chainlesschain 0.162.148 → 0.162.150

package/src/runtime/auto-pin.js

@@ -0,0 +1,117 @@
+/**
+ * Auto-pin policy for compaction (OPT-IN).
+ *
+ * Phase 7.7 gave the compressor a deterministic pin mechanism: a message the
+ * predicate marks is pulled out before any strategy and re-inserted verbatim,
+ * so it survives compaction no matter what the (non-deterministic) LLM summary
+ * drops. What was deliberately left unbuilt is the *policy* — deciding WHICH
+ * messages to auto-pin — because auto-pinning reorders the hot agent loop's
+ * context and is a product-UX call.
+ *
+ * This module supplies that policy, but strictly opt-in: it only ever produces
+ * a predicate when the caller explicitly enables auto-pin. When disabled it
+ * returns null and the caller passes NO predicate, so the compressor falls back
+ * to its default (pin only messages already tagged `pinned:true`) and behaviour
+ * is byte-identical to before.
+ *
+ * Default policy when enabled: pin the ORIGINAL TASK — the first user turn —
+ * because that is the single fact most likely to scroll out of the recent
+ * window yet most important to keep (the coding agent's goal). Explicit
+ * `pinned:true` messages are always honored on top of it. A token cap keeps a
+ * pathologically large first turn from itself blowing the budget.
+ */
+
+const DEFAULT_MAX_PIN_TOKENS = 2000;
+
+/**
+ * Normalize the opt-in value into a config object, or null when auto-pin is off.
+ * Accepts: falsy (off), `true` (defaults on), or a config object
+ * `{ firstUserGoal?, maxPinTokens? }`.
+ */
+export function resolveAutoPinConfig(opt) {
+  if (!opt) return null;
+  const cfg = typeof opt === "object" ? opt : {};
+  return {
+    firstUserGoal: cfg.firstUserGoal !== false, // default true when enabled
+    maxPinTokens: Number.isFinite(cfg.maxPinTokens)
+      ? cfg.maxPinTokens
+      : DEFAULT_MAX_PIN_TOKENS,
+  };
+}
+
+/** Coarse char/4 token estimate — matches the compressor's own heuristic. */
+function estimateTokens(text) {
+  return Math.ceil(String(text || "").length / 4);
+}
+
+function contentString(m) {
+  if (!m) return "";
+  return typeof m.content === "string"
+    ? m.content
+    : JSON.stringify(m.content || "");
+}
+
+/**
+ * Build an `isPinned(message)` predicate for `compress({ isPinned })`, or null
+ * when auto-pin is disabled (caller then passes no predicate → default).
+ *
+ * The predicate combines explicit pins (`pinned:true`/`_pin`) with the policy's
+ * auto-selected messages, matched by identity against `messages` (compress
+ * filters the same array, so identity is stable).
+ */
+export function buildAutoPinPredicate(messages, opt) {
+  const cfg = resolveAutoPinConfig(opt);
+  if (!cfg) return null;
+  if (!Array.isArray(messages)) {
+    return (m) => !!m && (m.pinned === true || m._pin === true);
+  }
+
+  const auto = new Set();
+  if (cfg.firstUserGoal) {
+    const firstUser = messages.find((m) => m && m.role === "user");
+    // Skip a first turn that is itself huge — pinning it would defeat the point
+    // (it would dominate the very budget compaction is trying to reclaim).
+    if (
+      firstUser &&
+      estimateTokens(contentString(firstUser)) <= cfg.maxPinTokens
+    ) {
+      auto.add(firstUser);
+    }
+  }
+
+  return (m) => !!m && (m.pinned === true || m._pin === true || auto.has(m));
+}
+
+/**
+ * Explain what the policy would pin for `messages` (for `--dry-run` / logging).
+ * Returns `{ enabled, reasons: [{ role, preview, why }] }`.
+ */
+export function describeAutoPin(messages, opt) {
+  const cfg = resolveAutoPinConfig(opt);
+  if (!cfg) return { enabled: false, reasons: [] };
+  const reasons = [];
+  const list = Array.isArray(messages) ? messages : [];
+  for (const m of list) {
+    if (m && (m.pinned === true || m._pin === true)) {
+      reasons.push({ role: m.role, preview: preview(m), why: "explicit pin" });
+    }
+  }
+  if (cfg.firstUserGoal) {
+    const firstUser = list.find((m) => m && m.role === "user");
+    if (
+      firstUser &&
+      estimateTokens(contentString(firstUser)) <= cfg.maxPinTokens
+    ) {
+      reasons.push({
+        role: "user",
+        preview: preview(firstUser),
+        why: "original task (first user turn)",
+      });
+    }
+  }
+  return { enabled: true, reasons };
+}
+
+function preview(m) {
+  return contentString(m).replace(/\s+/g, " ").slice(0, 80);
+}

package/src/runtime/coding-agent-contract-shared.cjs

@@ -353,6 +353,74 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
       tags: ["tool:search_files", "contract:coding-agent", "tier:mvp"],
     },
   },
+  {
+    name: "code_intelligence",
+    title: "Code Intelligence",
+    kind: "analysis",
+    tier: "extension",
+    description:
+      "Semantic code navigation via a Language Server (LSP): resolve a symbol's " +
+      "definition, find its references, get type/hover info, list document or " +
+      "workspace symbols, read diagnostics, or preview a rename — WITHOUT text " +
+      "guessing. Prefer this over search_files when you need exact symbol " +
+      "semantics. Positions are 1-based (line/col). Degrades gracefully to a " +
+      "'not available' result when no language server is installed for the file.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        action: {
+          type: "string",
+          enum: [
+            "definition",
+            "references",
+            "hover",
+            "document_symbols",
+            "workspace_symbols",
+            "diagnostics",
+            "rename_preview",
+          ],
+          description: "Which semantic query to run",
+        },
+        file: {
+          type: "string",
+          description:
+            "File path (relative to cwd). Required for every action except workspace_symbols.",
+        },
+        line: {
+          type: "integer",
+          description:
+            "1-based line number of the symbol (definition/references/hover/rename_preview).",
+        },
+        col: {
+          type: "integer",
+          description:
+            "1-based column of the symbol (definition/references/hover/rename_preview).",
+        },
+        query: {
+          type: "string",
+          description: "Symbol name to search for (workspace_symbols).",
+        },
+        new_name: {
+          type: "string",
+          description: "Proposed new identifier (rename_preview).",
+        },
+      },
+      required: ["action"],
+    },
+    ...TOOL_POLICY_METADATA.code_intelligence,
+    permissions: {
+      level: "readonly",
+      scopes: ["filesystem:read", "process:spawn"],
+    },
+    telemetry: {
+      category: "analysis",
+      tags: [
+        "tool:code_intelligence",
+        "contract:coding-agent",
+        "tier:extension",
+      ],
+    },
+  },
   {
     name: "list_dir",
     title: "List Directory",
@@ -422,7 +490,8 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
       properties: {
         category: {
           type: "string",
-          description: "Filter by category (e.g. development, automation, data)",
+          description:
+            "Filter by category (e.g. development, automation, data)",
         },
         query: {
           type: "string",
@@ -491,7 +560,7 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
         agent: {
           type: "string",
           description:
-            'Optional name of a pre-defined subagent from .chainlesschain/agents/ or .claude/agents/ (e.g. "review:security"). Loads that file\'s system prompt + tool allow-list. Run `cc agents list` to see them. Explicit `role`/`tools` override the agent\'s values.',
+            "Optional name of a pre-defined subagent from .chainlesschain/agents/ or .claude/agents/ (e.g. \"review:security\"). Loads that file's system prompt + tool allow-list. Run `cc agents list` to see them. Explicit `role`/`tools` override the agent's values.",
         },
         role: {
           type: "string",
@@ -588,7 +657,16 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
         },
         provider: {
           type: "string",
-          enum: ["auto", "tavily", "brave", "bocha", "qianfan", "duckduckgo", "searxng", "baidu"],
+          enum: [
+            "auto",
+            "tavily",
+            "brave",
+            "bocha",
+            "qianfan",
+            "duckduckgo",
+            "searxng",
+            "baidu",
+          ],
           description:
             "Override the configured search backend for this call (default: from config / auto)",
         },
@@ -763,11 +841,7 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
     },
     telemetry: {
       category: "search",
-      tags: [
-        "tool:search_sessions",
-        "contract:coding-agent",
-        "tier:extension",
-      ],
+      tags: ["tool:search_sessions", "contract:coding-agent", "tier:extension"],
     },
   },
 ]);

package/src/runtime/coding-agent-policy.cjs

@@ -23,7 +23,11 @@ const TOOL_DECISIONS = Object.freeze({
   REQUIRE_CONFIRMATION: "require_confirmation",
 });
 
-const PLAN_APPROVED_STATES = Object.freeze(["approved", "executing", "completed"]);
+const PLAN_APPROVED_STATES = Object.freeze([
+  "approved",
+  "executing",
+  "completed",
+]);
 
 const READ_ONLY_GIT_SUBCOMMANDS = Object.freeze([
   "status",
@@ -64,6 +68,20 @@ const TOOL_POLICY_METADATA = Object.freeze({
     approvalFlow: "auto",
     isReadOnly: true,
   },
+  code_intelligence: {
+    // Read-only semantic navigation via LSP (definition/references/hover/
+    // symbols/diagnostics/rename-preview). It never mutates the workspace — a
+    // rename returns a preview, not an applied edit — so it is auto-approved and
+    // available in plan mode, like search_files.
+    riskLevel: RISK_LEVELS.LOW,
+    category: TOOL_CATEGORIES.ANALYZE,
+    availableInPlanMode: true,
+    planModeBehavior: "allow",
+    requiresPlanApproval: false,
+    requiresConfirmation: false,
+    approvalFlow: "auto",
+    isReadOnly: true,
+  },
   edit_file: {
     riskLevel: RISK_LEVELS.MEDIUM,
     category: TOOL_CATEGORIES.WRITE,
@@ -295,7 +313,9 @@ function isDangerousGitCommand(command) {
     case "checkout":
       // Discard working-tree changes: `checkout -- <path>`, `checkout .`,
       // or `-f`/`--force` (a plain branch checkout is not flagged).
-      return lower.includes("--") || lower.includes(".") || has("-f", "--force");
+      return (
+        lower.includes("--") || lower.includes(".") || has("-f", "--force")
+      );
     case "restore":
       // Worktree restore discards changes; a pure `--staged` restore only
       // unstages and is recoverable.
@@ -321,9 +341,9 @@ function isDangerousGitCommand(command) {
       // or an explicit `--delete --force`.
       return rest.includes("-D") || (has("--delete") && has("-f", "--force"));
     case "stash":
-      return ["drop", "clear"].includes((lower[0] || ""));
+      return ["drop", "clear"].includes(lower[0] || "");
     case "reflog":
-      return ["expire", "delete"].includes((lower[0] || ""));
+      return ["expire", "delete"].includes(lower[0] || "");
     case "update-ref":
       return has("-d", "--delete");
     case "filter-branch":
@@ -333,9 +353,14 @@ function isDangerousGitCommand(command) {
       return lower.some((t) => t.startsWith("--prune"));
     case "rebase":
       // History rewrite; control sub-actions (--abort/--continue/etc.) are safe.
-      return !["--abort", "--continue", "--skip", "--quit", "--edit-todo", "--show-current-patch"].includes(
-        lower[0] || "",
-      );
+      return ![
+        "--abort",
+        "--continue",
+        "--skip",
+        "--quit",
+        "--edit-todo",
+        "--show-current-patch",
+      ].includes(lower[0] || "");
     default:
       return false;
   }

package/src/runtime/fallback-model.js

@@ -13,11 +13,20 @@
  * 3 models) and 2.1.152 switches to the configured fallback when the primary
  * model is "not found".
  *
- * Same-provider only: each hop swaps `options.model`, keeping the configured
- * provider / baseUrl / apiKey. Cross-provider fallback is a larger feature.
+ * Cross-provider fallback (v2): a fallback entry may name a DIFFERENT provider
+ * as `provider:model` (e.g. `openai:gpt-4o`, `ollama:qwen2.5:7b`). A cross-
+ * provider hop swaps provider + baseUrl + apiKey too, resolving the target
+ * provider's connection from BUILT_IN_PROVIDERS + its `apiKeyEnv`. SECURITY: a
+ * cross-provider hop is used ONLY when the user EXPLICITLY named that provider in
+ * the fallback chain AND the target provider's API key is present in the env —
+ * we never reuse the primary provider's key against a different vendor (that
+ * would be the silent auth-substitution this project forbids). A cross-provider
+ * entry whose key is missing is SKIPPED with a clear reason, not attempted with
+ * the wrong credential.
  */
 
 import { chatWithTools } from "./agent-core.js";
+import { BUILT_IN_PROVIDERS } from "../lib/llm-providers.js";
 
 // Claude Code caps the fallback chain at 3 backups; mirror that here so a
 // mis-configured comma list can't fan out into an unbounded retry storm.
@@ -142,6 +151,85 @@ export function normalizeFallbackModels(input) {
   return out;
 }
 
+/**
+ * Parse a fallback entry into `{ provider, model }`. A `provider:model` prefix
+ * is recognized ONLY when the prefix is a KNOWN provider name — so an
+ * ollama-style model id that itself contains a colon (`qwen2.5:7b`) is NOT
+ * mis-split, while `ollama:qwen2.5:7b` correctly yields provider `ollama` +
+ * model `qwen2.5:7b`. A plain `model` (no known-provider prefix) means
+ * "same provider" (provider: null).
+ *
+ * @param {string} entry
+ * @param {Set<string>} [knownProviders]  provider names to recognize as prefixes
+ * @returns {{ provider: string|null, model: string }}
+ */
+export function parseFallbackEntry(entry, knownProviders) {
+  const known =
+    knownProviders || new Set(Object.keys(BUILT_IN_PROVIDERS || {}));
+  const s = String(entry || "").trim();
+  const idx = s.indexOf(":");
+  if (idx > 0) {
+    const head = s.slice(0, idx);
+    const rest = s.slice(idx + 1);
+    if (rest && known.has(head)) {
+      return { provider: head, model: rest };
+    }
+  }
+  return { provider: null, model: s };
+}
+
+/**
+ * Resolve a fallback entry into a concrete call target. For a SAME-provider hop
+ * (no known provider prefix), only the model changes. For a CROSS-provider hop,
+ * resolve the target provider's baseUrl + apiKey (from its `apiKeyEnv` in the
+ * environment); if the target needs a key and none is set, the hop is
+ * `unavailable` (skipped) — we never fall back onto a different vendor with the
+ * wrong/absent credential.
+ *
+ * @param {string} entry
+ * @param {object} [opts] { env, providers, knownProviders }
+ * @returns {{ model, provider?, baseUrl?, apiKey?, crossProvider:boolean } | { unavailable:true, reason:string, model:string, provider:string }}
+ */
+export function resolveFallbackTarget(entry, opts = {}) {
+  const env = opts.env || process.env;
+  const providers = opts.providers || BUILT_IN_PROVIDERS || {};
+  const { provider, model } = parseFallbackEntry(
+    entry,
+    opts.knownProviders || new Set(Object.keys(providers)),
+  );
+  if (!provider) {
+    return { model, crossProvider: false };
+  }
+  const def = providers[provider];
+  if (!def) {
+    return {
+      unavailable: true,
+      reason: `unknown provider "${provider}"`,
+      provider,
+      model,
+    };
+  }
+  let apiKey = null;
+  if (def.apiKeyEnv) {
+    apiKey = env[def.apiKeyEnv] || null;
+    if (!apiKey) {
+      return {
+        unavailable: true,
+        reason: `${provider} fallback skipped: ${def.apiKeyEnv} not set`,
+        provider,
+        model,
+      };
+    }
+  }
+  return {
+    model,
+    provider,
+    baseUrl: def.baseUrl || null,
+    apiKey,
+    crossProvider: true,
+  };
+}
+
 /**
  * Build a chatFn that walks an ordered fallback chain when the primary fails.
  *
@@ -168,6 +256,9 @@ export function makeFallbackChatFn(opts = {}) {
   const isModelNotFound = opts.isModelNotFound || isModelNotFoundError;
   const onFallback = opts.onFallback;
 
+  const env = opts.env || process.env;
+  const providers = opts.providers || BUILT_IN_PROVIDERS || {};
+
   return async function chatWithFallback(messages, options = {}) {
     try {
       return await baseChatFn(messages, options);
@@ -175,8 +266,30 @@ export function makeFallbackChatFn(opts = {}) {
       let err = firstErr;
       let lastTried = options.model;
       for (const candidate of models) {
-        // Skip a no-op hop (fallback identical to the model just attempted).
-        if (!candidate || candidate === lastTried) continue;
+        const target = resolveFallbackTarget(candidate, { env, providers });
+        // A cross-provider hop whose key is absent (or an unknown provider) is
+        // skipped — never attempted with the wrong credential. Surface why.
+        if (target.unavailable) {
+          if (typeof onFallback === "function") {
+            try {
+              onFallback({
+                from: lastTried,
+                to: candidate,
+                skipped: true,
+                reason: target.reason,
+                error: err?.message || String(err),
+              });
+            } catch {
+              /* best-effort */
+            }
+          }
+          continue;
+        }
+        // Skip a no-op hop (same provider + same model just attempted).
+        const sameModel = target.model === lastTried;
+        const sameProvider =
+          !target.crossProvider || target.provider === options.provider;
+        if (!target.model || (sameModel && sameProvider)) continue;
         // Only advance the chain for transient failures or a missing primary;
         // a real bad-request / auth error is surfaced immediately.
         if (!isRetryable(err) && !isModelNotFound(err)) throw err;
@@ -184,16 +297,30 @@ export function makeFallbackChatFn(opts = {}) {
           try {
             onFallback({
               from: lastTried,
-              to: candidate,
+              to: target.crossProvider
+                ? `${target.provider}:${target.model}`
+                : target.model,
+              crossProvider: target.crossProvider,
               error: err?.message || String(err),
             });
           } catch {
             // Notification is best-effort — never mask the retry.
           }
         }
-        lastTried = candidate;
+        lastTried = target.model;
+        // Build the per-hop options: same-provider swaps only the model; a
+        // cross-provider hop also swaps provider/baseUrl/apiKey.
+        const hopOptions = target.crossProvider
+          ? {
+              ...options,
+              model: target.model,
+              provider: target.provider,
+              baseUrl: target.baseUrl,
+              apiKey: target.apiKey,
+            }
+          : { ...options, model: target.model };
         try {
-          return await baseChatFn(messages, { ...options, model: candidate });
+          return await baseChatFn(messages, hopOptions);
         } catch (nextErr) {
           err = nextErr;
         }