+    // hooks (Claude-Code 2.1.195 parity). Best-effort, stderr-only.
+    try {
+      const notice = projectHookTrustNotice({ cwd: process.cwd() });
+      if (notice) process.stderr.write(notice + "\n");
+    } catch {
+      /* trust notice is best-effort */
+    }
   } catch (_err) {
     _settingsHooks = null;
   }
@@ -1482,7 +1539,7 @@ export async function startAgentRepl(options = {}) {
         `  ${chalk.cyan("/cost")}       Session token spend + estimated $ (per model & category)`,
       );
       logger.log(
-        `  ${chalk.cyan("/permissions")} Allow/ask/deny rules; set/cycle tier (/permissions <tier> · Shift+Tab cycles)`,
+        `  ${chalk.cyan("/permissions")} Allow/ask/deny rules; set/cycle tier (/permissions <tier> · Shift+Tab); /permissions denials to review blocked calls`,
       );
       logger.log(
         `  ${chalk.cyan("/export")}     Save this conversation to a Markdown file (/export [path])`,
@@ -3034,6 +3091,13 @@ export async function startAgentRepl(options = {}) {
     // parity): what the agent runs unprompted, asks about, or is blocked from.
     if (trimmed === "/permissions" || trimmed.startsWith("/permissions ")) {
       const arg = trimmed.slice("/permissions".length).trim();
+      if (arg === "denials" || arg === "denied") {
+        // Review what the agent was BLOCKED from running this session
+        // (Claude-Code 2.1.193 "recent denials").
+        logger.log(formatDenials(_recentDenials));
+        prompt();
+        return;
+      }
       if (arg) {
         // Set this session's approval tier mid-session (Claude-Code
         // permission-mode / Shift+Tab parity; mirrors `cc session policy --set`).
@@ -3079,6 +3143,13 @@ export async function startAgentRepl(options = {}) {
           "  Set tier mid-session: /permissions <strict|trusted|autopilot>",
         ),
       );
+      if (_recentDenials.length) {
+        logger.log(
+          chalk.gray(
+            `  ${_recentDenials.length} tool call(s) denied this session — /permissions denials to review`,
+          ),
+        );
+      }
       prompt();
       return;
     }
@@ -3511,11 +3582,13 @@ export async function startAgentRepl(options = {}) {
         autoCheckpoint,
         checkpointSession: sessionId,
         checkpointMarks: _checkpointMarks,
+        denialLog: _recentDenials,
         prepareCall,
         approvalGate: _approvalGate,
         permissionRules: _permissionRules,
         permissionConfirm: _permissionConfirm,
         settingsHooks: _settingsHooks,
+        classifyAllShell: _classifyAllShell,
         // Interactive session: gate run_code through the ApprovalGate (like
         // run_shell) so a strict tier prompts before arbitrary code runs.
         interactiveApproval: true,

package/src/runtime/__tests__/message-roles.test.js

@@ -51,13 +51,38 @@ describe("mergeConsecutiveMessages", () => {
     // A multi-tool turn produces back-to-back `tool` results — folding them
     // would drop tool_call_ids and corrupt the tool-call pairing.
     const msgs = [
-      { role: "assistant", content: "", tool_calls: [{ id: "a" }, { id: "b" }] },
+      {
+        role: "assistant",
+        content: "",
+        tool_calls: [{ id: "a" }, { id: "b" }],
+      },
       { role: "tool", content: "r1", tool_call_id: "a" },
       { role: "tool", content: "r2", tool_call_id: "b" },
     ];
     expect(mergeConsecutiveMessages(msgs)).toEqual(msgs);
   });
 
+  it("never merges a structured assistant tool-call turn (tool_calls preserved)", () => {
+    // Two consecutive assistants where the SECOND carries tool_calls — folding
+    // would drop them (orphaning the result) and the strict API would 400.
+    const msgs = [
+      { role: "assistant", content: "let me check" },
+      { role: "assistant", content: "", tool_calls: [{ id: "c1" }] },
+      { role: "tool", content: "result", tool_call_id: "c1" },
+    ];
+    expect(mergeConsecutiveMessages(msgs)).toEqual(msgs);
+  });
+
+  it("never folds two consecutive assistants when the FIRST has tool_calls", () => {
+    // e.g. after a compaction dropped the tool results — merging would mutate
+    // the structured turn's content and keep its now-unanswered tool_calls.
+    const msgs = [
+      { role: "assistant", content: "", tool_calls: [{ id: "a" }] },
+      { role: "assistant", content: "fallback text" },
+    ];
+    expect(mergeConsecutiveMessages(msgs)).toEqual(msgs);
+  });
+
   it("never merges system messages (leading base + context pair kept distinct)", () => {
     const msgs = [
       { role: "system", content: "base" },
@@ -202,14 +227,22 @@ describe("collapseConsecutiveMessagesInPlace", () => {
     const messages = [
       { role: "user", content: "u1" },
       { role: "user", content: "u2" },
-      { role: "assistant", content: "", tool_calls: [{ id: "a" }, { id: "b" }] },
+      {
+        role: "assistant",
+        content: "",
+        tool_calls: [{ id: "a" }, { id: "b" }],
+      },
       { role: "tool", content: "r1", tool_call_id: "a" },
       { role: "tool", content: "r2", tool_call_id: "b" },
     ];
     expect(collapseConsecutiveMessagesInPlace(messages)).toBe(true);
     expect(messages).toEqual([
       { role: "user", content: "u1\n\nu2" },
-      { role: "assistant", content: "", tool_calls: [{ id: "a" }, { id: "b" }] },
+      {
+        role: "assistant",
+        content: "",
+        tool_calls: [{ id: "a" }, { id: "b" }],
+      },
       { role: "tool", content: "r1", tool_call_id: "a" },
       { role: "tool", content: "r2", tool_call_id: "b" },
     ]);