chainlesschain 0.162.125 → 0.162.127

package/src/gateways/ws/message-dispatcher.js

@@ -106,199 +106,179 @@ export function createWsMessageDispatcher(server) {
         "llm.chat": () => server._handleLlmChat(id, ws, message),
       };
 
-      // Phase I — Hosted Session API streaming routes (stream.run).
-      // Each intermediate event goes out as { id, type: "stream.event", event }
-      // and the final response is sent by the normal ok/err wrapper.
-      for (const streamingType of Object.keys(
-        SESSION_CORE_STREAMING_HANDLERS,
-      )) {
-        routes[streamingType] = async () => {
-          const controller = new AbortController();
-          const client = server.clients.get(clientId);
-          if (client) {
-            client._streamAborts = client._streamAborts || new Map();
-            client._streamAborts.set(id, controller);
-          }
-          const sender = (payload) => server._send(ws, { id, ...payload });
-          const context = { server, ws, clientId };
-          try {
-            const result = await SESSION_CORE_STREAMING_HANDLERS[streamingType](
-              message,
-              sender,
-              controller.signal,
-              context,
-            );
-            server._send(ws, {
-              id,
-              type: `${streamingType}.end`,
-              ...result,
-            });
-          } catch (err) {
-            server._send(ws, {
-              id,
-              type: "error",
-              code: "STREAM_RUN_ERROR",
-              message: err?.message || String(err),
-            });
-          } finally {
-            if (client?._streamAborts) client._streamAborts.delete(id);
-          }
-        };
+      // Static core routes take precedence and are dispatched directly. The
+      // feature handler maps below are consulted ONLY when no static route
+      // matches — so a feature topic can never shadow a core protocol route
+      // (auth/cancel/ping/execute), and we no longer allocate a closure for all
+      // ~79 feature keys on every message (the old per-message Object.keys loops
+      // built the entire route table each dispatch). Only the matched handler
+      // runs.
+      const staticHandler = routes[type];
+      if (staticHandler) {
+        return staticHandler();
+      }
+
+      // Phase I — Hosted Session API streaming routes (stream.run). Each
+      // intermediate event goes out as { id, type:"stream.event", event } and
+      // the final response is sent by the normal ok/err wrapper.
+      if (SESSION_CORE_STREAMING_HANDLERS[type]) {
+        const controller = new AbortController();
+        const client = server.clients.get(clientId);
+        if (client) {
+          client._streamAborts = client._streamAborts || new Map();
+          client._streamAborts.set(id, controller);
+        }
+        const sender = (payload) => server._send(ws, { id, ...payload });
+        const context = { server, ws, clientId };
+        try {
+          const result = await SESSION_CORE_STREAMING_HANDLERS[type](
+            message,
+            sender,
+            controller.signal,
+            context,
+          );
+          server._send(ws, { id, type: `${type}.end`, ...result });
+        } catch (err) {
+          server._send(ws, {
+            id,
+            type: "error",
+            code: "STREAM_RUN_ERROR",
+            message: err?.message || String(err),
+          });
+        } finally {
+          if (client?._streamAborts) client._streamAborts.delete(id);
+        }
+        return;
       }
 
       // Video Editing streaming routes
-      for (const videoStreamType of Object.keys(VIDEO_STREAMING_HANDLERS)) {
-        routes[videoStreamType] = async () => {
-          const controller = new AbortController();
-          const client = server.clients.get(clientId);
-          if (client) {
-            client._streamAborts = client._streamAborts || new Map();
-            client._streamAborts.set(id, controller);
-          }
-          const sender = (payload) => server._send(ws, { id, ...payload });
-          try {
-            const result = await VIDEO_STREAMING_HANDLERS[videoStreamType](
-              message,
-              sender,
-              controller.signal,
-            );
-            server._send(ws, {
-              id,
-              type: `${videoStreamType}.end`,
-              ...result,
-            });
-          } catch (err) {
-            server._send(ws, {
-              id,
-              type: "error",
-              code: "VIDEO_STREAM_ERROR",
-              message: err?.message || String(err),
-            });
-          } finally {
-            if (client?._streamAborts) client._streamAborts.delete(id);
-          }
-        };
+      if (VIDEO_STREAMING_HANDLERS[type]) {
+        const controller = new AbortController();
+        const client = server.clients.get(clientId);
+        if (client) {
+          client._streamAborts = client._streamAborts || new Map();
+          client._streamAborts.set(id, controller);
+        }
+        const sender = (payload) => server._send(ws, { id, ...payload });
+        try {
+          const result = await VIDEO_STREAMING_HANDLERS[type](
+            message,
+            sender,
+            controller.signal,
+          );
+          server._send(ws, { id, type: `${type}.end`, ...result });
+        } catch (err) {
+          server._send(ws, {
+            id,
+            type: "error",
+            code: "VIDEO_STREAM_ERROR",
+            message: err?.message || String(err),
+          });
+        } finally {
+          if (client?._streamAborts) client._streamAborts.delete(id);
+        }
+        return;
       }
 
       // Video Editing request/response routes
-      for (const videoType of Object.keys(VIDEO_HANDLERS)) {
-        routes[videoType] = async () => {
-          try {
-            const result = await VIDEO_HANDLERS[videoType](message);
-            server._send(ws, {
-              id,
-              type: `${videoType}.response`,
-              ...result,
-            });
-          } catch (err) {
-            server._send(ws, {
-              id,
-              type: "error",
-              code: "VIDEO_ERROR",
-              message: err?.message || String(err),
-            });
-          }
-        };
+      if (VIDEO_HANDLERS[type]) {
+        try {
+          const result = await VIDEO_HANDLERS[type](message);
+          server._send(ws, { id, type: `${type}.response`, ...result });
+        } catch (err) {
+          server._send(ws, {
+            id,
+            type: "error",
+            code: "VIDEO_ERROR",
+            message: err?.message || String(err),
+          });
+        }
+        return;
       }
 
       // Personal Data Hub topics — same 10 surfaces as the Electron IPC
       // (see desktop-app-vue/src/main/ipc/personal-data-hub-ipc.js). Each
       // handler returns { result } or { error }; we wrap with the standard
       // response envelope so renderer code is shell-agnostic.
-      for (const hubType of Object.keys(PERSONAL_DATA_HUB_HANDLERS)) {
-        routes[hubType] = async () => {
-          try {
-            const out = await PERSONAL_DATA_HUB_HANDLERS[hubType](message);
-            if (out && out.error) {
-              server._send(ws, {
-                id,
-                type: "error",
-                code: "PERSONAL_DATA_HUB_ERROR",
-                message: out.error,
-              });
-            } else {
-              server._send(ws, {
-                id,
-                type: `${hubType}.response`,
-                result: out && out.result !== undefined ? out.result : out,
-              });
-            }
-          } catch (err) {
+      if (PERSONAL_DATA_HUB_HANDLERS[type]) {
+        try {
+          const out = await PERSONAL_DATA_HUB_HANDLERS[type](message);
+          if (out && out.error) {
             server._send(ws, {
               id,
               type: "error",
               code: "PERSONAL_DATA_HUB_ERROR",
-              message: err?.message || String(err),
-            });
-          }
-        };
-      }
-
-      // Phase 5.7 — streaming sync routes. Adapter progress events are
-      // pushed as `<topic>.event` messages tagged with the request id;
-      // the final report comes as `<topic>.end`.
-      for (const streamType of Object.keys(
-        PERSONAL_DATA_HUB_STREAMING_HANDLERS,
-      )) {
-        routes[streamType] = async () => {
-          const sender = (payload) => server._send(ws, { id, ...payload });
-          try {
-            const out = await PERSONAL_DATA_HUB_STREAMING_HANDLERS[streamType](
-              message,
-              sender,
-            );
-            server._send(ws, {
-              id,
-              type: `${streamType}.end`,
-              ...(out && out.result !== undefined
-                ? { result: out.result }
-                : out || {}),
+              message: out.error,
             });
-          } catch (err) {
+          } else {
             server._send(ws, {
               id,
-              type: "error",
-              code: "PERSONAL_DATA_HUB_STREAM_ERROR",
-              message: err?.message || String(err),
+              type: `${type}.response`,
+              result: out && out.result !== undefined ? out.result : out,
             });
           }
-        };
+        } catch (err) {
+          server._send(ws, {
+            id,
+            type: "error",
+            code: "PERSONAL_DATA_HUB_ERROR",
+            message: err?.message || String(err),
+          });
+        }
+        return;
       }
 
-      // Phase I — Hosted Session API (session-core, memory, beta, usage)
-      for (const sessionCoreType of Object.keys(SESSION_CORE_HANDLERS)) {
-        routes[sessionCoreType] = async () => {
-          try {
-            const result =
-              await SESSION_CORE_HANDLERS[sessionCoreType](message);
-            server._send(ws, {
-              id,
-              type: `${sessionCoreType}.response`,
-              ...result,
-            });
-          } catch (err) {
-            server._send(ws, {
-              id,
-              type: "error",
-              code: "SESSION_CORE_ERROR",
-              message: err?.message || String(err),
-            });
-          }
-        };
+      // Phase 5.7 — streaming sync routes. Adapter progress events are pushed
+      // as `<topic>.event` messages tagged with the request id; the final
+      // report comes as `<topic>.end`.
+      if (PERSONAL_DATA_HUB_STREAMING_HANDLERS[type]) {
+        const sender = (payload) => server._send(ws, { id, ...payload });
+        try {
+          const out = await PERSONAL_DATA_HUB_STREAMING_HANDLERS[type](
+            message,
+            sender,
+          );
+          server._send(ws, {
+            id,
+            type: `${type}.end`,
+            ...(out && out.result !== undefined
+              ? { result: out.result }
+              : out || {}),
+          });
+        } catch (err) {
+          server._send(ws, {
+            id,
+            type: "error",
+            code: "PERSONAL_DATA_HUB_STREAM_ERROR",
+            message: err?.message || String(err),
+          });
+        }
+        return;
       }
 
-      const handler = routes[type];
-      if (!handler) {
-        server._send(ws, {
-          id,
-          type: "error",
-          code: "UNKNOWN_TYPE",
-          message: `Unknown message type: ${type}`,
-        });
+      // Phase I — Hosted Session API (session-core, memory, beta, usage)
+      if (SESSION_CORE_HANDLERS[type]) {
+        try {
+          const result = await SESSION_CORE_HANDLERS[type](message);
+          server._send(ws, { id, type: `${type}.response`, ...result });
+        } catch (err) {
+          server._send(ws, {
+            id,
+            type: "error",
+            code: "SESSION_CORE_ERROR",
+            message: err?.message || String(err),
+          });
+        }
         return;
       }
 
-      return handler();
+      server._send(ws, {
+        id,
+        type: "error",
+        code: "UNKNOWN_TYPE",
+        message: `Unknown message type: ${type}`,
+      });
+      return;
     },
   };
 }

package/src/gateways/ws/ws-session-gateway.js

@@ -123,6 +123,33 @@ export class WSSessionManager {
     this.maxPendingPatches = Number.isFinite(options.maxPendingPatches)
       ? options.maxPendingPatches
       : 50;
+    // The entry-count caps above bound how MANY patches are kept, but a SINGLE
+    // proposed patch (a client-reachable `patch-propose`) could still carry an
+    // unbounded number of files, each with unbounded before/after/diff content
+    // — all held in memory AND serialized to disk by _persistSessionState. One
+    // file with a multi-GB diff string is enough to OOM. Bound a single patch's
+    // payload: cap the file count and truncate each content field.
+    this.maxPatchFiles = Number.isFinite(options.maxPatchFiles)
+      ? options.maxPatchFiles
+      : 200;
+    this.maxPatchContentChars = Number.isFinite(options.maxPatchContentChars)
+      ? options.maxPatchContentChars
+      : 512 * 1024; // 512 KB per before/after/diff field
+  }
+
+  /**
+   * Truncate a patch content field (before/after/diff) to maxPatchContentChars,
+   * appending a visible marker. Preserves the null-vs-string distinction (a null
+   * field stays null — it signals create/delete ops). Pure.
+   */
+  _capPatchContent(value) {
+    if (value == null) return null;
+    const s = String(value);
+    if (s.length <= this.maxPatchContentChars) return s;
+    return (
+      s.slice(0, this.maxPatchContentChars) +
+      `\n…[truncated for storage: field was ${s.length} chars]`
+    );
   }
 
   _normalizeEnabledToolNames(enabledToolNames) {
@@ -854,8 +881,13 @@ export class WSSessionManager {
     const session = this.sessions.get(sessionId);
     if (!session) return null;
 
-    const files = Array.isArray(payload.files) ? payload.files : [];
-    if (files.length === 0) return null;
+    const rawFiles = Array.isArray(payload.files) ? payload.files : [];
+    if (rawFiles.length === 0) return null;
+    // Cap the per-patch file count; a proposal touching more than this is
+    // pathological for review. Excess files are dropped (count recorded below)
+    // so one message can't pin unbounded memory / disk.
+    const files = rawFiles.slice(0, this.maxPatchFiles);
+    const droppedFiles = rawFiles.length - files.length;
 
     const patchId = `patch-${this._generateId()}`;
     const now = new Date().toISOString();
@@ -866,9 +898,9 @@ export class WSSessionManager {
         index,
         path: file.path || `unknown-${index}`,
         op,
-        before: file.before == null ? null : String(file.before),
-        after: file.after == null ? null : String(file.after),
-        diff: file.diff == null ? null : String(file.diff),
+        before: this._capPatchContent(file.before),
+        after: this._capPatchContent(file.after),
+        diff: this._capPatchContent(file.diff),
         stats,
       };
     });
@@ -895,6 +927,8 @@ export class WSSessionManager {
         fileCount: normalizedFiles.length,
         added: totalStats.added,
         removed: totalStats.removed,
+        // Surfaced so the reviewer/UI knows the proposal was capped for storage.
+        ...(droppedFiles > 0 ? { droppedFiles } : {}),
       },
     };
 

package/src/harness/jsonl-session-store.js

@@ -113,20 +113,36 @@ export function readEvents(sessionId) {
   return events;
 }
 
+/**
+ * A replayable chat message must be a `{ role, content }` object — guard
+ * against a corrupt / partially-written / hand-edited event whose `data` is
+ * missing, null, or not a message (it would otherwise inject `undefined` into
+ * the resumed history and break the next LLM request).
+ */
+function isReplayableMessage(m) {
+  return Boolean(m) && typeof m === "object" && typeof m.role === "string";
+}
+
 export function rebuildMessages(sessionId) {
   const events = readEvents(sessionId);
   const messages = [];
   let lastCompactIndex = -1;
 
+  // A `compact` event carries the pre-compaction snapshot in data.messages. A
+  // malformed compact line (type present but data null / messages not an array)
+  // must not crash the resume — skip it and look further back.
   for (let i = events.length - 1; i >= 0; i--) {
-    if (events[i].type === "compact" && events[i].data.messages) {
+    const e = events[i];
+    if (e && e.type === "compact" && Array.isArray(e.data?.messages)) {
       lastCompactIndex = i;
       break;
     }
   }
 
-  if (lastCompactIndex >= 0 && events[lastCompactIndex].data.messages) {
-    messages.push(...events[lastCompactIndex].data.messages);
+  if (lastCompactIndex >= 0) {
+    for (const m of events[lastCompactIndex].data.messages) {
+      if (isReplayableMessage(m)) messages.push(m);
+    }
   }
 
   const startIndex = lastCompactIndex >= 0 ? lastCompactIndex + 1 : 0;
@@ -134,9 +150,11 @@ export function rebuildMessages(sessionId) {
   for (let i = startIndex; i < events.length; i++) {
     const event = events[i];
     if (
-      event.type === "user_message" ||
-      event.type === "assistant_message" ||
-      event.type === "system"
+      event &&
+      (event.type === "user_message" ||
+        event.type === "assistant_message" ||
+        event.type === "system") &&
+      isReplayableMessage(event.data)
     ) {
       messages.push(event.data);
     }
@@ -145,6 +163,19 @@ export function rebuildMessages(sessionId) {
   return messages;
 }
 
+/** ISO string for a numeric ms timestamp, or "" when missing / non-finite /
+ * invalid — `new Date(undefined).toISOString()` (and `new Date("garbage")`)
+ * throw "Invalid time value", and one corrupt event must not crash a whole
+ * `cc session list` / `cc session search`. Exported so command-layer readers of
+ * the same (hand-editable) JSONL share the guard. */
+export function toIsoSafe(ts) {
+  if (ts == null) return ""; // null/undefined → "" (Number(null) is 0 = epoch)
+  const n = Number(ts);
+  if (!Number.isFinite(n)) return "";
+  const d = new Date(n);
+  return Number.isNaN(d.getTime()) ? "" : d.toISOString();
+}
+
 export function listJsonlSessions(options = {}) {
   const dir = getSessionsDir();
   if (!existsSync(dir)) return [];
@@ -167,12 +198,8 @@ export function listJsonlSessions(options = {}) {
         provider: startEvent?.data?.provider || "",
         model: startEvent?.data?.model || "",
         message_count: messageCount,
-        created_at: startEvent
-          ? new Date(startEvent.timestamp).toISOString()
-          : "",
-        updated_at: lastEvent
-          ? new Date(lastEvent.timestamp).toISOString()
-          : "",
+        created_at: toIsoSafe(startEvent?.timestamp),
+        updated_at: toIsoSafe(lastEvent?.timestamp),
         _lastTs: lastEvent?.timestamp || 0,
         _eventCount: events.length,
       };

package/src/harness/worktree-isolator.js

@@ -550,6 +550,11 @@ function _hasUncommittedChanges(worktreePath) {
     const output = execSync("git status --porcelain", {
       cwd: worktreePath,
       encoding: "utf-8",
+      // A worktree with many dirty files produces >1 MB of porcelain output and
+      // would ENOBUFS on the default cap — the catch below then reports "clean"
+      // (fail-OPEN), which could let a caller discard a worktree full of
+      // uncommitted work. Give it the same 64 MB headroom as gitExec.
+      maxBuffer: 64 * 1024 * 1024,
     });
     return output.trim().length > 0;
   } catch (_e) {

package/src/lib/agent-core.js

@@ -29,6 +29,7 @@ export {
   killBackgroundShellTask,
   killAllBackgroundShellTasks,
   reapIdleBackgroundShellTasks,
+  _ingestSearchOutput,
   writeFileVerified,
   formatProviderHttpError,
   _accumulateOllamaStream,

package/src/lib/audit-logger.js

@@ -4,6 +4,7 @@
  */
 
 import crypto from "crypto";
+import { safeJsonParse } from "./safe-json.js";
 
 /**
  * Event types for audit logging.
@@ -232,7 +233,8 @@ export function queryLogs(db, filters = {}) {
   const rows = db.prepare(sql).all(...params);
   return rows.map((r) => ({
     ...r,
-    details: r.details ? JSON.parse(r.details) : null,
+    // One corrupt details cell must not throw out of the whole query.
+    details: safeJsonParse(r.details, null),
     success: r.success === 1,
   }));
 }

package/src/lib/chat-core.js

@@ -13,8 +13,8 @@ import { BUILT_IN_PROVIDERS } from "./llm-providers.js";
 import { appendTokenUsage } from "../harness/jsonl-session-store.js";
 import {
   isRetryableStreamError,
-  STREAM_RETRY_MAX,
   STREAM_RETRY_BASE_MS,
+  resolveStreamRetryMax,
 } from "./stream-retry.js";
 
 // A streaming chat call must not hang forever if the API accepts the connection
@@ -513,6 +513,9 @@ export async function* chatStream(messages, options) {
   // any token still terminates the generator cleanly.
   const streamPromise = (async () => {
     try {
+      // Budget honors CC_MAX_RETRIES / CLAUDE_CODE_MAX_RETRIES (capped 15),
+      // same as the agent path.
+      const maxRetries = resolveStreamRetryMax();
       let attempt = 0;
       for (;;) {
         try {
@@ -524,7 +527,7 @@ export async function* chatStream(messages, options) {
           // zero-output retry safety (cc agent parity). Stall aborts (180s) and
           // HTTP/auth errors are not retryable and surface immediately.
           if (
-            attempt >= STREAM_RETRY_MAX ||
+            attempt >= maxRetries ||
             tokensEmitted > 0 ||
             !isRetryableStreamError(err)
           ) {