chainlesschain 0.166.10 → 0.166.13

package/src/harness/prompt-compressor.js

@@ -12,6 +12,11 @@
 import { createHash } from "node:crypto";
 import { feature, featureVariant } from "../lib/feature-flags.js";
 import { isAbortError } from "../lib/abort-utils.js";
+import {
+  CONTEXT_WINDOWS,
+  getContextWindow,
+} from "../lib/model-context-window.js";
+export { CONTEXT_WINDOWS, getContextWindow } from "../lib/model-context-window.js";
 import {
   DURABLE_SYSTEM_MESSAGE_KINDS,
   getDurableSystemMessageProvenance,
@@ -184,61 +189,6 @@ function getContent(msg) {
     : JSON.stringify(msg.content || "");
 }
 
-export const CONTEXT_WINDOWS = {
-  "qwen2.5:7b": 32768,
-  "qwen2.5:14b": 32768,
-  "qwen2.5-coder:14b": 32768,
-  "qwen2:7b": 32768,
-  "llama3:8b": 8192,
-  "mistral:7b": 32768,
-  "codellama:7b": 16384,
-  "gpt-4o": 128000,
-  "gpt-4o-mini": 128000,
-  "gpt-4-turbo": 128000,
-  "gpt-3.5-turbo": 16385,
-  o1: 200000,
-  "claude-opus-4-6": 200000,
-  "claude-sonnet-4-6": 200000,
-  "claude-haiku-4-5-20251001": 200000,
-  "deepseek-chat": 64000,
-  "deepseek-coder": 64000,
-  "deepseek-reasoner": 64000,
-  "qwen-turbo": 131072,
-  "qwen-plus": 131072,
-  "qwen-max": 32768,
-  "gemini-2.0-flash": 1048576,
-  "gemini-2.0-pro": 1048576,
-  "gemini-1.5-flash": 1048576,
-  "moonshot-v1-auto": 131072,
-  "moonshot-v1-8k": 8192,
-  "moonshot-v1-32k": 32768,
-  "moonshot-v1-128k": 131072,
-  "doubao-seed-1-6-251015": 32768,
-  "doubao-seed-2-1-pro-260628": 32768,
-  _provider_defaults: {
-    ollama: 32768,
-    openai: 128000,
-    anthropic: 200000,
-    deepseek: 64000,
-    dashscope: 131072,
-    gemini: 1048576,
-    kimi: 131072,
-    volcengine: 32768,
-    minimax: 32768,
-    mistral: 32768,
-  },
-};
-
-export function getContextWindow(model, provider) {
-  if (model && CONTEXT_WINDOWS[model]) {
-    return CONTEXT_WINDOWS[model];
-  }
-  if (provider && CONTEXT_WINDOWS._provider_defaults[provider]) {
-    return CONTEXT_WINDOWS._provider_defaults[provider];
-  }
-  return 32768;
-}
-
 export const COMPRESSION_VARIANTS = {
   aggressive: { tokenFactor: 0.4, messageFactor: 0.7 },
   balanced: { tokenFactor: 0.6, messageFactor: 1.0 },

package/src/lib/agent-sandbox.js

@@ -259,10 +259,14 @@ export function normalizeAgentSandbox(value, options = {}) {
  */
 export function normalizeAgentSandboxMode(mode, value, options = {}) {
   if (mode == null || mode === "") {
-    // Keep the container sandbox opt-in unless CLI/settings policy explicitly
-    // enables it. The process broker still applies its platform boundary, but
-    // starting a normal agent must not require Docker to be installed/running.
-    return normalizeAgentSandbox(value, options);
+    // Public agent execution defaults to a real, fail-closed workspace
+    // sandbox with networking disabled. Bare-host execution remains available
+    // only through the explicit `off` mode below, where managed policy can
+    // prohibit it and the CLI records a high-risk security event.
+    return normalizeAgentSandboxMode("workspace-write", value || true, {
+      ...options,
+      network: false,
+    });
   }
   if (!AGENT_SANDBOX_MODES.includes(mode)) {
     const error = new Error(
@@ -392,6 +396,9 @@ export function executeSandboxedShell(command, sandbox, options = {}) {
     timeout: options.timeout,
     maxBuffer: options.maxBuffer,
     windowsHide: true,
+    requirePersistentAudit: true,
+    auditRedactArgIndexes: [args.length - 1],
+    auditContext: options.auditContext,
   });
   if (result.error) {
     return {
@@ -461,6 +468,9 @@ function executeBubblewrapShell(command, sandbox, options, hostCwd, policy) {
     timeout: options.timeout,
     maxBuffer: options.maxBuffer,
     windowsHide: true,
+    requirePersistentAudit: true,
+    auditRedactArgIndexes: [args.length - 1],
+    auditContext: options.auditContext,
   });
   if (result.error) {
     return {

package/src/lib/agent-team/team-distributed-graph-bridge.js

@@ -1,11 +1,11 @@
 import path from "node:path";
 import { createHash } from "node:crypto";
-import { JsonlRolloutStore } from "../app-server/rollout-store.js";
+import { createRolloutStore } from "../app-server/rollout-store-factory.js";
 
 export const TEAM_DISTRIBUTED_GRAPH_BRIDGE_SCHEMA =
   "chainlesschain.team-distributed-graph-bridge/v1";
 
-// Keep every derived thread/idempotency key inside JsonlRolloutStore's own
+// Keep every derived thread/idempotency key inside the RolloutStore contract's
 // bounds after this adapter adds its domain prefix.
 const ID = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u;
 const REQUEST_TYPES = new Set(["dispatch", "settle", "cancel"]);
@@ -74,7 +74,7 @@ export class TeamDistributedGraphBridge {
     this.runId = identifier(runId, "runId");
     this.threadId = identifier(`team-graph-bridge:${this.queueId}`, "threadId");
     this.store =
-      store || new JsonlRolloutStore({ directory: this.directory, now });
+      store || createRolloutStore({ directory: this.directory, now });
     const thread = this.store.start({
       threadId: this.threadId,
       title: `Distributed Team Graph bridge ${this.queueId}`,

package/src/lib/app-server/context-memory-notifications.js

@@ -0,0 +1,54 @@
+const MEMORY_MUTATION_EVENTS = new Set([
+  "memory.candidate.created",
+  "memory.activated",
+  "memory.reinforced",
+  "memory.superseded",
+  "memory.expired",
+]);
+
+export function contextPlanCreatedNotification(plan) {
+  return {
+    method: "context/event",
+    params: { type: "context.plan.created", plan },
+  };
+}
+
+export function memoryRecalledNotification(result) {
+  return {
+    method: "memory/event",
+    params: { type: "memory.recalled", result },
+  };
+}
+
+export function memoryMutationNotification(mutation) {
+  if (!MEMORY_MUTATION_EVENTS.has(mutation?.event?.type)) return null;
+  return {
+    method: "memory/event",
+    params: {
+      type: mutation.event.type,
+      memory_id: mutation.record.memoryId,
+      revision: mutation.record.revision,
+      record_digest: mutation.record.digest,
+      record: mutation.record,
+    },
+  };
+}
+
+export function memoryDeletionNotification(receipt, operationId = receipt?.requestId) {
+  if (!receipt?.memoryId || !receipt?.recordDigest || !receipt?.revision) {
+    return null;
+  }
+  const purged = receipt.status === "purged";
+  return {
+    method: "memory/event",
+    params: {
+      type: purged ? "memory.purged" : "memory.deleted",
+      operation_id: operationId,
+      request_id: receipt.requestId || operationId,
+      memory_id: receipt.memoryId,
+      revision: receipt.revision,
+      record_digest: receipt.recordDigest,
+      ...(purged ? { receipt } : {}),
+    },
+  };
+}

package/src/lib/app-server/rollout-store-factory.js

@@ -0,0 +1,115 @@
+import path from "node:path";
+
+import {
+  JsonlRolloutStore,
+  assertRolloutStore,
+  defaultRolloutStoreDirectory,
+} from "./rollout-store.js";
+import {
+  SqliteRolloutStore,
+  sqliteRolloutStoreAvailable,
+} from "./sqlite-rollout-store.js";
+
+export const ROLLOUT_STORE_BACKENDS = Object.freeze(["jsonl", "sqlite"]);
+export const ROLLOUT_STORE_ENV = "CHAINLESSCHAIN_ROLLOUT_STORE";
+export const ROLLOUT_STORE_PATH_ENV = "CHAINLESSCHAIN_ROLLOUT_STORE_PATH";
+
+function factoryError(code, message, details = {}) {
+  const error = new Error(message);
+  error.name = "RolloutStoreFactoryError";
+  error.code = code;
+  Object.assign(error, details);
+  return error;
+}
+
+export function normalizeRolloutStoreBackend(value = null) {
+  const backend = String(value || "jsonl")
+    .trim()
+    .toLowerCase();
+  if (!ROLLOUT_STORE_BACKENDS.includes(backend)) {
+    throw factoryError(
+      "CC_ROLLOUT_BACKEND_UNSUPPORTED",
+      `unsupported rollout store backend: ${backend || "empty"}`,
+      { backend, supported: [...ROLLOUT_STORE_BACKENDS] },
+    );
+  }
+  return backend;
+}
+
+export function defaultSqliteRolloutStoreFilename() {
+  return path.join(
+    path.dirname(defaultRolloutStoreDirectory()),
+    "rollouts.sqlite",
+  );
+}
+
+function labelStore(store, backend, location) {
+  if (!Object.isExtensible(store)) return store;
+  for (const [key, value] of Object.entries({ backend, location })) {
+    if (!Object.prototype.hasOwnProperty.call(store, key)) {
+      Object.defineProperty(store, key, {
+        configurable: false,
+        enumerable: false,
+        writable: false,
+        value,
+      });
+    }
+  }
+  return store;
+}
+
+/**
+ * Resolve one physical adapter behind the canonical RolloutStore contract.
+ * A host-provided adapter is the extension seam for remote/synchronized stores;
+ * it is accepted only after the complete logical contract is present.
+ */
+export function createRolloutStore({
+  backend = process.env[ROLLOUT_STORE_ENV] || "jsonl",
+  location = process.env[ROLLOUT_STORE_PATH_ENV] || null,
+  directory = null,
+  filename = null,
+  adapter = null,
+  now = Date.now,
+} = {}) {
+  if (adapter) {
+    return labelStore(assertRolloutStore(adapter), "custom", location || null);
+  }
+
+  const normalizedBackend = normalizeRolloutStoreBackend(backend);
+  if (normalizedBackend === "jsonl") {
+    const resolvedDirectory = path.resolve(
+      directory || location || defaultRolloutStoreDirectory(),
+    );
+    return labelStore(
+      assertRolloutStore(
+        new JsonlRolloutStore({ directory: resolvedDirectory, now }),
+      ),
+      normalizedBackend,
+      resolvedDirectory,
+    );
+  }
+
+  if (!sqliteRolloutStoreAvailable()) {
+    throw factoryError(
+      "CC_ROLLOUT_SQLITE_UNAVAILABLE",
+      "SQLite rollout storage is unavailable in this Node runtime",
+    );
+  }
+  const resolvedFilename = path.resolve(
+    filename ||
+      (directory ? path.join(directory, "rollouts.sqlite") : null) ||
+      location ||
+      defaultSqliteRolloutStoreFilename(),
+  );
+  return labelStore(
+    assertRolloutStore(
+      new SqliteRolloutStore({ filename: resolvedFilename, now }),
+    ),
+    normalizedBackend,
+    resolvedFilename,
+  );
+}
+
+export function closeRolloutStore(store) {
+  if (store && typeof store.close === "function") store.close();
+}