chainlesschain 0.163.3 → 0.163.5

package/src/harness/mcp-client.js

@@ -16,6 +16,7 @@ import { isProxy } from "node:util/types";
 import WebSocket from "ws";
 import { safeJsonParse } from "../lib/safe-json.js";
 import {
+  enforceMcpStdioCapsuleHostSandboxPolicy,
   MCP_SANDBOX_POLICY_INVALID_CODE,
   normalizeMcpSandboxPolicy,
   readMcpStdioCwd,
@@ -40,7 +41,7 @@ import {
   verifyMcpStdioApprovedWorkingDirectory,
 } from "../lib/mcp-stdio-execution-authority.js";
 import {
-  MCP_STDIO_CAPSULE_CODE_SNAPSHOT_BOUNDARY,
+  MCP_STDIO_CAPSULE_REQUIRED_BOUNDARIES,
   prepareMcpStdioExecutableIdentity,
 } from "../lib/mcp-stdio-executable-identity.js";
 import { resolveMcpStdioSandboxContext } from "../lib/mcp-stdio-workspace-authority.js";
@@ -611,6 +612,102 @@ function mcpTransportError(code, message, details = {}) {
   return error;
 }
 
+function dispatchMcpToolRequest(options, metadata, dispatch) {
+  const admission = options?.dispatchAdmission ?? null;
+  if (metadata.method !== "tools/call" || admission === null) {
+    return dispatch();
+  }
+  if (typeof admission !== "function") {
+    throw mcpTransportError(
+      "CC_MCP_DISPATCH_ADMISSION_INVALID",
+      "MCP tool dispatch authority is invalid",
+      {
+        transport: metadata.transport,
+        dispatched: false,
+        outcomeUnknown: false,
+      },
+    );
+  }
+
+  let admissionOpen = true;
+  let dispatched = false;
+  let dispatchResult;
+  const admittedDispatch = () => {
+    if (!admissionOpen || dispatched) {
+      throw mcpTransportError(
+        "CC_MCP_DISPATCH_ADMISSION_INVALID",
+        "MCP tool dispatch authority invoked its one-shot send outside the admission window",
+        { transport: metadata.transport },
+      );
+    }
+    dispatched = true;
+    dispatchResult = dispatch();
+    return dispatchResult;
+  };
+
+  try {
+    const admissionResult = admission(
+      Object.freeze({ ...metadata }),
+      admittedDispatch,
+    );
+    if (!dispatched) {
+      throw mcpTransportError(
+        "CC_MCP_DISPATCH_ADMISSION_REQUIRED",
+        "MCP tool dispatch authority did not synchronously admit the request",
+        { transport: metadata.transport },
+      );
+    }
+    if (admissionResult !== dispatchResult) {
+      throw mcpTransportError(
+        "CC_MCP_DISPATCH_AUTHORITY_OUTCOME_UNKNOWN",
+        "MCP tool dispatch started, but the host did not synchronously return the admitted send",
+        {
+          transport: metadata.transport,
+          dispatched: true,
+          outcomeUnknown: true,
+        },
+      );
+    }
+    return dispatchResult;
+  } catch (cause) {
+    if (!dispatched) {
+      if (safeRpcProperty(cause, "dispatched") === false) throw cause;
+      const causeCode = safeRpcProperty(cause, "code");
+      const error = mcpTransportError(
+        typeof causeCode === "string" && causeCode.startsWith("CC_")
+          ? causeCode
+          : "CC_MCP_DISPATCH_NOT_ADMITTED",
+        "MCP tool request was not dispatched because host authority denied admission",
+        {
+          transport: metadata.transport,
+          dispatched: false,
+          outcomeUnknown: false,
+        },
+      );
+      error.cause = cause;
+      throw error;
+    }
+    if (safeRpcProperty(cause, "outcomeUnknown") === true) {
+      throw cause;
+    }
+    const error = mcpTransportError(
+      "CC_MCP_DISPATCH_AUTHORITY_OUTCOME_UNKNOWN",
+      "MCP tool dispatch started, but the host could not durably confirm its dispatch authority",
+      {
+        transport: metadata.transport,
+        dispatched: true,
+        outcomeUnknown: true,
+      },
+    );
+    error.cause = cause;
+    throw error;
+  } finally {
+    // An admission callback must invoke the send before returning. This also
+    // prevents an async callback from retaining a usable dispatch capability.
+    admissionOpen = false;
+  }
+}
+
 function mcpWebSocketPayloadTooLargeError(
   serverName,
   { transport, url, limitBytes, closeCode = 1009 },
@@ -1973,6 +2070,17 @@ export class MCPClient extends EventEmitter {
       stdioExecutableIdentityDigest = prepared.identityDigest;
       stdioCapsuleSandboxExecutionContract =
         prepared.sandboxExecutionContract || null;
+      if (stdioCapsuleSandboxExecutionContract) {
+        runtimeConfig = {
+          ...runtimeConfig,
+          sandboxPolicy: enforceMcpStdioCapsuleHostSandboxPolicy(
+            sourceConfig.sandboxPolicy,
+            {
+              label: `MCP stdio server "${name}" capsule sandboxPolicy`,
+            },
+          ),
+        };
+      }
     }
     const connectionHeaders = await this._connectionHeaders(
       name,
@@ -2394,17 +2502,13 @@ export class MCPClient extends EventEmitter {
           // Broker's Job Object boundary so an unexpectedly exiting MCP root
           // cannot orphan grandchildren before taskkill can enumerate them.
           detached: process.platform !== "win32",
-          ...(process.platform === "win32" ||
-          stdioCapsuleSandboxExecutionContract
+          ...(stdioCapsuleSandboxExecutionContract
             ? {
-                requiredBoundaries: [
-                  ...(process.platform === "win32" ? ["process-tree"] : []),
-                  ...(stdioCapsuleSandboxExecutionContract
-                    ? [MCP_STDIO_CAPSULE_CODE_SNAPSHOT_BOUNDARY]
-                    : []),
-                ],
+                requiredBoundaries: MCP_STDIO_CAPSULE_REQUIRED_BOUNDARIES,
               }
-            : {}),
+            : process.platform === "win32"
+              ? { requiredBoundaries: ["process-tree"] }
+              : {}),
           pluginId: config.pluginId,
           pluginVersion: config.pluginVersion,
           pluginSource: config.pluginSource,
@@ -2427,11 +2531,15 @@ export class MCPClient extends EventEmitter {
                   process.cwd(),
               )
             : null);
+        const effectiveRuntimeSandboxBoundaries = new Set([
+          ...(spawnOptions.requiredBoundaries || []),
+          ...(config.sandboxPolicy?.requiredBoundaries || []),
+        ]);
         const capsuleUsesLinuxProcessTreeSandbox =
           Boolean(stdioCapsuleSandboxExecutionContract) &&
           process.platform === "linux" &&
-          sourceConfig.sandboxPolicy?.requiredBoundaries?.some((boundary) =>
-            ["filesystem", "network", "process-tree"].includes(boundary),
+          MCP_STDIO_CAPSULE_REQUIRED_BOUNDARIES.every((boundary) =>
+            effectiveRuntimeSandboxBoundaries.has(boundary),
           );
         const capsuleUsesPosixProcessGroup =
           Boolean(stdioCapsuleSandboxExecutionContract) &&
@@ -2895,7 +3003,7 @@ export class MCPClient extends EventEmitter {
    * @param {string} serverName - Server name
    * @param {string} toolName - Tool name
    * @param {object} args - Tool arguments
-   * @param {{signal?: AbortSignal}} options - Host-owned cancellation
+   * @param {{signal?: AbortSignal, dispatchAdmission?: Function}} options - Host-owned cancellation and dispatch authority
    */
   async callTool(serverName, toolName, args = {}, options = {}) {
     if (options?.signal?.aborted) {
@@ -3381,8 +3489,19 @@ export class MCPClient extends EventEmitter {
       }
 
       try {
-        dispatched = true;
-        entry.process.stdin.write(message + "\n");
+        dispatchMcpToolRequest(
+          options,
+          {
+            serverName,
+            method,
+            transport: entry.transportKind || "stdio",
+            requestId: id,
+          },
+          () => {
+            dispatched = true;
+            return entry.process.stdin.write(message + "\n");
+          },
+        );
       } catch (err) {
         settle(reject, err);
       }
@@ -3499,13 +3618,26 @@ export class MCPClient extends EventEmitter {
         );
       };
       try {
-        dispatched = true;
-        entry.socket.send(message, (cause) => {
-          if (!cause) return;
-          failDispatch();
-        });
-      } catch {
-        failDispatch();
+        dispatchMcpToolRequest(
+          options,
+          {
+            serverName,
+            method,
+            transport: entry.transportKind || "ws",
+            requestId: id,
+          },
+          () => {
+            dispatched = true;
+            return entry.socket.send(message, (cause) => {
+              if (!cause) return;
+              failDispatch();
+            });
+          },
+        );
+      } catch (error) {
+        if (error?.outcomeUnknown === true) settle(reject, error);
+        else if (!dispatched) settle(reject, error);
+        else failDispatch();
       }
     });
   }
@@ -3843,13 +3975,24 @@ export class MCPClient extends EventEmitter {
 
     try {
       throwIfAborted();
-      const responsePromise = _deps.fetch(entry.httpUrl, {
-        method: "POST",
-        headers,
-        body,
-        ...(controller ? { signal: controller.signal } : {}),
-      });
-      if (request) request.dispatched = true;
+      const responsePromise = dispatchMcpToolRequest(
+        options,
+        {
+          serverName,
+          method,
+          transport: entry.transportKind || "http",
+          requestId: id,
+        },
+        () => {
+          if (request) request.dispatched = true;
+          return _deps.fetch(entry.httpUrl, {
+            method: "POST",
+            headers,
+            body,
+            ...(controller ? { signal: controller.signal } : {}),
+          });
+        },
+      );
       const response = await responsePromise;
       if (request) request.response = response;
       throwIfAborted();

package/src/harness/prompt-compressor.js

@@ -11,6 +11,7 @@
 
 import { createHash } from "node:crypto";
 import { feature, featureVariant } from "../lib/feature-flags.js";
+import { isAbortError } from "../lib/abort-utils.js";
 import {
   DURABLE_SYSTEM_MESSAGE_KINDS,
   getDurableSystemMessageProvenance,
@@ -566,6 +567,8 @@ export class PromptCompressor {
     let degradedReason = null;
     let rawSummary;
     let summaryUsage = null;
+    let summaryUsageUnknown = false;
+    let summaryUsageUnknownReason = null;
     let summaryProvider = null;
     let summaryModel = null;
     try {
@@ -592,6 +595,12 @@ export class PromptCompressor {
                   usage.cache_creation_tokens,
               ) || 0,
           };
+        } else if (queryResult.usageOutcome !== "not-billable") {
+          // Standard provider adapters return an explicit `usage` field. A
+          // successful response without it is still a paid call whose amount
+          // is unknown; never let a hard budget silently count it as zero.
+          summaryUsageUnknown = true;
+          summaryUsageUnknownReason = "provider_usage_not_reported";
         }
         summaryProvider = queryResult.provider || null;
         summaryModel = queryResult.model || null;
@@ -599,9 +608,18 @@ export class PromptCompressor {
         rawSummary = queryResult;
       }
     } catch (error) {
+      // Cancellation is authoritative. Treating AbortError as an ordinary
+      // provider failure would manufacture an extractive summary after Stop and
+      // let callers apply/persist it even though the operation was cancelled.
+      if (isAbortError(error)) throw error;
       degraded = true;
       summaryMode = "extractive-fallback";
       degradedReason = `llm_query_failed:${boundedFailureMessage(error)}`;
+      // A transport exception does not prove that the provider rejected the
+      // request before billing it. Keep that uncertainty explicit so a hard
+      // budget can latch instead of silently accounting the call as $0.
+      summaryUsageUnknown = true;
+      summaryUsageUnknownReason = "provider_transport_outcome_unknown";
     }
     if (!degraded) {
       try {
@@ -644,6 +662,12 @@ export class PromptCompressor {
         summaryInputChars: prompt.length,
         summaryInputLimit: this.summaryInputMaxChars,
         ...(summaryUsage ? { summaryUsage } : {}),
+        ...(summaryUsageUnknown
+          ? {
+              summaryUsageUnknown: true,
+              summaryUsageUnknownReason,
+            }
+          : {}),
         ...(summaryProvider ? { summaryProvider } : {}),
         ...(summaryModel ? { summaryModel } : {}),
       },

package/src/harness/provider-backed-compaction.js

@@ -0,0 +1,205 @@
+import {
+  estimateMessagesTokens,
+  PromptCompressor,
+  sanitizeToolPairs,
+} from "./prompt-compressor.js";
+
+const DEFAULT_MAX_OUTPUT_TOKENS = 2048;
+const MIN_MAX_OUTPUT_TOKENS = 256;
+const MAX_MAX_OUTPUT_TOKENS = 4096;
+const MANUAL_MAX_MESSAGES = 4;
+
+function boundedMaxOutputTokens(value) {
+  const parsed = Math.trunc(Number(value));
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return DEFAULT_MAX_OUTPUT_TOKENS;
+  }
+  return Math.min(
+    MAX_MAX_OUTPUT_TOKENS,
+    Math.max(MIN_MAX_OUTPUT_TOKENS, parsed),
+  );
+}
+
+function tokenCount(value) {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? Math.trunc(parsed) : 0;
+}
+
+function responseSummary(response) {
+  if (typeof response === "string") return response;
+  return response?.message?.content ?? response?.content ?? "";
+}
+
+function preserveCompletedExchange(originalMessages, compactedMessages) {
+  if (originalMessages.at(-1)?.role === "user") return compactedMessages;
+  let lastUserIndex = -1;
+  for (let index = originalMessages.length - 1; index >= 0; index -= 1) {
+    if (originalMessages[index]?.role === "user") {
+      lastUserIndex = index;
+      break;
+    }
+  }
+  if (lastUserIndex < 0) return compactedMessages;
+
+  const completedExchange = originalMessages.slice(lastUserIndex);
+  const exchangeMessages = new Set(completedExchange);
+  const prefix = compactedMessages.filter(
+    (message) => !exchangeMessages.has(message),
+  );
+  return sanitizeToolPairs([...prefix, ...completedExchange]);
+}
+
+/**
+ * Convert PromptCompressor's provider-neutral summary accounting into the
+ * token-usage wire shape shared by the agent hosts.
+ */
+export function compactionTokenUsage(stats) {
+  const usage = stats?.summaryUsage;
+  if (!usage || typeof usage !== "object") return null;
+  return {
+    input_tokens: tokenCount(usage.inputTokens),
+    output_tokens: tokenCount(usage.outputTokens),
+    cache_read_input_tokens: tokenCount(usage.cacheReadTokens),
+    cache_creation_input_tokens: tokenCount(usage.cacheCreationTokens),
+  };
+}
+
+/**
+ * Build one provider-backed semantic compaction operation.
+ *
+ * The provider request is deliberately tool-free. A missing provider adapter,
+ * transport error, or malformed summary is handled by PromptCompressor's
+ * structured extractive handoff, so every host gets the same safe degradation
+ * contract instead of falling back to positional truncation.
+ */
+export async function compactConversationWithProvider(messages, options = {}) {
+  const originalMessages = Array.isArray(messages) ? [...messages] : [];
+  const provider = options.provider || null;
+  const model = options.model || null;
+  const maxOutputTokens = boundedMaxOutputTokens(options.maxOutputTokens);
+  const chatFn = options.chatFn;
+  const llmQuery =
+    typeof options.llmQuery === "function"
+      ? options.llmQuery
+      : async (prompt) => {
+          if (typeof chatFn !== "function") {
+            throw new Error("provider adapter unavailable");
+          }
+          const response = await chatFn([{ role: "user", content: prompt }], {
+            ...(options.chatOptions || {}),
+            provider,
+            model,
+            baseUrl: options.baseUrl,
+            apiKey: options.apiKey,
+            signal: options.signal,
+            contextEngine: null,
+            enabledToolNames: [],
+            extraToolDefinitions: [],
+            hostManagedToolPolicy: null,
+            onToken: undefined,
+            onStall: undefined,
+            onStreamRetry: undefined,
+            maxOutputTokens,
+          });
+          return {
+            summary: responseSummary(response),
+            usage: response?.usage || null,
+            provider,
+            model,
+          };
+        };
+
+  const compressor =
+    options.compressor ||
+    new PromptCompressor({
+      model,
+      provider,
+      llmQuery,
+      ...(options.force === true
+        ? { maxMessages: options.maxMessages || MANUAL_MAX_MESSAGES }
+        : options.maxMessages
+          ? { maxMessages: options.maxMessages }
+          : {}),
+      ...(options.maxTokens ? { maxTokens: options.maxTokens } : {}),
+      summaryInputMaxChars: options.summaryInputMaxChars,
+    });
+  if (
+    options.onlyIfNeeded === true &&
+    !compressor.shouldAutoCompact(originalMessages)
+  ) {
+    const originalTokens = estimateMessagesTokens(originalMessages);
+    return {
+      messages: originalMessages,
+      stats: {
+        strategy: "none",
+        originalMessages: originalMessages.length,
+        compressedMessages: originalMessages.length,
+        originalTokens,
+        compressedTokens: originalTokens,
+        saved: 0,
+        ratio: 1,
+        trimmed: 0,
+      },
+      degradedEvent: null,
+      usageEvent: null,
+      usageUnknownEvent: null,
+    };
+  }
+  const result = await compressor.compress(originalMessages, {
+    preserveToolPairs: true,
+    ...(typeof options.isPinned === "function"
+      ? { isPinned: options.isPinned }
+      : {}),
+  });
+  const compactedMessages =
+    options.preserveCompletedExchange === true
+      ? preserveCompletedExchange(originalMessages, result.messages)
+      : result.messages;
+  const originalTokens = estimateMessagesTokens(originalMessages);
+  const compressedTokens = estimateMessagesTokens(compactedMessages);
+  const stats = {
+    ...result.stats,
+    originalMessages: originalMessages.length,
+    compressedMessages: compactedMessages.length,
+    originalTokens,
+    compressedTokens,
+    saved: originalTokens - compressedTokens,
+    ratio: originalTokens > 0 ? compressedTokens / originalTokens : 1,
+    trimmed: Math.max(0, originalMessages.length - compactedMessages.length),
+  };
+  const usage = compactionTokenUsage(stats);
+  const usageUnknownEvent =
+    stats.summaryUsageUnknown === true
+      ? {
+          provider: stats.summaryProvider || provider,
+          model: stats.summaryModel || model,
+          source: "semantic-compaction",
+          reason:
+            stats.summaryUsageUnknownReason ||
+            "provider_transport_outcome_unknown",
+          usageOutcome: "unknown",
+        }
+      : null;
+
+  return {
+    messages: compactedMessages,
+    stats,
+    degradedEvent:
+      stats.degraded === true
+        ? {
+            reason: stats.degradedReason || "semantic-summary-degraded",
+            summaryMode: stats.summaryMode || "extractive-fallback",
+            stats,
+          }
+        : null,
+    usageEvent: usage
+      ? {
+          provider: stats.summaryProvider || provider,
+          model: stats.summaryModel || model,
+          usage,
+          source: "semantic-compaction",
+        }
+      : null,
+    usageUnknownEvent,
+  };
+}