chainlesschain 0.163.6 → 0.163.8

package/src/lib/cowork-task-runner.js

@@ -36,6 +36,7 @@ import {
   isUnsafeSessionId,
   readVerifiedEvents as readVerifiedSessionEvents,
   readVerifiedProjection as readVerifiedSessionProjection,
+  sessionHasPersistedEvidence,
 } from "../harness/jsonl-session-store.js";
 
 // ─── Dependencies (overridable for testing) ──────────────────────────────────
@@ -49,6 +50,7 @@ export const _deps = {
   appendSessionEventIfHead,
   readVerifiedSessionEvents,
   readVerifiedSessionProjection,
+  sessionHasPersistedEvidence,
   randomUUID,
 };
 
@@ -56,6 +58,91 @@ export const _deps = {
 
 const DEFAULT_MAX_ITERATIONS = 50;
 const DEFAULT_TOKEN_BUDGET = 100_000;
+const COWORK_MCP_CALL_LEDGER_UNSUPPORTED =
+  "CC_COWORK_MCP_CALL_LEDGER_UNSUPPORTED";
+const COWORK_MCP_SESSION_UNVERIFIED = "CC_COWORK_MCP_SESSION_UNVERIFIED";
+const PROTECTED_USAGE_FIELDS = Object.freeze([
+  "observabilityScope",
+  "usageTelemetryProtocol",
+  "usageTelemetryVersion",
+]);
+
+function coworkMcpAdmissionError(code, message, sessionId, cause = null) {
+  const error = new Error(message, cause ? { cause } : undefined);
+  error.code = code;
+  error.sessionId = sessionId;
+  return error;
+}
+
+function assertCoworkMcpEventUsageAdmission(event, sessionId) {
+  if (event?.type !== "session_start") return;
+  const data =
+    event.data && typeof event.data === "object" && !Array.isArray(event.data)
+      ? event.data
+      : {};
+  if (!PROTECTED_USAGE_FIELDS.some((field) => Object.hasOwn(data, field))) {
+    return;
+  }
+  throw coworkMcpAdmissionError(
+    COWORK_MCP_CALL_LEDGER_UNSUPPORTED,
+    "Scoped call-ledger sessions are not supported by Cowork MCP tasks; use agent mode or an IDE host with usage-ledger support",
+    sessionId,
+  );
+}
+
+function readCoworkMcpUsageAdmission(sessionId) {
+  return _deps.readVerifiedSessionProjection(sessionId, () => ({
+    accept(event) {
+      assertCoworkMcpEventUsageAdmission(event, sessionId);
+    },
+    finish() {
+      return true;
+    },
+  }));
+}
+
+/**
+ * An explicitly supplied MCP session can name an existing canonical JSONL
+ * authority. Verify it before mounting servers or starting a child model, and
+ * refuse protected usage transcripts until Cowork persists the call ledger.
+ */
+export function assertCoworkMcpSessionUsageAdmission(sessionId) {
+  if (sessionId == null) return;
+  if (typeof sessionId !== "string" || isUnsafeSessionId(sessionId)) {
+    throw coworkMcpAdmissionError(
+      "CC_COWORK_MCP_SESSION_INVALID",
+      "Cowork MCP session id is invalid",
+      sessionId,
+    );
+  }
+
+  let hasEvidence;
+  try {
+    hasEvidence = _deps.sessionHasPersistedEvidence(sessionId);
+  } catch (cause) {
+    throw coworkMcpAdmissionError(
+      COWORK_MCP_SESSION_UNVERIFIED,
+      "Cowork MCP session authority could not be inspected; refusing to start a model or tool",
+      sessionId,
+      cause,
+    );
+  }
+  if (!hasEvidence) return;
+
+  try {
+    if (readCoworkMcpUsageAdmission(sessionId) !== true) {
+      throw new Error("verified usage-admission projection was bypassed");
+    }
+  } catch (cause) {
+    if (cause?.code === COWORK_MCP_CALL_LEDGER_UNSUPPORTED) throw cause;
+    throw coworkMcpAdmissionError(
+      COWORK_MCP_SESSION_UNVERIFIED,
+      "Cowork MCP session authority could not be verified; refusing to start a model or tool",
+      sessionId,
+      cause,
+    );
+  }
+}
 
 function resolveCoworkMcpSessionId(requested) {
   if (requested != null) {
@@ -152,6 +239,7 @@ function createCoworkMcpRecoveryProjection(sessionId, templateId, onFinish) {
         throw error;
       }
       acceptedCount += 1;
+      assertCoworkMcpEventUsageAdmission(event, sessionId);
       assertCoworkMcpSessionBindingEvent(event, templateId);
       ledger.accept(event);
     },
@@ -343,24 +431,13 @@ export function prepareCoworkMcpRuntime(mcp, options = {}) {
       });
     }
   } catch (error) {
-    recoveryNotice =
-      "MCP recovery notice — the durable Cowork MCP ledger could not be read. " +
-      "Do not execute or retry MCP tools until the session transcript has " +
-      `been inspected (${error?.code || "CC_MCP_LEDGER_EVENT_READ_FAILED"}).`;
-    recoveryState = publicMcpRecoveryState(
-      null,
-      "all",
-      error?.code || "CC_MCP_LEDGER_EVENT_READ_FAILED",
+    if (error?.code === COWORK_MCP_CALL_LEDGER_UNSUPPORTED) throw error;
+    throw coworkMcpAdmissionError(
+      COWORK_MCP_SESSION_UNVERIFIED,
+      "Cowork MCP session authority could not be verified; refusing to start a model or tool",
+      sessionId,
+      error,
     );
-    if (typeof options.onProgress === "function") {
-      options.onProgress({
-        type: "mcp-recovery",
-        sessionId,
-        unsettled: 0,
-        incidents: 1,
-        recovery: recoveryState,
-      });
-    }
   }
 
   const sink = createSessionMcpLedgerSink(
@@ -423,6 +500,10 @@ export async function runCoworkTask(options = {}) {
     throw new Error("userMessage is required");
   }
 
+  // An explicit canonical authority must be admitted before mounting local MCP
+  // servers, constructing a child context, or making any provider call.
+  assertCoworkMcpSessionUsageAdmission(mcpSessionId);
+
   // Validate file paths before starting
   if (files.length > 0) {
     const missing = files.filter((f) => !_deps.existsSync(f));
@@ -586,6 +667,7 @@ export async function runCoworkTask(options = {}) {
  * @param {object} options - Same as runCoworkTask, plus:
  * @param {number} [options.agents] - Number of parallel agents (default 3, max 10)
  * @param {string} [options.strategy] - Routing strategy (default "round-robin")
+ * @param {string} [options.mcpSessionId] - Canonical session authority to admit
  * @param {function} [options.onProgress] - Progress callback
  * @param {AbortSignal} [options.signal] - Cancellation signal
  * @returns {Promise<{ taskId: string, status: string, result: object }>}
@@ -600,12 +682,18 @@ export async function runCoworkTaskParallel(options = {}) {
     strategy,
     onProgress = null,
     signal = null,
+    mcpSessionId = null,
   } = options;
 
   if (!userMessage || typeof userMessage !== "string") {
     throw new Error("userMessage is required");
   }
 
+  // Parallel orchestration can make provider calls while decomposing and
+  // dispatching work. Apply the same canonical authority gate as sequential
+  // Cowork before constructing the orchestrator or starting any provider.
+  assertCoworkMcpSessionUsageAdmission(mcpSessionId);
+
   if (files.length > 0) {
     const missing = files.filter((f) => !_deps.existsSync(f));
     if (missing.length > 0) {
@@ -742,6 +830,7 @@ export async function runCoworkTaskParallel(options = {}) {
  * @param {string[]} [options.perspectives] - Override template perspectives
  * @param {string} [options.cwd] - Working directory for history
  * @param {object} [options.llmOptions] - LLM provider/model/key
+ * @param {string} [options.mcpSessionId] - Canonical session authority to admit
  * @param {function} [options.onProgress] - Progress callback
  * @returns {Promise<{ taskId, status, result }>}
  */
@@ -754,12 +843,18 @@ export async function runCoworkDebate(options = {}) {
     cwd = process.cwd(),
     llmOptions = {},
     onProgress = null,
+    mcpSessionId = null,
   } = options;
 
   if (!userMessage || typeof userMessage !== "string") {
     throw new Error("userMessage is required");
   }
 
+  // Debate performs multiple reviewer calls plus moderator synthesis. Refuse a
+  // protected or unverifiable authority before emitting progress or invoking
+  // the first reviewer, matching sequential and parallel Cowork admission.
+  assertCoworkMcpSessionUsageAdmission(mcpSessionId);
+
   if (files.length > 0) {
     const missing = files.filter((f) => !_deps.existsSync(f));
     if (missing.length > 0) {

package/src/lib/delivery-coordinator.js

@@ -66,7 +66,10 @@ const ACTION_TO_METHOD = Object.freeze({
 
 const EXACT_COMMIT_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;
 const SHA256_RE = /^sha256:[0-9a-f]{64}$/i;
+const TRANSCRIPT_HEAD_RE = /^[0-9a-f]{64}$/i;
 const DEFAULT_BLOCKING_SEVERITIES = Object.freeze(["Critical", "High"]);
+const MAX_CAUSAL_ID_LENGTH = 256;
+const MAX_CAUSAL_SESSIONS = 128;
 
 function hash(value) {
   return `sha256:${crypto
@@ -104,6 +107,126 @@ function boundedInteger(value, fallback, min, max) {
     : fallback;
 }
 
+function hasAsciiControlCharacter(value) {
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code <= 0x1f || code === 0x7f) return true;
+  }
+  return false;
+}
+
+function compareCodeUnits(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+function normalizeCausalId(value, field, { required = false } = {}) {
+  if (value == null) {
+    if (required) throw new Error(`${field} is required`);
+    return null;
+  }
+  if (typeof value !== "string") throw new Error(`${field} must be a string`);
+  const normalized = value.trim();
+  if (!normalized) {
+    if (required) throw new Error(`${field} is required`);
+    throw new Error(`${field} must not be blank`);
+  }
+  if (
+    normalized.length > MAX_CAUSAL_ID_LENGTH ||
+    hasAsciiControlCharacter(normalized)
+  ) {
+    throw new Error(`${field} is invalid`);
+  }
+  return normalized;
+}
+
+function normalizeCausality(value) {
+  if (value != null && (typeof value !== "object" || Array.isArray(value))) {
+    throw new Error("causality must be an object");
+  }
+  const source = value || {};
+  if (Object.hasOwn(source, "sessionIds")) {
+    throw new Error(
+      "causality.sessionIds is unsupported; bind sessions with headHash and eventCount",
+    );
+  }
+  if (
+    source.scope != null &&
+    (typeof source.scope !== "object" || Array.isArray(source.scope))
+  ) {
+    throw new Error("causality.scope must be an object");
+  }
+  if (source.sessions != null && !Array.isArray(source.sessions)) {
+    throw new Error("causality.sessions must be an array");
+  }
+  const scope = source.scope || {};
+  if ((source.sessions || []).length > MAX_CAUSAL_SESSIONS) {
+    throw new Error(
+      `causality.sessions exceeds the ${MAX_CAUSAL_SESSIONS} session limit`,
+    );
+  }
+  const sessions = (source.sessions || [])
+    .map((binding) => {
+      if (!binding || typeof binding !== "object" || Array.isArray(binding)) {
+        throw new Error("causality.sessions entries must be objects");
+      }
+      const sessionId = normalizeCausalId(
+        binding.sessionId,
+        "causality.sessions.sessionId",
+        { required: true },
+      );
+      if (
+        sessionId.includes("/") ||
+        sessionId.includes("\\") ||
+        sessionId.includes("..")
+      ) {
+        throw new Error("causality.sessions.sessionId is unsafe");
+      }
+      const headHash = String(binding.headHash || "").toLowerCase();
+      if (!TRANSCRIPT_HEAD_RE.test(headHash)) {
+        throw new Error("causality.sessions.headHash is invalid");
+      }
+      const eventCount = Number(binding.eventCount);
+      if (!Number.isSafeInteger(eventCount) || eventCount <= 0) {
+        throw new Error(
+          "causality.sessions.eventCount must be a positive safe integer",
+        );
+      }
+      return { sessionId, headHash, eventCount };
+    })
+    .sort((a, b) => compareCodeUnits(a.sessionId, b.sessionId));
+  if (
+    new Set(sessions.map((binding) => binding.sessionId)).size !==
+    sessions.length
+  ) {
+    throw new Error("causality.sessions contains duplicate sessionId values");
+  }
+  const normalizedScope = {
+    workspaceId: normalizeCausalId(
+      scope.workspaceId,
+      "causality.scope.workspaceId",
+    ),
+    teamId: normalizeCausalId(scope.teamId, "causality.scope.teamId"),
+    policyId: normalizeCausalId(scope.policyId, "causality.scope.policyId"),
+  };
+  if (
+    sessions.length > 0 &&
+    !Object.values(normalizedScope).some((scopeId) => scopeId != null)
+  ) {
+    throw new Error(
+      "causality.scope requires at least one dimension when sessions are bound",
+    );
+  }
+  return { scope: normalizedScope, sessions };
+}
+
+function hasCausality(causality) {
+  return Boolean(
+    causality &&
+    (causality.sessions.length > 0 ||
+      Object.values(causality.scope).some((value) => value != null)),
+  );
+}
+
 function stateMaterial(state) {
   const material = jsonClone(state);
   delete material.stateDigest;
@@ -533,6 +656,19 @@ export function verifyDeliveryFlowState(snapshot) {
     unmet.push("schema-unsupported");
   if (snapshot.version !== DELIVERY_FLOW_VERSION)
     unmet.push("version-unsupported");
+  if (Object.hasOwn(snapshot, "causality")) {
+    try {
+      const normalized = normalizeCausality(snapshot.causality);
+      if (
+        canonicalDeliveryJson(normalized) !==
+        canonicalDeliveryJson(snapshot.causality)
+      ) {
+        unmet.push("causality-noncanonical");
+      }
+    } catch {
+      unmet.push("causality-invalid");
+    }
+  }
   const actualDigest = String(snapshot.stateDigest || "");
   const expectedDigest = hash(stateMaterial(snapshot));
   if (!actualDigest || actualDigest !== expectedDigest) {
@@ -580,6 +716,10 @@ export function restoreDeliveryFlow(snapshot) {
 export function createDeliveryFlow(config = {}, { now } = {}) {
   const createdAt = isoNow(now);
   const requiredGates = normalizeGateDefinitions(config.requiredGates);
+  const normalizedCausality = normalizeCausality(config.causality);
+  const causality = hasCausality(normalizedCausality)
+    ? normalizedCausality
+    : null;
   const gateSelection = selectImpactedGates({
     changedFiles: config.diff?.changedFiles || config.changedFiles,
     requiredGates: requiredGates.map((gate) => ({
@@ -646,6 +786,7 @@ export function createDeliveryFlow(config = {}, { now } = {}) {
     commitSha: config.commitSha,
     diff: config.diff,
     requiredGateIds: requiredGates.map((gate) => gate.id),
+    ...(causality ? { causality } : {}),
   };
   const state = {
     schema: DELIVERY_FLOW_SCHEMA,
@@ -661,6 +802,7 @@ export function createDeliveryFlow(config = {}, { now } = {}) {
     stopReason: preflightReason,
     preflightUnmet,
     commitSha,
+    ...(causality ? { causality } : {}),
     diff: jsonClone(config.diff || {}),
     environment: jsonClone(config.environment || {}),
     requiredGates,

package/src/lib/direct-model-usage.js

@@ -0,0 +1,121 @@
+import { randomUUID } from "node:crypto";
+import {
+  markRuntimeLedgerPersistenceError,
+  projectRuntimeTokenUsage,
+  projectRuntimeUsageBoundary,
+  runtimeUsageEventType,
+} from "./runtime-usage-ledger.js";
+
+function asRuntimeLedgerPersistenceError(error) {
+  if (error && (typeof error === "object" || typeof error === "function")) {
+    try {
+      const marked = markRuntimeLedgerPersistenceError(error);
+      if (marked?.runtimeLedgerPersistence === true) return marked;
+    } catch {
+      // Frozen/non-extensible errors are wrapped below.
+    }
+  }
+  const wrapped = new Error("runtime usage ledger persistence failed", {
+    cause: error,
+  });
+  return markRuntimeLedgerPersistenceError(wrapped);
+}
+
+async function persistUsageEvent(persist, type, event) {
+  try {
+    await persist(type, event);
+  } catch (error) {
+    throw asRuntimeLedgerPersistenceError(error);
+  }
+}
+
+function unknownUsageEvent({ callId, provider, model, source, code }) {
+  return projectRuntimeUsageBoundary(
+    { callId, provider, model, source, code },
+    "unknown",
+  );
+}
+
+/**
+ * Meter one direct provider call that runs outside agentLoop. The started row is
+ * durable before the callback resumes into provider work; every outcome then
+ * settles known or unknown without persisting prompts, responses, or errors.
+ */
+export async function runMeteredDirectModelCall({
+  sessionId,
+  persist,
+  provider,
+  model,
+  source = "model",
+  call,
+}) {
+  if (typeof call !== "function") {
+    throw new TypeError("metered direct model call requires a callback");
+  }
+  if (!sessionId) return call();
+  if (typeof persist !== "function") {
+    throw new TypeError("metered direct model call requires persistence");
+  }
+  const callId = `direct-${randomUUID()}`;
+  await persistUsageEvent(
+    persist,
+    runtimeUsageEventType("started"),
+    projectRuntimeUsageBoundary({ callId, provider, model, source }, "started"),
+  );
+  let result;
+  try {
+    result = await call();
+  } catch (error) {
+    await persistUsageEvent(
+      persist,
+      runtimeUsageEventType("unknown"),
+      unknownUsageEvent({
+        callId,
+        provider,
+        model,
+        source,
+        code: "provider_call_failed",
+      }),
+    );
+    throw error;
+  }
+  if (result?.usage && typeof result.usage === "object") {
+    let event;
+    try {
+      event = projectRuntimeTokenUsage({
+        callId,
+        provider,
+        model,
+        source,
+        usage: result.usage,
+      });
+    } catch {
+      await persistUsageEvent(
+        persist,
+        runtimeUsageEventType("unknown"),
+        unknownUsageEvent({
+          callId,
+          provider,
+          model,
+          source,
+          code: "provider_usage_missing",
+        }),
+      );
+      return result;
+    }
+    await persistUsageEvent(persist, "token_usage", event);
+  } else {
+    await persistUsageEvent(
+      persist,
+      runtimeUsageEventType("unknown"),
+      unknownUsageEvent({
+        callId,
+        provider,
+        model,
+        source,
+        code: "provider_usage_missing",
+      }),
+    );
+  }
+  return result;
+}