chainlesschain 0.162.94 → 0.162.96

package/src/lib/runnable-provider.js

@@ -92,48 +92,79 @@ export function makeRunnableProviderFallback(
   chatFn,
   { env = process.env, onFallback } = {},
 ) {
+  // Notify at most once per from→to pair: in an agent loop the same fallback
+  // would otherwise re-warn on every turn.
+  const notified = new Set();
   const notify = (info) => {
-    if (typeof onFallback === "function") {
-      try {
-        onFallback(info);
-      } catch {
-        /* notification is best-effort */
-      }
+    if (typeof onFallback !== "function") return;
+    const key = `${info.from}→${info.to}`;
+    if (notified.has(key)) return;
+    notified.add(key);
+    try {
+      onFallback(info);
+    } catch {
+      /* notification is best-effort */
     }
   };
-  return async function runnableProviderFallback(messages, options = {}) {
-    try {
-      return await chatFn(messages, options);
-    } catch (err) {
-      if (!isAuthError(err)) throw err;
-      const failed = options.provider;
 
-      // 1) The endpoint belongs to a different provider than the label.
-      const inferred = inferProviderFromBaseUrl(options.baseUrl);
-      if (inferred && inferred !== failed) {
-        notify({ from: failed, to: inferred, reason: "baseurl-mismatch" });
-        return await chatFn(messages, {
-          ...options,
+  // Compute the fallback for these options WITHOUT calling the model — the
+  // resolution is deterministic (baseUrl-inferred provider, then env-keyed
+  // provider). Returns { to, reason, override } or null. Pure so we can both
+  // react to an auth failure AND pre-empt the known-bad attempt on later turns.
+  const computeFallback = (options) => {
+    const failed = options.provider;
+    const inferred = inferProviderFromBaseUrl(options.baseUrl);
+    if (inferred && inferred !== failed) {
+      return {
+        to: inferred,
+        reason: "baseurl-mismatch",
+        override: {
           provider: inferred,
           model: defaultModelFor(inferred) || options.model,
-        });
-      }
-
-      // 2) Another provider has a usable key in the environment.
-      for (const [name, def] of Object.entries(BUILT_IN_PROVIDERS)) {
-        if (name === failed) continue;
-        if (def.apiKeyEnv && nonEmpty(env[def.apiKeyEnv])) {
-          notify({ from: failed, to: name, reason: "env-key" });
-          return await chatFn(messages, {
-            ...options,
+        },
+      };
+    }
+    for (const [name, def] of Object.entries(BUILT_IN_PROVIDERS)) {
+      if (name === failed) continue;
+      if (def.apiKeyEnv && nonEmpty(env[def.apiKeyEnv])) {
+        return {
+          to: name,
+          reason: "env-key",
+          override: {
             provider: name,
             baseUrl: def.baseUrl,
             apiKey: envKey(name, env),
             model: defaultModelFor(name) || options.model,
-          });
-        }
+          },
+        };
       }
-      throw err; // nowhere runnable to fall back to — surface the clear error
+    }
+    return null;
+  };
+
+  // Providers we have already proven need a fallback — later turns route
+  // straight to the working provider instead of re-attempting the broken one.
+  const stickyFrom = new Set();
+
+  return async function runnableProviderFallback(messages, options = {}) {
+    // Known-bad provider: skip the wasted failed attempt and route directly.
+    if (stickyFrom.has(options.provider)) {
+      const fb = computeFallback(options);
+      if (fb) {
+        notify({ from: options.provider, to: fb.to, reason: fb.reason });
+        return await chatFn(messages, { ...options, ...fb.override });
+      }
+      // Resolution no longer available — fall through to a normal attempt.
+    }
+    try {
+      return await chatFn(messages, options);
+    } catch (err) {
+      if (!isAuthError(err)) throw err;
+      const fb = computeFallback(options);
+      if (!fb) throw err; // nowhere runnable — surface the clear error
+      stickyFrom.add(options.provider);
+      notify({ from: options.provider, to: fb.to, reason: fb.reason });
+      return await chatFn(messages, { ...options, ...fb.override });
     }
   };
 }

package/src/lib/session-tail.js

@@ -89,6 +89,10 @@ export async function* followSession(sessionId, options = {}) {
       ? fromOffset
       : initialOffset(sessionId, { fromStart });
   let buffer = "";
+  // Streaming decoder persisted across polls: when the file grows by a partial
+  // multi-byte UTF-8 character between reads (the rest arrives next poll), the
+  // held bytes are reassembled instead of corrupted into U+FFFD.
+  let decoder = new TextDecoder("utf-8");
 
   // eslint-disable-next-line no-constant-condition
   while (true) {
@@ -100,6 +104,7 @@ export async function* followSession(sessionId, options = {}) {
         // File was truncated / rotated — restart from beginning
         offset = 0;
         buffer = "";
+        decoder = new TextDecoder("utf-8"); // drop any held partial-char bytes
       }
       if (stat.size > offset) {
         const fd = await fsp.open(filePath, "r");
@@ -108,7 +113,7 @@ export async function* followSession(sessionId, options = {}) {
           const buf = Buffer.alloc(length);
           await fd.read(buf, 0, length, offset);
           offset = stat.size;
-          buffer += buf.toString("utf-8");
+          buffer += decoder.decode(buf, { stream: true });
         } finally {
           await fd.close();
         }

package/src/lib/session-usage.js

@@ -49,8 +49,23 @@ export function extractUsage(event) {
   const totalTokens = toNumber(
     raw.total_tokens ?? raw.totalTokens ?? inputTokens + outputTokens,
   );
+  // Prompt-cache token counts (Anthropic caching): read tokens are billed at
+  // ~10% and creation/write at ~1.25× the input rate, so they are tracked
+  // separately for accurate cost. Absent on non-caching providers → 0.
+  const cacheReadTokens = toNumber(
+    raw.cache_read_input_tokens ?? raw.cacheReadTokens ?? 0,
+  );
+  const cacheCreationTokens = toNumber(
+    raw.cache_creation_input_tokens ?? raw.cacheCreationTokens ?? 0,
+  );
 
-  if (inputTokens === 0 && outputTokens === 0 && totalTokens === 0) {
+  if (
+    inputTokens === 0 &&
+    outputTokens === 0 &&
+    totalTokens === 0 &&
+    cacheReadTokens === 0 &&
+    cacheCreationTokens === 0
+  ) {
     return null;
   }
 
@@ -60,6 +75,8 @@ export function extractUsage(event) {
     inputTokens,
     outputTokens,
     totalTokens,
+    cacheReadTokens,
+    cacheCreationTokens,
     timestamp: event.timestamp || null,
   };
 }
@@ -73,6 +90,8 @@ export function aggregateUsage(events) {
     inputTokens: 0,
     outputTokens: 0,
     totalTokens: 0,
+    cacheReadTokens: 0,
+    cacheCreationTokens: 0,
     calls: 0,
   };
 
@@ -83,6 +102,8 @@ export function aggregateUsage(events) {
     total.inputTokens += u.inputTokens;
     total.outputTokens += u.outputTokens;
     total.totalTokens += u.totalTokens;
+    total.cacheReadTokens += u.cacheReadTokens || 0;
+    total.cacheCreationTokens += u.cacheCreationTokens || 0;
     total.calls += 1;
 
     const key = `${u.provider || "?"}/${u.model || "?"}`;
@@ -92,11 +113,15 @@ export function aggregateUsage(events) {
       inputTokens: 0,
       outputTokens: 0,
       totalTokens: 0,
+      cacheReadTokens: 0,
+      cacheCreationTokens: 0,
       calls: 0,
     };
     entry.inputTokens += u.inputTokens;
     entry.outputTokens += u.outputTokens;
     entry.totalTokens += u.totalTokens;
+    entry.cacheReadTokens += u.cacheReadTokens || 0;
+    entry.cacheCreationTokens += u.cacheCreationTokens || 0;
     entry.calls += 1;
     byKey.set(key, entry);
   }
@@ -129,6 +154,8 @@ export function allSessionsUsage({ limit = 1000 } = {}) {
     inputTokens: 0,
     outputTokens: 0,
     totalTokens: 0,
+    cacheReadTokens: 0,
+    cacheCreationTokens: 0,
     calls: 0,
   };
   const byKey = new Map();
@@ -137,6 +164,8 @@ export function allSessionsUsage({ limit = 1000 } = {}) {
     total.inputTokens += s.total.inputTokens;
     total.outputTokens += s.total.outputTokens;
     total.totalTokens += s.total.totalTokens;
+    total.cacheReadTokens += s.total.cacheReadTokens || 0;
+    total.cacheCreationTokens += s.total.cacheCreationTokens || 0;
     total.calls += s.total.calls;
     for (const row of s.byModel) {
       const key = `${row.provider || "?"}/${row.model || "?"}`;
@@ -146,11 +175,15 @@ export function allSessionsUsage({ limit = 1000 } = {}) {
         inputTokens: 0,
         outputTokens: 0,
         totalTokens: 0,
+        cacheReadTokens: 0,
+        cacheCreationTokens: 0,
         calls: 0,
       };
       entry.inputTokens += row.inputTokens;
       entry.outputTokens += row.outputTokens;
       entry.totalTokens += row.totalTokens;
+      entry.cacheReadTokens += row.cacheReadTokens || 0;
+      entry.cacheCreationTokens += row.cacheCreationTokens || 0;
       entry.calls += row.calls;
       byKey.set(key, entry);
     }

package/src/lib/skill-loader.js

@@ -199,7 +199,10 @@ export function substituteArguments(body, args) {
   // Protect literal $$
   const MARKER = "\u0000DOLLAR\u0000";
   let out = body.replace(/\$\$/g, MARKER);
-  out = out.replace(/\$ARGUMENTS\b/g, full);
+  // Insert the args via a function so $-sequences in the user's arguments
+  // ($&, $`, $', $$) are placed literally instead of being interpreted as
+  // String.replace patterns (which would otherwise mangle the args).
+  out = out.replace(/\$ARGUMENTS\b/g, () => full);
   out = out.replace(/\$(\d+)/g, (match, idx) => {
     const i = parseInt(idx, 10) - 1;
     if (i < 0 || i >= positional.length) return match;

package/src/lib/skill-packs/generator.js

@@ -158,7 +158,7 @@ ${commandDocs}
 /**
  * Generate handler.js content for a direct-execution pack
  */
-function generateDirectHandler(domainKey, domainDef) {
+export function generateDirectHandler(domainKey, domainDef) {
   const commandList = Object.keys(domainDef.commands).join('", "');
   const commandGuide = Object.entries(domainDef.commands)
     .map(
@@ -241,6 +241,17 @@ ${commandGuide}
     const useJson = JSON_SUPPORTED_COMMANDS.has(command) && !cliArgs.includes("--json");
     if (useJson) cliArgs.push("--json");
 
+    // Security: spawnSync uses shell:true (needed to run the chainlesschain.cmd
+    // shim on Windows), which joins cliArgs into a shell command. Reject shell
+    // metacharacters so a crafted skill input can't inject commands.
+    const unsafeArg = cliArgs.find((a) => /[;&|\`$<>()\\n\\r]/.test(a));
+    if (unsafeArg) {
+      return {
+        success: false,
+        error: "参数包含不安全的 shell 字符，已拒绝执行: " + JSON.stringify(unsafeArg),
+      };
+    }
+
     // Execute via child process
     const result = spawnSync("chainlesschain", cliArgs, {
       encoding: "utf-8",
@@ -371,7 +382,7 @@ module.exports = handler;
 /**
  * Generate handler.js content for hybrid-mode pack
  */
-function generateHybridHandler(domainKey, domainDef) {
+export function generateHybridHandler(domainKey, domainDef) {
   const agentCmds = Object.entries(domainDef.commands)
     .filter(([cmd, info]) => info.isAgentMode || AGENT_MODE_COMMANDS.has(cmd))
     .map(([cmd]) => `"${cmd}"`)
@@ -458,6 +469,18 @@ const handler = {
 
     // Direct execution for other commands
     const cliArgs = [...args, "--quiet"];
+
+    // Security: spawnSync uses shell:true (needed to run the chainlesschain.cmd
+    // shim on Windows), which joins cliArgs into a shell command. Reject shell
+    // metacharacters so a crafted skill input can't inject commands.
+    const unsafeArg = cliArgs.find((a) => /[;&|\`$<>()\\n\\r]/.test(a));
+    if (unsafeArg) {
+      return {
+        success: false,
+        error: "参数包含不安全的 shell 字符，已拒绝执行: " + JSON.stringify(unsafeArg),
+      };
+    }
+
     const result = spawnSync("chainlesschain", cliArgs, {
       encoding: "utf-8",
       shell: true,

package/src/lib/stream-retry.js

@@ -0,0 +1,56 @@
+/**
+ * stream-retry — shared classification of transient streaming-chat failures.
+ *
+ * A streaming LLM call can drop mid-flight (ECONNRESET / "terminated" / socket
+ * hangup / DNS). When that happens BEFORE any output reached the user it is safe
+ * to re-issue the request. This module is the single source of truth for "is
+ * this error a retryable connection drop?" so the agent path (agent-core) and
+ * the chat path (chat-core) classify identically.
+ *
+ * Pure + dependency-light (only the shared abort-utils) so it can be unit-tested
+ * and imported by either streaming implementation without pulling in the heavy
+ * agent runtime.
+ */
+
+import { isAbortError } from "./abort-utils.js";
+
+/** Bounded auto-retry budget for streaming connection drops (Claude-Code 2.1.181). */
+export const STREAM_RETRY_MAX = 2;
+export const STREAM_RETRY_BASE_MS = 400;
+
+/**
+ * Is this error from a streaming chat request a transient API CONNECTION drop
+ * that is safe to retry? True only for genuine network failures (reset /
+ * timeout / DNS / refused / socket hangup / undici "terminated" / "fetch
+ * failed"). False for user aborts and for HTTP/status errors (a 4xx/auth/5xx is
+ * the server's verdict carried in the message, not a dropped pipe — retrying a
+ * connection that never dropped won't help and could double-bill).
+ *
+ * @param {unknown} err
+ * @param {AbortSignal} [signal]  the caller's signal — a user abort is never retryable
+ * @returns {boolean}
+ */
+export function isRetryableStreamError(err, signal) {
+  if (isAbortError(err)) return false;
+  if (signal && signal.aborted) return false;
+  if (!err) return false;
+  const code = String(err.code || err.cause?.code || "").toUpperCase();
+  if (
+    [
+      "ECONNRESET",
+      "ETIMEDOUT",
+      "ECONNREFUSED",
+      "EAI_AGAIN",
+      "EPIPE",
+      "ENETUNREACH",
+      "ENOTFOUND",
+      "UND_ERR_SOCKET",
+    ].includes(code)
+  ) {
+    return true;
+  }
+  const msg = String(err.message || err).toLowerCase();
+  return /econnreset|etimedout|econnrefused|eai_again|socket hang ?up|terminated|fetch failed|network error|timed?\s*out|premature close/.test(
+    msg,
+  );
+}

package/src/lib/sync-credentials.js

@@ -23,6 +23,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import crypto from "node:crypto";
+import { withFileLock } from "./with-file-lock.js";
 
 const SENSITIVE_FIELDS = ["sync.webdav.password", "sync.oss.secretAccessKey"];
 const ALLOWED_PROVIDER_IDS = ["webdav", "oss"];
@@ -55,6 +56,37 @@ function _ensureDir() {
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
 }
 
+/**
+ * Write a secret file atomically. A crash (or concurrent writer) mid-write must
+ * never corrupt the master key or the encrypted vault — a truncated key throws
+ * on every load, a truncated vault fails AEAD decrypt and forces a reconfigure.
+ * Temp sibling + rename (atomic within a filesystem); when `mode` is given the
+ * temp is created with it (0600) so the secret is never world-readable in the
+ * window before rename. chmod after rename is belt-and-suspenders (best-effort
+ * on NTFS / older fs).
+ */
+function _atomicWriteFileSync(filePath, data, mode) {
+  const tmp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    fs.writeFileSync(tmp, data, mode != null ? { mode } : undefined);
+    fs.renameSync(tmp, filePath);
+    if (mode != null) {
+      try {
+        fs.chmodSync(filePath, mode);
+      } catch (_e) {
+        /* non-fatal: NTFS / older fs */
+      }
+    }
+  } catch (err) {
+    try {
+      if (fs.existsSync(tmp)) fs.unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
 function _loadOrCreateMasterKey() {
   _ensureDir();
   const kp = _keyPath();
@@ -69,12 +101,10 @@ function _loadOrCreateMasterKey() {
     return buf;
   }
   const key = crypto.randomBytes(KEY_LEN);
-  fs.writeFileSync(kp, key);
-  try {
-    fs.chmodSync(kp, 0o600);
-  } catch (_e) {
-    /* non-fatal: NTFS / older fs */
-  }
+  // Atomic + 0600 from creation: a crash mid-write must not leave a truncated
+  // master key (a wrong-length key file then throws on every load), and the
+  // secret must never be briefly world-readable in the gap before chmod.
+  _atomicWriteFileSync(kp, key, 0o600);
   return key;
 }
 
@@ -123,7 +153,7 @@ function loadAll() {
 
 function saveAll(all) {
   _ensureDir();
-  fs.writeFileSync(_vaultPath(), _encryptBlob(JSON.stringify(all)));
+  _atomicWriteFileSync(_vaultPath(), _encryptBlob(JSON.stringify(all)));
   return true;
 }
 
@@ -184,20 +214,26 @@ function setCredentials(providerId, creds) {
   if (!creds || typeof creds !== "object") {
     throw new Error("sync-credentials: creds must be an object");
   }
-  const all = loadAll();
-  if (!all.sync || typeof all.sync !== "object") all.sync = {};
-  all.sync[providerId] = { ...creds };
-  return saveAll(all);
+  // Serialize the decrypt-modify-encrypt across processes so a concurrent write
+  // to a different provider doesn't drop this one (best-effort, never hangs).
+  return withFileLock(_vaultPath(), () => {
+    const all = loadAll();
+    if (!all.sync || typeof all.sync !== "object") all.sync = {};
+    all.sync[providerId] = { ...creds };
+    return saveAll(all);
+  });
 }
 
 function clearCredentials(providerId) {
   assertProviderId(providerId);
-  const all = loadAll();
-  if (all?.sync?.[providerId]) {
-    delete all.sync[providerId];
-    return saveAll(all);
-  }
-  return true;
+  return withFileLock(_vaultPath(), () => {
+    const all = loadAll();
+    if (all?.sync?.[providerId]) {
+      delete all.sync[providerId];
+      return saveAll(all);
+    }
+    return true;
+  });
 }
 
 /** Test seam: override the resolved chainlesschain dir without env leak. */

package/src/lib/token-tracker.js

@@ -21,9 +21,19 @@ const PRICING = {
     _default: { input: 2.5, output: 10 },
   },
   anthropic: {
+    // Current Anthropic list prices (USD/1M), verified 2026-06-21 vs the
+    // claude-api reference. Lookup is EXACT-key (calculateCost), so keep current
+    // model ids listed or they fall back to the Sonnet _default and mis-price —
+    // e.g. claude-opus-4-8 would otherwise be billed at $3/$15 not $5/$25. The
+    // Opus tier dropped to $5/$25 with Opus 4.5; Haiku 4.5 is $1/$5.
+    "claude-opus-4-8": { input: 5, output: 25 },
+    "claude-opus-4-7": { input: 5, output: 25 },
+    "claude-opus-4-6": { input: 5, output: 25 },
+    "claude-opus-4-5": { input: 5, output: 25 },
     "claude-sonnet-4-6": { input: 3, output: 15 },
-    "claude-opus-4-6": { input: 15, output: 75 },
-    "claude-haiku-4-5-20251001": { input: 0.8, output: 4 },
+    "claude-haiku-4-5": { input: 1, output: 5 },
+    "claude-haiku-4-5-20251001": { input: 1, output: 5 },
+    "claude-fable-5": { input: 10, output: 50 },
     _default: { input: 3, output: 15 },
   },
   deepseek: {

package/src/lib/with-file-lock.js

@@ -0,0 +1,87 @@
+/**
+ * Best-effort cross-process advisory lock around a state file.
+ *
+ * Multiple `cc` processes (and, for some dirs, the desktop app) can do
+ * read-modify-write on the same JSON state file. An atomic temp+rename makes
+ * each write crash-safe but does NOT prevent a lost update: A reads, B reads, A
+ * writes, B writes → A's change is gone. This serializes the whole
+ * read-mutate-write across processes using a lock DIRECTORY — `mkdir` is
+ * atomic-exclusive on POSIX and Windows, so exactly one process holds it.
+ *
+ * SAFETY — this is intentionally best-effort. If the lock can't be acquired
+ * within `timeoutMs`, it PROCEEDS WITHOUT THE LOCK rather than hanging or
+ * throwing: worst case degrades to the pre-lock behavior (a rare lost update),
+ * never a frozen CLI. A lock left by a crashed holder is reclaimed once its
+ * mtime is older than `staleMs`. The lock is always released in `finally`.
+ *
+ * @param {string} targetPath  the file being guarded (lock is `${targetPath}.lock`)
+ * @param {(ctx:{locked:boolean})=>T} fn  critical section; receives whether the lock was held
+ * @returns {T} whatever `fn` returns
+ */
+export function withFileLock(targetPath, fn, opts = {}) {
+  const {
+    timeoutMs = 2000,
+    staleMs = 30000,
+    retryMs = 25,
+    _fs = defaultFs,
+    _now = () => Date.now(),
+    _sleep = sleepSync,
+  } = opts;
+
+  const lockDir = `${targetPath}.lock`;
+  let held = false;
+  const deadline = _now() + timeoutMs;
+
+  for (;;) {
+    try {
+      _fs.mkdirSync(lockDir);
+      held = true;
+      break;
+    } catch (err) {
+      if (!err || err.code !== "EEXIST") break; // unexpected fs error → run unlocked
+      // Reclaim a stale lock left by a crashed holder.
+      try {
+        const age = _now() - _fs.statSync(lockDir).mtimeMs;
+        if (age > staleMs) {
+          _fs.rmSync(lockDir, { recursive: true, force: true });
+          continue; // retry acquisition immediately
+        }
+      } catch {
+        /* stat lost a race with the holder releasing — fall through to wait */
+      }
+      if (_now() >= deadline) break; // timed out → run unlocked (best-effort)
+      _sleep(retryMs);
+    }
+  }
+
+  try {
+    return fn({ locked: held });
+  } finally {
+    if (held) {
+      try {
+        _fs.rmSync(lockDir, { recursive: true, force: true });
+      } catch {
+        /* best-effort release */
+      }
+    }
+  }
+}
+
+import fs from "node:fs";
+const defaultFs = {
+  mkdirSync: (p) => fs.mkdirSync(p),
+  statSync: (p) => fs.statSync(p),
+  rmSync: (p, o) => fs.rmSync(p, o),
+};
+
+/** Synchronous sleep that doesn't busy-spin the CPU when possible. */
+function sleepSync(ms) {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  } catch {
+    const end = Date.now() + ms; // SharedArrayBuffer unavailable — bounded spin
+    while (Date.now() < end) {
+      /* spin */
+    }
+  }
+}