chainlesschain 0.163.6 → 0.163.7

package/src/lib/delivery-coordinator.js

@@ -66,7 +66,10 @@ const ACTION_TO_METHOD = Object.freeze({
 
 const EXACT_COMMIT_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;
 const SHA256_RE = /^sha256:[0-9a-f]{64}$/i;
+const TRANSCRIPT_HEAD_RE = /^[0-9a-f]{64}$/i;
 const DEFAULT_BLOCKING_SEVERITIES = Object.freeze(["Critical", "High"]);
+const MAX_CAUSAL_ID_LENGTH = 256;
+const MAX_CAUSAL_SESSIONS = 128;
 
 function hash(value) {
   return `sha256:${crypto
@@ -104,6 +107,126 @@ function boundedInteger(value, fallback, min, max) {
     : fallback;
 }
 
+function hasAsciiControlCharacter(value) {
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code <= 0x1f || code === 0x7f) return true;
+  }
+  return false;
+}
+
+function compareCodeUnits(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+function normalizeCausalId(value, field, { required = false } = {}) {
+  if (value == null) {
+    if (required) throw new Error(`${field} is required`);
+    return null;
+  }
+  if (typeof value !== "string") throw new Error(`${field} must be a string`);
+  const normalized = value.trim();
+  if (!normalized) {
+    if (required) throw new Error(`${field} is required`);
+    throw new Error(`${field} must not be blank`);
+  }
+  if (
+    normalized.length > MAX_CAUSAL_ID_LENGTH ||
+    hasAsciiControlCharacter(normalized)
+  ) {
+    throw new Error(`${field} is invalid`);
+  }
+  return normalized;
+}
+
+function normalizeCausality(value) {
+  if (value != null && (typeof value !== "object" || Array.isArray(value))) {
+    throw new Error("causality must be an object");
+  }
+  const source = value || {};
+  if (Object.hasOwn(source, "sessionIds")) {
+    throw new Error(
+      "causality.sessionIds is unsupported; bind sessions with headHash and eventCount",
+    );
+  }
+  if (
+    source.scope != null &&
+    (typeof source.scope !== "object" || Array.isArray(source.scope))
+  ) {
+    throw new Error("causality.scope must be an object");
+  }
+  if (source.sessions != null && !Array.isArray(source.sessions)) {
+    throw new Error("causality.sessions must be an array");
+  }
+  const scope = source.scope || {};
+  if ((source.sessions || []).length > MAX_CAUSAL_SESSIONS) {
+    throw new Error(
+      `causality.sessions exceeds the ${MAX_CAUSAL_SESSIONS} session limit`,
+    );
+  }
+  const sessions = (source.sessions || [])
+    .map((binding) => {
+      if (!binding || typeof binding !== "object" || Array.isArray(binding)) {
+        throw new Error("causality.sessions entries must be objects");
+      }
+      const sessionId = normalizeCausalId(
+        binding.sessionId,
+        "causality.sessions.sessionId",
+        { required: true },
+      );
+      if (
+        sessionId.includes("/") ||
+        sessionId.includes("\\") ||
+        sessionId.includes("..")
+      ) {
+        throw new Error("causality.sessions.sessionId is unsafe");
+      }
+      const headHash = String(binding.headHash || "").toLowerCase();
+      if (!TRANSCRIPT_HEAD_RE.test(headHash)) {
+        throw new Error("causality.sessions.headHash is invalid");
+      }
+      const eventCount = Number(binding.eventCount);
+      if (!Number.isSafeInteger(eventCount) || eventCount <= 0) {
+        throw new Error(
+          "causality.sessions.eventCount must be a positive safe integer",
+        );
+      }
+      return { sessionId, headHash, eventCount };
+    })
+    .sort((a, b) => compareCodeUnits(a.sessionId, b.sessionId));
+  if (
+    new Set(sessions.map((binding) => binding.sessionId)).size !==
+    sessions.length
+  ) {
+    throw new Error("causality.sessions contains duplicate sessionId values");
+  }
+  const normalizedScope = {
+    workspaceId: normalizeCausalId(
+      scope.workspaceId,
+      "causality.scope.workspaceId",
+    ),
+    teamId: normalizeCausalId(scope.teamId, "causality.scope.teamId"),
+    policyId: normalizeCausalId(scope.policyId, "causality.scope.policyId"),
+  };
+  if (
+    sessions.length > 0 &&
+    !Object.values(normalizedScope).some((scopeId) => scopeId != null)
+  ) {
+    throw new Error(
+      "causality.scope requires at least one dimension when sessions are bound",
+    );
+  }
+  return { scope: normalizedScope, sessions };
+}
+
+function hasCausality(causality) {
+  return Boolean(
+    causality &&
+    (causality.sessions.length > 0 ||
+      Object.values(causality.scope).some((value) => value != null)),
+  );
+}
+
 function stateMaterial(state) {
   const material = jsonClone(state);
   delete material.stateDigest;
@@ -533,6 +656,19 @@ export function verifyDeliveryFlowState(snapshot) {
     unmet.push("schema-unsupported");
   if (snapshot.version !== DELIVERY_FLOW_VERSION)
     unmet.push("version-unsupported");
+  if (Object.hasOwn(snapshot, "causality")) {
+    try {
+      const normalized = normalizeCausality(snapshot.causality);
+      if (
+        canonicalDeliveryJson(normalized) !==
+        canonicalDeliveryJson(snapshot.causality)
+      ) {
+        unmet.push("causality-noncanonical");
+      }
+    } catch {
+      unmet.push("causality-invalid");
+    }
+  }
   const actualDigest = String(snapshot.stateDigest || "");
   const expectedDigest = hash(stateMaterial(snapshot));
   if (!actualDigest || actualDigest !== expectedDigest) {
@@ -580,6 +716,10 @@ export function restoreDeliveryFlow(snapshot) {
 export function createDeliveryFlow(config = {}, { now } = {}) {
   const createdAt = isoNow(now);
   const requiredGates = normalizeGateDefinitions(config.requiredGates);
+  const normalizedCausality = normalizeCausality(config.causality);
+  const causality = hasCausality(normalizedCausality)
+    ? normalizedCausality
+    : null;
   const gateSelection = selectImpactedGates({
     changedFiles: config.diff?.changedFiles || config.changedFiles,
     requiredGates: requiredGates.map((gate) => ({
@@ -646,6 +786,7 @@ export function createDeliveryFlow(config = {}, { now } = {}) {
     commitSha: config.commitSha,
     diff: config.diff,
     requiredGateIds: requiredGates.map((gate) => gate.id),
+    ...(causality ? { causality } : {}),
   };
   const state = {
     schema: DELIVERY_FLOW_SCHEMA,
@@ -661,6 +802,7 @@ export function createDeliveryFlow(config = {}, { now } = {}) {
     stopReason: preflightReason,
     preflightUnmet,
     commitSha,
+    ...(causality ? { causality } : {}),
     diff: jsonClone(config.diff || {}),
     environment: jsonClone(config.environment || {}),
     requiredGates,

package/src/lib/direct-model-usage.js

@@ -0,0 +1,121 @@
+import { randomUUID } from "node:crypto";
+import {
+  markRuntimeLedgerPersistenceError,
+  projectRuntimeTokenUsage,
+  projectRuntimeUsageBoundary,
+  runtimeUsageEventType,
+} from "./runtime-usage-ledger.js";
+
+function asRuntimeLedgerPersistenceError(error) {
+  if (error && (typeof error === "object" || typeof error === "function")) {
+    try {
+      const marked = markRuntimeLedgerPersistenceError(error);
+      if (marked?.runtimeLedgerPersistence === true) return marked;
+    } catch {
+      // Frozen/non-extensible errors are wrapped below.
+    }
+  }
+  const wrapped = new Error("runtime usage ledger persistence failed", {
+    cause: error,
+  });
+  return markRuntimeLedgerPersistenceError(wrapped);
+}
+
+async function persistUsageEvent(persist, type, event) {
+  try {
+    await persist(type, event);
+  } catch (error) {
+    throw asRuntimeLedgerPersistenceError(error);
+  }
+}
+
+function unknownUsageEvent({ callId, provider, model, source, code }) {
+  return projectRuntimeUsageBoundary(
+    { callId, provider, model, source, code },
+    "unknown",
+  );
+}
+
+/**
+ * Meter one direct provider call that runs outside agentLoop. The started row is
+ * durable before the callback resumes into provider work; every outcome then
+ * settles known or unknown without persisting prompts, responses, or errors.
+ */
+export async function runMeteredDirectModelCall({
+  sessionId,
+  persist,
+  provider,
+  model,
+  source = "model",
+  call,
+}) {
+  if (typeof call !== "function") {
+    throw new TypeError("metered direct model call requires a callback");
+  }
+  if (!sessionId) return call();
+  if (typeof persist !== "function") {
+    throw new TypeError("metered direct model call requires persistence");
+  }
+  const callId = `direct-${randomUUID()}`;
+  await persistUsageEvent(
+    persist,
+    runtimeUsageEventType("started"),
+    projectRuntimeUsageBoundary({ callId, provider, model, source }, "started"),
+  );
+  let result;
+  try {
+    result = await call();
+  } catch (error) {
+    await persistUsageEvent(
+      persist,
+      runtimeUsageEventType("unknown"),
+      unknownUsageEvent({
+        callId,
+        provider,
+        model,
+        source,
+        code: "provider_call_failed",
+      }),
+    );
+    throw error;
+  }
+  if (result?.usage && typeof result.usage === "object") {
+    let event;
+    try {
+      event = projectRuntimeTokenUsage({
+        callId,
+        provider,
+        model,
+        source,
+        usage: result.usage,
+      });
+    } catch {
+      await persistUsageEvent(
+        persist,
+        runtimeUsageEventType("unknown"),
+        unknownUsageEvent({
+          callId,
+          provider,
+          model,
+          source,
+          code: "provider_usage_missing",
+        }),
+      );
+      return result;
+    }
+    await persistUsageEvent(persist, "token_usage", event);
+  } else {
+    await persistUsageEvent(
+      persist,
+      runtimeUsageEventType("unknown"),
+      unknownUsageEvent({
+        callId,
+        provider,
+        model,
+        source,
+        code: "provider_usage_missing",
+      }),
+    );
+  }
+  return result;
+}

package/src/lib/file-lines.js

@@ -1,7 +1,64 @@
 import { closeSync, fstatSync, openSync, readSync } from "node:fs";
-import { StringDecoder } from "node:string_decoder";
 
 const DEFAULT_CHUNK_SIZE = 64 * 1024;
+export const DEFAULT_MAX_FILE_LINE_BYTES = 16 * 1024 * 1024;
+export const FILE_LINE_TOO_LARGE_CODE = "CC_FILE_LINE_TOO_LARGE";
+
+function normalizeMaxLineBytes(value) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+    throw new TypeError("maxLineBytes must be a positive safe integer");
+  }
+  return parsed;
+}
+
+function normalizeChunkSize(value) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+    throw new TypeError("chunkSize must be a positive safe integer");
+  }
+  return parsed;
+}
+
+export function assertFileLineByteLength(
+  byteLength,
+  {
+    maxLineBytes = DEFAULT_MAX_FILE_LINE_BYTES,
+    code = FILE_LINE_TOO_LARGE_CODE,
+    lineNo = null,
+    direction = null,
+    label = "File line",
+  } = {},
+) {
+  const actualBytes = Number(byteLength);
+  const maxBytes = normalizeMaxLineBytes(maxLineBytes);
+  if (!Number.isSafeInteger(actualBytes) || actualBytes < 0) {
+    throw new TypeError("byteLength must be a non-negative safe integer");
+  }
+  if (actualBytes <= maxBytes) return actualBytes;
+  const error = new Error(`${label} exceeded the ${maxBytes}-byte limit`);
+  error.code = code;
+  error.actualBytes = actualBytes;
+  error.maxBytes = maxBytes;
+  if (Number.isSafeInteger(lineNo) && lineNo > 0) error.lineNo = lineNo;
+  if (direction) error.direction = direction;
+  throw error;
+}
+
+function assertLineByteLength(byteLength, options, details) {
+  return assertFileLineByteLength(byteLength, {
+    maxLineBytes: options.maxLineBytes,
+    code: options.lineTooLargeCode,
+    label: options.lineLabel,
+    ...details,
+  });
+}
+
+function joinedLineBuffer(parts, byteLength) {
+  if (parts.length === 0) return Buffer.alloc(0);
+  if (parts.length === 1) return parts[0];
+  return Buffer.concat(parts, byteLength);
+}
 
 function recordRead(ioMetrics, bytes) {
   if (!ioMetrics || typeof ioMetrics !== "object") return;
@@ -13,7 +70,8 @@ function recordRead(ioMetrics, bytes) {
 /**
  * Stream UTF-8 lines from a file without loading the whole file. The final
  * unterminated fragment is yielded with `terminated:false`, which lets callers
- * distinguish a crash tail from a normal record.
+ * distinguish a crash tail from a normal record. Records are assembled as raw
+ * byte slices and checked before any Buffer.concat or UTF-8 decode.
  */
 export function* iterateFileLinesSync(
   filePath,
@@ -21,35 +79,81 @@ export function* iterateFileLinesSync(
     chunkSize = DEFAULT_CHUNK_SIZE,
     includeEmpty = false,
     ioMetrics = null,
+    maxLineBytes = DEFAULT_MAX_FILE_LINE_BYTES,
+    lineTooLargeCode = FILE_LINE_TOO_LARGE_CODE,
+    lineLabel = "File line",
   } = {},
 ) {
+  const lineOptions = {
+    maxLineBytes: normalizeMaxLineBytes(maxLineBytes),
+    lineTooLargeCode,
+    lineLabel,
+  };
+  const buffer = Buffer.allocUnsafe(
+    Math.min(normalizeChunkSize(chunkSize), lineOptions.maxLineBytes),
+  );
   const fd = openSync(filePath, "r");
-  const decoder = new StringDecoder("utf8");
-  const buffer = Buffer.allocUnsafe(Math.max(1024, chunkSize));
-  let pending = "";
+  let pendingParts = [];
+  let pendingBytes = 0;
   let lineNo = 0;
   try {
     for (;;) {
-      const bytes = readSync(fd, buffer, 0, buffer.length, null);
-      if (bytes === 0) break;
-      recordRead(ioMetrics, bytes);
-      pending += decoder.write(buffer.subarray(0, bytes));
-      let newline;
-      while ((newline = pending.indexOf("\n")) >= 0) {
-        let line = pending.slice(0, newline);
-        if (line.endsWith("\r")) line = line.slice(0, -1);
-        pending = pending.slice(newline + 1);
+      const bytesRead = readSync(fd, buffer, 0, buffer.length, null);
+      if (bytesRead === 0) break;
+      recordRead(ioMetrics, bytesRead);
+      let start = 0;
+      let newline = buffer.indexOf(0x0a, start);
+      while (newline >= 0 && newline < bytesRead) {
+        const segment = buffer.subarray(start, newline);
+        const lineByteLength = pendingBytes + segment.length;
         lineNo += 1;
-        if (includeEmpty || line.length > 0) {
-          yield { line, lineNo, terminated: true };
+        assertLineByteLength(lineByteLength, lineOptions, {
+          lineNo,
+          direction: "forward",
+        });
+        let lineBytes = joinedLineBuffer(
+          segment.length > 0 ? [...pendingParts, segment] : pendingParts,
+          lineByteLength,
+        );
+        if (lineBytes.length > 0 && lineBytes[lineBytes.length - 1] === 0x0d) {
+          lineBytes = lineBytes.subarray(0, lineBytes.length - 1);
+        }
+        if (includeEmpty || lineBytes.length > 0) {
+          yield {
+            line: lineBytes.toString("utf8"),
+            lineNo,
+            terminated: true,
+          };
         }
+        pendingParts = [];
+        pendingBytes = 0;
+        start = newline + 1;
+        newline = buffer.indexOf(0x0a, start);
       }
+
+      const trailing = buffer.subarray(start, bytesRead);
+      const nextPendingBytes = pendingBytes + trailing.length;
+      assertLineByteLength(nextPendingBytes, lineOptions, {
+        lineNo: lineNo + 1,
+        direction: "forward",
+      });
+      if (trailing.length > 0) pendingParts.push(Buffer.from(trailing));
+      pendingBytes = nextPendingBytes;
     }
-    pending += decoder.end();
-    if (pending.length > 0 || includeEmpty) {
+
+    if (pendingBytes > 0 || includeEmpty) {
       lineNo += 1;
-      if (includeEmpty || pending.length > 0) {
-        yield { line: pending, lineNo, terminated: false };
+      assertLineByteLength(pendingBytes, lineOptions, {
+        lineNo,
+        direction: "forward",
+      });
+      if (includeEmpty || pendingBytes > 0) {
+        const pending = joinedLineBuffer(pendingParts, pendingBytes);
+        yield {
+          line: pending.toString("utf8"),
+          lineNo,
+          terminated: false,
+        };
       }
     }
   } finally {
@@ -68,36 +172,57 @@ export function* iterateFileLinesReverseSync(
     chunkSize = DEFAULT_CHUNK_SIZE,
     includeEmpty = false,
     ioMetrics = null,
+    maxLineBytes = DEFAULT_MAX_FILE_LINE_BYTES,
+    lineTooLargeCode = FILE_LINE_TOO_LARGE_CODE,
+    lineLabel = "File line",
   } = {},
 ) {
+  const lineOptions = {
+    maxLineBytes: normalizeMaxLineBytes(maxLineBytes),
+    lineTooLargeCode,
+    lineLabel,
+  };
+  const readChunkSize = Math.min(
+    normalizeChunkSize(chunkSize),
+    lineOptions.maxLineBytes,
+  );
   const fd = openSync(filePath, "r");
-  const size = fstatSync(fd).size;
-  let endsWithNewline = false;
-  if (size > 0) {
-    const last = Buffer.allocUnsafe(1);
-    const bytes = readSync(fd, last, 0, 1, size - 1);
-    recordRead(ioMetrics, bytes);
-    endsWithNewline = last[0] === 0x0a;
-  }
-  let position = size;
-  let carry = Buffer.alloc(0);
+  let carryParts = [];
+  let carryBytes = 0;
   let isPhysicalTail = true;
   try {
+    const size = fstatSync(fd).size;
+    let endsWithNewline = false;
+    if (size > 0) {
+      const last = Buffer.allocUnsafe(1);
+      const bytesRead = readSync(fd, last, 0, 1, size - 1);
+      recordRead(ioMetrics, bytesRead);
+      endsWithNewline = last[0] === 0x0a;
+    }
+
+    let position = size;
     while (position > 0) {
-      const length = Math.min(Math.max(1024, chunkSize), position);
+      const length = Math.min(readChunkSize, position);
       position -= length;
       const chunk = Buffer.allocUnsafe(length);
-      const bytes = readSync(fd, chunk, 0, length, position);
-      recordRead(ioMetrics, bytes);
-      const combined = Buffer.concat([chunk, carry]);
-      let end = combined.length;
-      for (let index = combined.length - 1; index >= 0; index -= 1) {
-        if (combined[index] !== 0x0a) continue;
-        let bytes = combined.subarray(index + 1, end);
-        if (bytes.length > 0 && bytes[bytes.length - 1] === 0x0d) {
-          bytes = bytes.subarray(0, bytes.length - 1);
+      const bytesRead = readSync(fd, chunk, 0, length, position);
+      recordRead(ioMetrics, bytesRead);
+      let end = bytesRead;
+      for (let index = bytesRead - 1; index >= 0; index -= 1) {
+        if (chunk[index] !== 0x0a) continue;
+        const segment = chunk.subarray(index + 1, end);
+        const lineByteLength = segment.length + carryBytes;
+        assertLineByteLength(lineByteLength, lineOptions, {
+          direction: "reverse",
+        });
+        let lineBytes = joinedLineBuffer(
+          segment.length > 0 ? [segment, ...carryParts] : carryParts,
+          lineByteLength,
+        );
+        if (lineBytes.length > 0 && lineBytes[lineBytes.length - 1] === 0x0d) {
+          lineBytes = lineBytes.subarray(0, lineBytes.length - 1);
         }
-        const line = bytes.toString("utf8");
+        const line = lineBytes.toString("utf8");
         const terminated = isPhysicalTail ? endsWithNewline : true;
         // A file ending in "\n" produces one empty physical-tail slice. Skip
         // it without changing the termination status of the real last line.
@@ -105,16 +230,27 @@ export function* iterateFileLinesReverseSync(
           yield { line, terminated };
           isPhysicalTail = false;
         }
+        carryParts = [];
+        carryBytes = 0;
         end = index;
       }
-      carry = combined.subarray(0, end);
+
+      const prefix = chunk.subarray(0, end);
+      const nextCarryBytes = prefix.length + carryBytes;
+      assertLineByteLength(nextCarryBytes, lineOptions, {
+        direction: "reverse",
+      });
+      if (prefix.length > 0) carryParts.unshift(Buffer.from(prefix));
+      carryBytes = nextCarryBytes;
     }
-    if (carry.length > 0 || includeEmpty) {
-      let bytes = carry;
-      if (bytes.length > 0 && bytes[bytes.length - 1] === 0x0d) {
-        bytes = bytes.subarray(0, bytes.length - 1);
+
+    if (carryBytes > 0 || includeEmpty) {
+      assertLineByteLength(carryBytes, lineOptions, { direction: "reverse" });
+      let lineBytes = joinedLineBuffer(carryParts, carryBytes);
+      if (lineBytes.length > 0 && lineBytes[lineBytes.length - 1] === 0x0d) {
+        lineBytes = lineBytes.subarray(0, lineBytes.length - 1);
       }
-      const line = bytes.toString("utf8");
+      const line = lineBytes.toString("utf8");
       if (includeEmpty || line.length > 0) {
         yield { line, terminated: !isPhysicalTail };
       }

package/src/lib/llm-pricing.js

@@ -84,11 +84,6 @@ export const PRICE_TABLE = Object.freeze({
   ],
 });
 
-const round = (n, dp = 6) => {
-  const f = Math.pow(10, dp);
-  return Math.round((Number(n) + Number.EPSILON) * f) / f;
-};
-
 /**
  * Merge user-supplied price overrides (typically `config.llm.pricing`) onto the
  * built-in table. Override shape mirrors PRICE_TABLE:
@@ -221,22 +216,22 @@ export function estimateCost({
       rate: null,
     };
   }
-  const inputCost = round((Number(inputTokens) / 1e6) * rate.in);
-  const outputCost = round((Number(outputTokens) / 1e6) * rate.out);
-  const cacheReadCost = round(
-    (Number(cacheReadTokens) / 1e6) * rate.in * cacheReadMultiplier(provider),
-  );
-  const cacheCreationCost = round(
-    (Number(cacheCreationTokens) / 1e6) * rate.in * CACHE_WRITE_MULTIPLIER,
-  );
+  // Keep full IEEE-754 precision throughout authority and budget arithmetic.
+  // Rounding each component to six decimals lets a real sub-microdollar call
+  // become zero and can make a hard `maxUsd` gate pass incorrectly. Display
+  // surfaces may format these values, but safety decisions consume the raw sum.
+  const inputCost = (Number(inputTokens) / 1e6) * rate.in;
+  const outputCost = (Number(outputTokens) / 1e6) * rate.out;
+  const cacheReadCost =
+    (Number(cacheReadTokens) / 1e6) * rate.in * cacheReadMultiplier(provider);
+  const cacheCreationCost =
+    (Number(cacheCreationTokens) / 1e6) * rate.in * CACHE_WRITE_MULTIPLIER;
   return {
     inputCost,
     outputCost,
     cacheReadCost,
     cacheCreationCost,
-    totalCost: round(
-      inputCost + outputCost + cacheReadCost + cacheCreationCost,
-    ),
+    totalCost: inputCost + outputCost + cacheReadCost + cacheCreationCost,
     currency: "USD",
     matched: true,
     free: rate.pattern === "free",
@@ -280,7 +275,7 @@ export function priceRollup(aggregate, { table } = {}) {
   const unpriced = [];
   for (const row of byModel) {
     if (row.matched) {
-      totalCost = round(totalCost + row.cost);
+      totalCost += row.cost;
     } else if (row.totalTokens > 0) {
       unpriced.push({
         provider: row.provider,