chainlesschain 0.162.95 → 0.162.96

package/src/lib/stream-retry.js

@@ -0,0 +1,56 @@
+/**
+ * stream-retry — shared classification of transient streaming-chat failures.
+ *
+ * A streaming LLM call can drop mid-flight (ECONNRESET / "terminated" / socket
+ * hangup / DNS). When that happens BEFORE any output reached the user it is safe
+ * to re-issue the request. This module is the single source of truth for "is
+ * this error a retryable connection drop?" so the agent path (agent-core) and
+ * the chat path (chat-core) classify identically.
+ *
+ * Pure + dependency-light (only the shared abort-utils) so it can be unit-tested
+ * and imported by either streaming implementation without pulling in the heavy
+ * agent runtime.
+ */
+
+import { isAbortError } from "./abort-utils.js";
+
+/** Bounded auto-retry budget for streaming connection drops (Claude-Code 2.1.181). */
+export const STREAM_RETRY_MAX = 2;
+export const STREAM_RETRY_BASE_MS = 400;
+
+/**
+ * Is this error from a streaming chat request a transient API CONNECTION drop
+ * that is safe to retry? True only for genuine network failures (reset /
+ * timeout / DNS / refused / socket hangup / undici "terminated" / "fetch
+ * failed"). False for user aborts and for HTTP/status errors (a 4xx/auth/5xx is
+ * the server's verdict carried in the message, not a dropped pipe — retrying a
+ * connection that never dropped won't help and could double-bill).
+ *
+ * @param {unknown} err
+ * @param {AbortSignal} [signal]  the caller's signal — a user abort is never retryable
+ * @returns {boolean}
+ */
+export function isRetryableStreamError(err, signal) {
+  if (isAbortError(err)) return false;
+  if (signal && signal.aborted) return false;
+  if (!err) return false;
+  const code = String(err.code || err.cause?.code || "").toUpperCase();
+  if (
+    [
+      "ECONNRESET",
+      "ETIMEDOUT",
+      "ECONNREFUSED",
+      "EAI_AGAIN",
+      "EPIPE",
+      "ENETUNREACH",
+      "ENOTFOUND",
+      "UND_ERR_SOCKET",
+    ].includes(code)
+  ) {
+    return true;
+  }
+  const msg = String(err.message || err).toLowerCase();
+  return /econnreset|etimedout|econnrefused|eai_again|socket hang ?up|terminated|fetch failed|network error|timed?\s*out|premature close/.test(
+    msg,
+  );
+}

package/src/lib/sync-credentials.js

@@ -23,6 +23,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import crypto from "node:crypto";
+import { withFileLock } from "./with-file-lock.js";
 
 const SENSITIVE_FIELDS = ["sync.webdav.password", "sync.oss.secretAccessKey"];
 const ALLOWED_PROVIDER_IDS = ["webdav", "oss"];
@@ -55,6 +56,37 @@ function _ensureDir() {
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
 }
 
+/**
+ * Write a secret file atomically. A crash (or concurrent writer) mid-write must
+ * never corrupt the master key or the encrypted vault — a truncated key throws
+ * on every load, a truncated vault fails AEAD decrypt and forces a reconfigure.
+ * Temp sibling + rename (atomic within a filesystem); when `mode` is given the
+ * temp is created with it (0600) so the secret is never world-readable in the
+ * window before rename. chmod after rename is belt-and-suspenders (best-effort
+ * on NTFS / older fs).
+ */
+function _atomicWriteFileSync(filePath, data, mode) {
+  const tmp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    fs.writeFileSync(tmp, data, mode != null ? { mode } : undefined);
+    fs.renameSync(tmp, filePath);
+    if (mode != null) {
+      try {
+        fs.chmodSync(filePath, mode);
+      } catch (_e) {
+        /* non-fatal: NTFS / older fs */
+      }
+    }
+  } catch (err) {
+    try {
+      if (fs.existsSync(tmp)) fs.unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
 function _loadOrCreateMasterKey() {
   _ensureDir();
   const kp = _keyPath();
@@ -69,12 +101,10 @@ function _loadOrCreateMasterKey() {
     return buf;
   }
   const key = crypto.randomBytes(KEY_LEN);
-  fs.writeFileSync(kp, key);
-  try {
-    fs.chmodSync(kp, 0o600);
-  } catch (_e) {
-    /* non-fatal: NTFS / older fs */
-  }
+  // Atomic + 0600 from creation: a crash mid-write must not leave a truncated
+  // master key (a wrong-length key file then throws on every load), and the
+  // secret must never be briefly world-readable in the gap before chmod.
+  _atomicWriteFileSync(kp, key, 0o600);
   return key;
 }
 
@@ -123,7 +153,7 @@ function loadAll() {
 
 function saveAll(all) {
   _ensureDir();
-  fs.writeFileSync(_vaultPath(), _encryptBlob(JSON.stringify(all)));
+  _atomicWriteFileSync(_vaultPath(), _encryptBlob(JSON.stringify(all)));
   return true;
 }
 
@@ -184,20 +214,26 @@ function setCredentials(providerId, creds) {
   if (!creds || typeof creds !== "object") {
     throw new Error("sync-credentials: creds must be an object");
   }
-  const all = loadAll();
-  if (!all.sync || typeof all.sync !== "object") all.sync = {};
-  all.sync[providerId] = { ...creds };
-  return saveAll(all);
+  // Serialize the decrypt-modify-encrypt across processes so a concurrent write
+  // to a different provider doesn't drop this one (best-effort, never hangs).
+  return withFileLock(_vaultPath(), () => {
+    const all = loadAll();
+    if (!all.sync || typeof all.sync !== "object") all.sync = {};
+    all.sync[providerId] = { ...creds };
+    return saveAll(all);
+  });
 }
 
 function clearCredentials(providerId) {
   assertProviderId(providerId);
-  const all = loadAll();
-  if (all?.sync?.[providerId]) {
-    delete all.sync[providerId];
-    return saveAll(all);
-  }
-  return true;
+  return withFileLock(_vaultPath(), () => {
+    const all = loadAll();
+    if (all?.sync?.[providerId]) {
+      delete all.sync[providerId];
+      return saveAll(all);
+    }
+    return true;
+  });
 }
 
 /** Test seam: override the resolved chainlesschain dir without env leak. */

package/src/lib/token-tracker.js

@@ -21,9 +21,19 @@ const PRICING = {
     _default: { input: 2.5, output: 10 },
   },
   anthropic: {
+    // Current Anthropic list prices (USD/1M), verified 2026-06-21 vs the
+    // claude-api reference. Lookup is EXACT-key (calculateCost), so keep current
+    // model ids listed or they fall back to the Sonnet _default and mis-price —
+    // e.g. claude-opus-4-8 would otherwise be billed at $3/$15 not $5/$25. The
+    // Opus tier dropped to $5/$25 with Opus 4.5; Haiku 4.5 is $1/$5.
+    "claude-opus-4-8": { input: 5, output: 25 },
+    "claude-opus-4-7": { input: 5, output: 25 },
+    "claude-opus-4-6": { input: 5, output: 25 },
+    "claude-opus-4-5": { input: 5, output: 25 },
     "claude-sonnet-4-6": { input: 3, output: 15 },
-    "claude-opus-4-6": { input: 15, output: 75 },
-    "claude-haiku-4-5-20251001": { input: 0.8, output: 4 },
+    "claude-haiku-4-5": { input: 1, output: 5 },
+    "claude-haiku-4-5-20251001": { input: 1, output: 5 },
+    "claude-fable-5": { input: 10, output: 50 },
     _default: { input: 3, output: 15 },
   },
   deepseek: {

package/src/lib/with-file-lock.js

@@ -0,0 +1,87 @@
+/**
+ * Best-effort cross-process advisory lock around a state file.
+ *
+ * Multiple `cc` processes (and, for some dirs, the desktop app) can do
+ * read-modify-write on the same JSON state file. An atomic temp+rename makes
+ * each write crash-safe but does NOT prevent a lost update: A reads, B reads, A
+ * writes, B writes → A's change is gone. This serializes the whole
+ * read-mutate-write across processes using a lock DIRECTORY — `mkdir` is
+ * atomic-exclusive on POSIX and Windows, so exactly one process holds it.
+ *
+ * SAFETY — this is intentionally best-effort. If the lock can't be acquired
+ * within `timeoutMs`, it PROCEEDS WITHOUT THE LOCK rather than hanging or
+ * throwing: worst case degrades to the pre-lock behavior (a rare lost update),
+ * never a frozen CLI. A lock left by a crashed holder is reclaimed once its
+ * mtime is older than `staleMs`. The lock is always released in `finally`.
+ *
+ * @param {string} targetPath  the file being guarded (lock is `${targetPath}.lock`)
+ * @param {(ctx:{locked:boolean})=>T} fn  critical section; receives whether the lock was held
+ * @returns {T} whatever `fn` returns
+ */
+export function withFileLock(targetPath, fn, opts = {}) {
+  const {
+    timeoutMs = 2000,
+    staleMs = 30000,
+    retryMs = 25,
+    _fs = defaultFs,
+    _now = () => Date.now(),
+    _sleep = sleepSync,
+  } = opts;
+
+  const lockDir = `${targetPath}.lock`;
+  let held = false;
+  const deadline = _now() + timeoutMs;
+
+  for (;;) {
+    try {
+      _fs.mkdirSync(lockDir);
+      held = true;
+      break;
+    } catch (err) {
+      if (!err || err.code !== "EEXIST") break; // unexpected fs error → run unlocked
+      // Reclaim a stale lock left by a crashed holder.
+      try {
+        const age = _now() - _fs.statSync(lockDir).mtimeMs;
+        if (age > staleMs) {
+          _fs.rmSync(lockDir, { recursive: true, force: true });
+          continue; // retry acquisition immediately
+        }
+      } catch {
+        /* stat lost a race with the holder releasing — fall through to wait */
+      }
+      if (_now() >= deadline) break; // timed out → run unlocked (best-effort)
+      _sleep(retryMs);
+    }
+  }
+
+  try {
+    return fn({ locked: held });
+  } finally {
+    if (held) {
+      try {
+        _fs.rmSync(lockDir, { recursive: true, force: true });
+      } catch {
+        /* best-effort release */
+      }
+    }
+  }
+}
+
+import fs from "node:fs";
+const defaultFs = {
+  mkdirSync: (p) => fs.mkdirSync(p),
+  statSync: (p) => fs.statSync(p),
+  rmSync: (p, o) => fs.rmSync(p, o),
+};
+
+/** Synchronous sleep that doesn't busy-spin the CPU when possible. */
+function sleepSync(ms) {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  } catch {
+    const end = Date.now() + ms; // SharedArrayBuffer unavailable — bounded spin
+    while (Date.now() < end) {
+      /* spin */
+    }
+  }
+}

package/src/repl/agent-repl.js

@@ -286,9 +286,19 @@ export async function startAgentRepl(options = {}) {
   // an auto-detected image path so the REPL switches to a vision-capable model
   // for that turn only (resolveVisionLlm falls back to the default when unset).
   let _visionModel;
+  // Hard stream inactivity timeout override (config.llm.streamStallTimeoutMs,
+  // ms): a stream silent that long is aborted + retried instead of hanging.
+  // Unset → agent-core's 180s default (matches cc chat/ask). Set to 0 to
+  // disable. Left undefined here means "use the default".
+  let _streamStallTimeoutMs;
   try {
     const { loadConfig } = await import("../lib/config-manager.js");
-    _visionModel = loadConfig()?.llm?.visionModel || undefined;
+    const _cfg = loadConfig();
+    _visionModel = _cfg?.llm?.visionModel || undefined;
+    const raw = _cfg?.llm?.streamStallTimeoutMs;
+    const t = Number(raw);
+    // Accept 0 (explicit disable) — only ignore absent/invalid values.
+    if (raw != null && Number.isFinite(t) && t >= 0) _streamStallTimeoutMs = t;
   } catch {
     /* optional — resolveVisionLlm falls back to DEFAULT_VISION_MODEL */
   }
@@ -721,6 +731,7 @@ export async function startAgentRepl(options = {}) {
           // an IDE integrated terminal. --ide forces it, --no-ide disables it
           // (parity with headless; auto-detect already works via process.env).
           ide: options.ide,
+          pdh: options.pdh,
           cwd: process.cwd(),
           // advertise the session id to spawned stdio MCP servers
           sessionId,
@@ -2463,12 +2474,19 @@ export async function startAgentRepl(options = {}) {
           process.stdout.write(chalk.gray(`  [step] ${evt.step}\n`));
         };
 
-        autonomousAgent.on("goal:completed", goalListener);
-        autonomousAgent.on("goal:failed", goalListener);
-        autonomousAgent.on("step:started", stepListener);
-        autonomousAgent.on("step:completed", (evt) => {
-          process.stdout.write(chalk.green(`  [done] ${evt.step}\n`));
-        });
+        // Attach the live-output listeners ONCE per REPL session — the agent is
+        // a session-scoped singleton (created once above), so re-attaching on
+        // every `/auto` would accumulate listeners (duplicate output + leak +
+        // MaxListenersExceededWarning). The handlers are stateless.
+        if (!autonomousAgent._replListenersAttached) {
+          autonomousAgent._replListenersAttached = true;
+          autonomousAgent.on("goal:completed", goalListener);
+          autonomousAgent.on("goal:failed", goalListener);
+          autonomousAgent.on("step:started", stepListener);
+          autonomousAgent.on("step:completed", (evt) => {
+            process.stdout.write(chalk.green(`  [done] ${evt.step}\n`));
+          });
+        }
 
         logger.info(`Submitting goal: ${chalk.cyan(autoArg)}`);
         try {
@@ -3249,6 +3267,20 @@ export async function startAgentRepl(options = {}) {
               `  ⟳ connection dropped — retrying (attempt ${attempt})…\n`,
             ),
           ),
+        // Stream-stall hint (Claude-Code 2.1.185): the connection is alive but
+        // the API has gone silent mid-response — tell the user we're still
+        // waiting instead of leaving a frozen spinner. stderr so it never
+        // corrupts the streamed answer on stdout.
+        onStall: (ms) =>
+          process.stderr.write(
+            chalk.dim(
+              `  ⏳ waiting for API response (silent ${Math.round(ms / 1000)}s)…\n`,
+            ),
+          ),
+        // Hard inactivity timeout: abort + retry a dead-but-open stream instead
+        // of hanging forever. undefined → agent-core's 180s default (matches cc
+        // chat/ask); config.llm.streamStallTimeoutMs tunes or disables (0).
+        streamStallTimeoutMs: _streamStallTimeoutMs,
         signal: _turnAbort.signal,
         // On an auto-detected image turn, switch to the vision LLM for this
         // turn only (provider/baseUrl/apiKey unchanged, model → vision model).

package/src/repl/chat-repl.js

@@ -183,6 +183,13 @@ export async function startChatRepl(options = {}) {
       const onUsage = (u) => {
         capturedUsage = u;
       };
+      // Stall hint (cc agent parity): the connection is alive but the API has
+      // gone silent — reassure instead of a frozen cursor. stderr so it never
+      // corrupts the streamed answer on stdout.
+      const onStall = (ms) =>
+        process.stderr.write(
+          `\x1b[2m  ⏳ waiting for API response (silent ${Math.round(ms / 1000)}s)…\x1b[0m\n`,
+        );
 
       if (sessionId)
         appendEvent(sessionId, "user_message", { content: trimmed });
@@ -194,6 +201,7 @@ export async function startChatRepl(options = {}) {
           baseUrl,
           onToken,
           onUsage,
+          onStall,
         );
       } else if (provider === "anthropic") {
         const providerDef = BUILT_IN_PROVIDERS.anthropic;
@@ -215,6 +223,7 @@ export async function startChatRepl(options = {}) {
           key,
           onToken,
           onUsage,
+          onStall,
         );
       } else {
         // OpenAI-compatible providers (openai, volcengine, deepseek, dashscope, mistral, gemini, anthropic-proxy)
@@ -237,6 +246,7 @@ export async function startChatRepl(options = {}) {
           key,
           onToken,
           onUsage,
+          onStall,
         );
       }
 

package/src/repl/session-cost.js

@@ -24,7 +24,14 @@ function fmtUsd(n) {
 /** A fresh accumulator: running totals + per provider/model rows. */
 export function newCostStore() {
   return {
-    total: { inputTokens: 0, outputTokens: 0, totalTokens: 0, calls: 0 },
+    total: {
+      inputTokens: 0,
+      outputTokens: 0,
+      totalTokens: 0,
+      cacheReadTokens: 0,
+      cacheCreationTokens: 0,
+      calls: 0,
+    },
     byKey: new Map(),
   };
 }
@@ -43,10 +50,16 @@ export function addUsage(store, events) {
     const inT = num(u.input_tokens ?? u.prompt_tokens ?? u.inputTokens);
     const outT = num(u.output_tokens ?? u.completion_tokens ?? u.outputTokens);
     const totT = num(u.total_tokens ?? u.totalTokens ?? inT + outT);
-    if (inT === 0 && outT === 0 && totT === 0) continue;
+    // Prompt-cache token counts (Anthropic caching) so /cost prices cached
+    // reads/writes correctly; absent on non-caching providers → 0.
+    const cR = num(u.cache_read_input_tokens ?? u.cacheReadTokens);
+    const cC = num(u.cache_creation_input_tokens ?? u.cacheCreationTokens);
+    if (inT === 0 && outT === 0 && totT === 0 && cR === 0 && cC === 0) continue;
     s.total.inputTokens += inT;
     s.total.outputTokens += outT;
     s.total.totalTokens += totT;
+    s.total.cacheReadTokens += cR;
+    s.total.cacheCreationTokens += cC;
     s.total.calls += 1;
     const key = `${ev.provider || "?"}/${ev.model || "?"}`;
     let row = s.byKey.get(key);
@@ -57,6 +70,8 @@ export function addUsage(store, events) {
         inputTokens: 0,
         outputTokens: 0,
         totalTokens: 0,
+        cacheReadTokens: 0,
+        cacheCreationTokens: 0,
         calls: 0,
       };
       s.byKey.set(key, row);
@@ -64,6 +79,8 @@ export function addUsage(store, events) {
     row.inputTokens += inT;
     row.outputTokens += outT;
     row.totalTokens += totT;
+    row.cacheReadTokens += cR;
+    row.cacheCreationTokens += cC;
     row.calls += 1;
   }
   return s;
@@ -172,10 +189,21 @@ export function renderSessionCost(store, { pricingOverrides, roles } = {}) {
     `  total: ${fmtUsd(result.cost.totalCost)} USD  ` +
       `(${result.total.totalTokens.toLocaleString()} tokens, ${result.total.calls} calls)`,
   );
+  // Cache line only when caching actually happened this session.
+  const cacheRead = num(result.total.cacheReadTokens);
+  const cacheWrite = num(result.total.cacheCreationTokens);
+  if (cacheRead || cacheWrite) {
+    lines.push(
+      `  cache: ${cacheRead.toLocaleString()} read + ${cacheWrite.toLocaleString()} write tokens`,
+    );
+  }
   for (const row of result.byModel) {
     const provider = (row.provider || "?").padEnd(10);
     const model = (row.model || "?").padEnd(24);
-    const tokens = `in=${row.inputTokens} out=${row.outputTokens}`;
+    const cacheSuffix = num(row.cacheReadTokens)
+      ? ` cache_read=${row.cacheReadTokens}`
+      : "";
+    const tokens = `in=${row.inputTokens} out=${row.outputTokens}${cacheSuffix}`;
     const price = row.free
       ? "free (local)"
       : row.matched