chainlesschain 0.163.6 → 0.163.7

package/src/lib/chat-session-admission.js

@@ -0,0 +1,76 @@
+import {
+  readVerifiedProjection,
+  resolveSessionAuthority,
+} from "../harness/jsonl-session-store.js";
+
+export const CHAT_CALL_LEDGER_UNSUPPORTED = "CC_CHAT_CALL_LEDGER_UNSUPPORTED";
+export const CHAT_SESSION_NOT_FOUND = "CC_CHAT_SESSION_NOT_FOUND";
+export const CHAT_SESSION_UNAVAILABLE = "CC_CHAT_SESSION_UNAVAILABLE";
+
+function admissionError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function sessionDeclaresProtectedUsage(sessionId, projectionReader) {
+  return projectionReader(sessionId, () => {
+    let protectedUsage = false;
+    let sessionStartSeen = false;
+    return {
+      accept(event) {
+        if (event?.type !== "session_start" || sessionStartSeen) return;
+        sessionStartSeen = true;
+        const data =
+          event.data &&
+          typeof event.data === "object" &&
+          !Array.isArray(event.data)
+            ? event.data
+            : {};
+        protectedUsage = [
+          "observabilityScope",
+          "usageTelemetryProtocol",
+          "usageTelemetryVersion",
+        ].some((field) => Object.hasOwn(data, field));
+      },
+      finish() {
+        return protectedUsage;
+      },
+    };
+  });
+}
+
+/**
+ * Admit only an explicitly present, readable and fully verified legacy session.
+ * Interactive chat cannot yet durably bracket its provider calls, so any scope
+ * or call-ledger declaration must fail before the REPL appends or spends.
+ */
+export function assertChatSessionUsageAdmission(
+  sessionReference,
+  {
+    resolveAuthority = resolveSessionAuthority,
+    readProjection = readVerifiedProjection,
+  } = {},
+) {
+  if (!sessionReference) return;
+  const authority = resolveAuthority(sessionReference);
+  if (!authority) {
+    throw admissionError(
+      CHAT_SESSION_NOT_FOUND,
+      "Interactive chat session was not found",
+    );
+  }
+  if (!authority.readable) {
+    throw admissionError(
+      CHAT_SESSION_UNAVAILABLE,
+      "Interactive chat session is not readable and cannot be resumed safely",
+    );
+  }
+  if (!sessionDeclaresProtectedUsage(authority.id, readProjection)) {
+    return authority.id;
+  }
+  throw admissionError(
+    CHAT_CALL_LEDGER_UNSUPPORTED,
+    "Scoped call-ledger sessions are not supported by interactive chat; use agent mode or an IDE host with usage-ledger support",
+  );
+}

package/src/lib/cost-budget.js

@@ -19,11 +19,6 @@
 
 import { estimateCost } from "./llm-pricing.js";
 
-const round = (n, dp = 6) => {
-  const f = Math.pow(10, dp);
-  return Math.round((Number(n) + Number.EPSILON) * f) / f;
-};
-
 /** Parse a `--max-budget-usd` value into a positive number, or null when unset. */
 export function parseBudgetUsd(value) {
   if (value == null || value === "") return null;
@@ -94,7 +89,10 @@ export class CostBudget {
       // otherwise treat the record as unpriced.
       const cost = Number(est.totalCost);
       if (Number.isFinite(cost) && cost >= 0) {
-        this.spentUsd = round(this.spentUsd + cost);
+        // Preserve sub-microdollar charges. Formatting belongs at the UI edge;
+        // rounding here can turn a positive paid call into zero and disable a
+        // sufficiently small hard budget.
+        this.spentUsd += cost;
         this.priced = true;
       } else {
         this.sawUnpriced = true;
@@ -114,7 +112,7 @@ export class CostBudget {
   remaining() {
     return this.limitUsd == null
       ? Infinity
-      : Math.max(0, round(this.limitUsd - this.spentUsd));
+      : Math.max(0, this.limitUsd - this.spentUsd);
   }
 
   /**

package/src/lib/cowork/ab-comparator-cli.js

@@ -10,6 +10,10 @@ import { runPeerGroup } from "./agent-group-runner.js";
 
 const DEFAULT_CRITERIA = ["quality", "performance", "readability"];
 
+function throwRuntimeLedgerFailure(error) {
+  if (error?.runtimeLedgerPersistence === true) throw error;
+}
+
 const VARIANT_PROFILES = [
   {
     name: "conservative",
@@ -84,6 +88,12 @@ export async function compare({
     },
   });
 
+  // Ordinary variant failures remain comparable, but a host ledger failure
+  // must escape before judging can spend again or a partial result is emitted.
+  for (const outcome of runResult.results) {
+    throwRuntimeLedgerFailure(outcome.error);
+  }
+
   const generatedVariants = runResult.results.map((r) => {
     if (r.ok) return r.value;
     const profile = r.peer.payload.profile;
@@ -135,6 +145,7 @@ REASON: (1-2 sentence justification)`;
     winner = parseWinner(judgement) || generatedVariants[0]?.name || "unknown";
     reason = parseReason(judgement) || "See detailed scores above.";
   } catch (err) {
+    throwRuntimeLedgerFailure(err);
     reason = `Scoring error: ${err.message}`;
   }
 

package/src/lib/cowork/debate-review-cli.js

@@ -10,6 +10,10 @@ import { runPeerGroup } from "./agent-group-runner.js";
 
 const DEFAULT_PERSPECTIVES = ["performance", "security", "maintainability"];
 
+function throwRuntimeLedgerFailure(error) {
+  if (error?.runtimeLedgerPersistence === true) throw error;
+}
+
 const PERSPECTIVE_PROMPTS = {
   performance: {
     role: "Performance Reviewer",
@@ -96,6 +100,13 @@ export async function startDebate({
     },
   });
 
+  // Peer groups intentionally turn ordinary reviewer failures into result
+  // rows. A durable usage-ledger failure is host-terminal, not review content:
+  // let the REPL latch stop this and every later paid call.
+  for (const outcome of runResult.results) {
+    throwRuntimeLedgerFailure(outcome.error);
+  }
+
   const reviews = runResult.results.map((r) => {
     if (r.ok) return r.value;
     return {
@@ -142,6 +153,7 @@ export async function startDebate({
     finalVerdict = extractVerdict(summary);
     consensusScore = extractConsensusScore(summary);
   } catch (err) {
+    throwRuntimeLedgerFailure(err);
     summary = `Moderator error: ${err.message}`;
   }
 

package/src/lib/cowork-adapter.js

@@ -11,6 +11,86 @@ import { LLMProviderRegistry, BUILT_IN_PROVIDERS } from "./llm-providers.js";
 import { loadConfig } from "./config-manager.js";
 import { applyConfigLlmDefaults } from "./llm-config-defaults.js";
 
+function plainUsage(value) {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : null;
+}
+
+function normalizeOllamaUsage(data) {
+  if (
+    !Object.hasOwn(data, "prompt_eval_count") ||
+    !Object.hasOwn(data, "eval_count")
+  ) {
+    return null;
+  }
+  return {
+    input_tokens: data.prompt_eval_count,
+    output_tokens: data.eval_count,
+    cache_read_input_tokens: 0,
+    cache_creation_input_tokens: 0,
+  };
+}
+
+function normalizeAnthropicUsage(value) {
+  const usage = plainUsage(value);
+  if (!usage) return null;
+  // Keep malformed provider fields malformed so the canonical ledger projects
+  // the call as unknown instead of manufacturing a known zero settlement.
+  return {
+    input_tokens: usage.input_tokens,
+    output_tokens: usage.output_tokens,
+    cache_read_input_tokens: Object.hasOwn(usage, "cache_read_input_tokens")
+      ? usage.cache_read_input_tokens
+      : 0,
+    cache_creation_input_tokens: Object.hasOwn(
+      usage,
+      "cache_creation_input_tokens",
+    )
+      ? usage.cache_creation_input_tokens
+      : 0,
+  };
+}
+
+function normalizeOpenAiUsage(value) {
+  const usage = plainUsage(value);
+  if (!usage) return null;
+  // OpenAI/volcengine report cached prompt tokens under the nested detail;
+  // DeepSeek reports the same quantity as prompt_cache_hit_tokens. In both
+  // cases prompt_tokens includes the cached prefix, so persist only the
+  // uncached remainder as input_tokens.
+  const detailed = Number(usage.prompt_tokens_details?.cached_tokens);
+  const deepseek = Number(usage.prompt_cache_hit_tokens);
+  const cached =
+    Number.isFinite(detailed) && detailed > 0
+      ? detailed
+      : Number.isFinite(deepseek) && deepseek > 0
+        ? deepseek
+        : 0;
+  const input =
+    typeof usage.prompt_tokens === "number" && typeof cached === "number"
+      ? usage.prompt_tokens - cached
+      : usage.prompt_tokens;
+  return {
+    input_tokens: input,
+    output_tokens: usage.completion_tokens,
+    cache_read_input_tokens: cached,
+    cache_creation_input_tokens: 0,
+  };
+}
+
+function chatEnvelope(content, usage = null) {
+  return {
+    content: typeof content === "string" ? content : "",
+    ...(usage ? { usage } : {}),
+  };
+}
+
+async function invokeChatCall(callWrapper, provider, model, call) {
+  if (!callWrapper) return call();
+  return callWrapper({ call, provider, model });
+}
+
 /**
  * Create a chat completion function that routes through the active LLM provider.
  *
@@ -26,6 +106,10 @@ import { applyConfigLlmDefaults } from "./llm-config-defaults.js";
  * @param {string} [options.model] - Model name override
  * @param {string} [options.baseUrl] - Base URL override
  * @param {string} [options.apiKey] - API key override
+ * @param {(request: {call: function, provider: string, model: string}) => Promise<object>} [options.callWrapper]
+ *        Optional host boundary around each real provider call. The callback
+ *        resolves to a private `{content, usage?}` envelope; callers still
+ *        receive only the response string.
  * @returns {(messages: object[], opts?: object) => Promise<string>}
  */
 export function createChatFn(options = {}) {
@@ -47,25 +131,40 @@ export function createChatFn(options = {}) {
   const model =
     resolved.model || process.env.LLM_MODEL || providerDef.models[0];
   const baseUrl = resolved.baseUrl || providerDef.baseUrl;
+  const callWrapper = resolved.callWrapper || null;
+  if (callWrapper !== null && typeof callWrapper !== "function") {
+    throw new TypeError("cowork callWrapper must be a function");
+  }
 
   return async function chat(messages, opts = {}) {
     const currentModel = opts.model || model;
     const maxTokens = opts.maxTokens || 2048;
 
     if (provider === "ollama") {
-      const res = await fetch(`${baseUrl}/api/chat`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          model: currentModel,
-          messages,
-          stream: false,
-          options: { num_predict: maxTokens },
-        }),
-      });
-      if (!res.ok) throw new Error(`Ollama error: ${res.status}`);
-      const data = await res.json();
-      return data.message?.content || "";
+      const envelope = await invokeChatCall(
+        callWrapper,
+        provider,
+        currentModel,
+        async () => {
+          const res = await fetch(`${baseUrl}/api/chat`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+              model: currentModel,
+              messages,
+              stream: false,
+              options: { num_predict: maxTokens },
+            }),
+          });
+          if (!res.ok) throw new Error(`Ollama error: ${res.status}`);
+          const data = await res.json();
+          return chatEnvelope(
+            data.message?.content,
+            normalizeOllamaUsage(data),
+          );
+        },
+      );
+      return typeof envelope === "string" ? envelope : envelope?.content || "";
     }
 
     if (provider === "anthropic") {
@@ -82,39 +181,61 @@ export function createChatFn(options = {}) {
       if (systemMsgs.length > 0) {
         body.system = systemMsgs.map((m) => m.content).join("\n");
       }
-      const res = await fetch(`${baseUrl}/messages`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "x-api-key": key,
-          "anthropic-version": "2023-06-01",
+      const envelope = await invokeChatCall(
+        callWrapper,
+        provider,
+        currentModel,
+        async () => {
+          const res = await fetch(`${baseUrl}/messages`, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              "x-api-key": key,
+              "anthropic-version": "2023-06-01",
+            },
+            body: JSON.stringify(body),
+          });
+          if (!res.ok) throw new Error(`Anthropic error: ${res.status}`);
+          const data = await res.json();
+          return chatEnvelope(
+            data.content?.[0]?.text,
+            normalizeAnthropicUsage(data.usage),
+          );
         },
-        body: JSON.stringify(body),
-      });
-      if (!res.ok) throw new Error(`Anthropic error: ${res.status}`);
-      const data = await res.json();
-      return data.content?.[0]?.text || "";
+      );
+      return typeof envelope === "string" ? envelope : envelope?.content || "";
     }
 
     // OpenAI-compatible (openai, deepseek, dashscope, mistral, gemini)
     const key = resolved.apiKey || process.env[providerDef.apiKeyEnv];
     if (!key) throw new Error(`${providerDef.apiKeyEnv} not set`);
 
-    const res = await fetch(`${baseUrl}/chat/completions`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${key}`,
+    const envelope = await invokeChatCall(
+      callWrapper,
+      provider,
+      currentModel,
+      async () => {
+        const res = await fetch(`${baseUrl}/chat/completions`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${key}`,
+          },
+          body: JSON.stringify({
+            model: currentModel,
+            messages,
+            max_tokens: maxTokens,
+          }),
+        });
+        if (!res.ok) throw new Error(`API error: ${res.status}`);
+        const data = await res.json();
+        return chatEnvelope(
+          data.choices?.[0]?.message?.content,
+          normalizeOpenAiUsage(data.usage),
+        );
       },
-      body: JSON.stringify({
-        model: currentModel,
-        messages,
-        max_tokens: maxTokens,
-      }),
-    });
-    if (!res.ok) throw new Error(`API error: ${res.status}`);
-    const data = await res.json();
-    return data.choices?.[0]?.message?.content || "";
+    );
+    return typeof envelope === "string" ? envelope : envelope?.content || "";
   };
 }