chainlesschain 0.166.102 → 0.166.103

package/src/assets/web-panel/assets/{zoom-BWhIVeKQ.js → zoom-CIZAMma9.js}

@@ -1,4 +1,4 @@
-import{K as o}from"./index-CkqBoCiu.js";import{i as f}from"./motion-IPIj1ZtP.js";const c=new o("antZoomIn",{"0%":{transform:"scale(0.2)",opacity:0},"100%":{transform:"scale(1)",opacity:1}}),y=new o("antZoomOut",{"0%":{transform:"scale(1)"},"100%":{transform:"scale(0.2)",opacity:0}}),a=new o("antZoomBigIn",{"0%":{transform:"scale(0.8)",opacity:0},"100%":{transform:"scale(1)",opacity:1}}),s=new o("antZoomBigOut",{"0%":{transform:"scale(1)"},"100%":{transform:"scale(0.8)",opacity:0}}),g=new o("antZoomUpIn",{"0%":{transform:"scale(0.8)",transformOrigin:"50% 0%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"50% 0%"}}),O=new o("antZoomUpOut",{"0%":{transform:"scale(1)",transformOrigin:"50% 0%"},"100%":{transform:"scale(0.8)",transformOrigin:"50% 0%",opacity:0}}),l=new o("antZoomLeftIn",{"0%":{transform:"scale(0.8)",transformOrigin:"0% 50%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"0% 50%"}}),u=new o("antZoomLeftOut",{"0%":{transform:"scale(1)",transformOrigin:"0% 50%"},"100%":{transform:"scale(0.8)",transformOrigin:"0% 50%",opacity:0}}),p=new o("antZoomRightIn",{"0%":{transform:"scale(0.8)",transformOrigin:"100% 50%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"100% 50%"}}),z=new o("antZoomRightOut",{"0%":{transform:"scale(1)",transformOrigin:"100% 50%"},"100%":{transform:"scale(0.8)",transformOrigin:"100% 50%",opacity:0}}),K=new o("antZoomDownIn",{"0%":{transform:"scale(0.8)",transformOrigin:"50% 100%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"50% 100%"}}),w=new o("antZoomDownOut",{"0%":{transform:"scale(1)",transformOrigin:"50% 100%"},"100%":{transform:"scale(0.8)",transformOrigin:"50% 100%",opacity:0}}),I={zoom:{inKeyframes:c,outKeyframes:y},"zoom-big":{inKeyframes:a,outKeyframes:s},"zoom-big-fast":{inKeyframes:a,outKeyframes:s},"zoom-left":{inKeyframes:l,outKeyframes:u},"zoom-right":{inKeyframes:p,outKeyframes:z},"zoom-up":{inKeyframes:g,outKeyframes:O},"zoom-down":{inKeyframes:K,outKeyframes:w}},h=(n,r)=>{const{antCls:m}=n,t=`${m}-${r}`,{inKeyframes:i,outKeyframes:e}=I[r];return[f(t,i,e,r==="zoom-big-fast"?n.motionDurationFast:n.motionDurationMid),{[`
+import{K as o}from"./index-CRa4pAaM.js";import{i as f}from"./motion-CX2Cnsd5.js";const c=new o("antZoomIn",{"0%":{transform:"scale(0.2)",opacity:0},"100%":{transform:"scale(1)",opacity:1}}),y=new o("antZoomOut",{"0%":{transform:"scale(1)"},"100%":{transform:"scale(0.2)",opacity:0}}),a=new o("antZoomBigIn",{"0%":{transform:"scale(0.8)",opacity:0},"100%":{transform:"scale(1)",opacity:1}}),s=new o("antZoomBigOut",{"0%":{transform:"scale(1)"},"100%":{transform:"scale(0.8)",opacity:0}}),g=new o("antZoomUpIn",{"0%":{transform:"scale(0.8)",transformOrigin:"50% 0%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"50% 0%"}}),O=new o("antZoomUpOut",{"0%":{transform:"scale(1)",transformOrigin:"50% 0%"},"100%":{transform:"scale(0.8)",transformOrigin:"50% 0%",opacity:0}}),l=new o("antZoomLeftIn",{"0%":{transform:"scale(0.8)",transformOrigin:"0% 50%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"0% 50%"}}),u=new o("antZoomLeftOut",{"0%":{transform:"scale(1)",transformOrigin:"0% 50%"},"100%":{transform:"scale(0.8)",transformOrigin:"0% 50%",opacity:0}}),p=new o("antZoomRightIn",{"0%":{transform:"scale(0.8)",transformOrigin:"100% 50%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"100% 50%"}}),z=new o("antZoomRightOut",{"0%":{transform:"scale(1)",transformOrigin:"100% 50%"},"100%":{transform:"scale(0.8)",transformOrigin:"100% 50%",opacity:0}}),K=new o("antZoomDownIn",{"0%":{transform:"scale(0.8)",transformOrigin:"50% 100%",opacity:0},"100%":{transform:"scale(1)",transformOrigin:"50% 100%"}}),w=new o("antZoomDownOut",{"0%":{transform:"scale(1)",transformOrigin:"50% 100%"},"100%":{transform:"scale(0.8)",transformOrigin:"50% 100%",opacity:0}}),I={zoom:{inKeyframes:c,outKeyframes:y},"zoom-big":{inKeyframes:a,outKeyframes:s},"zoom-big-fast":{inKeyframes:a,outKeyframes:s},"zoom-left":{inKeyframes:l,outKeyframes:u},"zoom-right":{inKeyframes:p,outKeyframes:z},"zoom-up":{inKeyframes:g,outKeyframes:O},"zoom-down":{inKeyframes:K,outKeyframes:w}},h=(n,r)=>{const{antCls:m}=n,t=`${m}-${r}`,{inKeyframes:i,outKeyframes:e}=I[r];return[f(t,i,e,r==="zoom-big-fast"?n.motionDurationFast:n.motionDurationMid),{[`
         ${t}-enter,
         ${t}-appear
       `]:{transform:"scale(0)",opacity:0,animationTimingFunction:n.motionEaseOutCirc,"&-prepare":{transform:"none"}},[`${t}-leave`]:{animationTimingFunction:n.motionEaseInOutCirc}}]};export{h as i,c as z};

package/src/assets/web-panel/index.html

@@ -8,7 +8,7 @@
     // Injected by web-ui-server.js at serve time
     window.__CC_CONFIG__ = __CC_CONFIG_PLACEHOLDER__;
   </script>
-  <script type="module" crossorigin src="./assets/index-CkqBoCiu.js"></script>
+  <script type="module" crossorigin src="./assets/index-CRa4pAaM.js"></script>
   <link rel="modulepreload" crossorigin href="./assets/vendor-Bn1JzzAn.js">
   <link rel="modulepreload" crossorigin href="./assets/icons-DG5UD-6K.js">
   <link rel="stylesheet" crossorigin href="./assets/index-Cq93VfoF.css">

package/src/commands/ask.js

@@ -21,6 +21,7 @@
  *   used /api/generate, which broke against the Android server.
  */
 
+import { providerFetch } from "../lib/formal-budget-provider-scope.js";
 import ora from "ora";
 import { randomUUID } from "node:crypto";
 import { types as utilTypes } from "node:util";
@@ -128,8 +129,9 @@ export async function queryLLM(
   // under vitest so it never pollutes spawned-bin test stderr.
   if (!process.env.VITEST && !process.env.VITEST_WORKER_ID) {
     try {
-      const { maybeWarnDeprecatedModel } =
-        await import("../lib/model-deprecation.js");
+      const { maybeWarnDeprecatedModel } = await import(
+        "../lib/model-deprecation.js"
+      );
       maybeWarnDeprecatedModel({ model });
     } catch {
       /* fail-open: a deprecation notice must never affect the query */
@@ -140,7 +142,7 @@ export async function queryLLM(
     const baseUrl = options.baseUrl || "http://localhost:11434";
     // Use /api/chat (modern Ollama API + only endpoint Android LocalLlmServer
     // implements). Non-streaming mode keeps the response shape simple.
-    const response = await fetch(`${baseUrl}/api/chat`, {
+    const response = await providerFetch(`${baseUrl}/api/chat`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -183,7 +185,7 @@ export async function queryLLM(
   }
 
   const apiBase = options.baseUrl || providerDef.baseUrl;
-  const response = await fetch(`${apiBase}/chat/completions`, {
+  const response = await providerFetch(`${apiBase}/chat/completions`, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",

package/src/commands/team.js

@@ -40,6 +40,7 @@ import {
   normalizeTeamScopes,
 } from "../lib/agent-team/team-scope-lock.js";
 import { executionBroker } from "../lib/process-execution-broker/index.js";
+import { requireUnscopedDescendantControl } from "../lib/formal-budget-provider-scope.js";
 import {
   createCollaborationRun,
   createCollaborationRunId,
@@ -1025,7 +1026,9 @@ function planWaves(reg) {
 
 /** Real executor: run a task's shell `command`, success = exit 0. */
 export function makeShellRunTask() {
-  return function runTask({ task, signal = null }) {
+  return function runTask(payload) {
+    requireUnscopedDescendantControl();
+    const { task, signal = null } = payload;
     const command = task.metadata?.command || task?.command;
     if (!command) {
       throw new Error(`task "${task.key}" has no \`command\` to --exec`);
@@ -1128,6 +1131,7 @@ export function makeShellRunTask() {
 
 /** Spawn a headless `cc agent -p` for one prompt in `cwd`; resolve on exit 0. */
 function spawnAgentProcess(prompt, cwd, opts = {}) {
+  requireUnscopedDescendantControl();
   return new Promise((resolve, reject) => {
     const formalQualityHermetic = isFormalQualityHermeticRuntime(process.env);
     const parser = new TeamAgentStreamParser({
@@ -1445,6 +1449,7 @@ function spawnAgentProcess(prompt, cwd, opts = {}) {
 }
 
 export function spawnAgent(prompt, cwd, opts = {}) {
+  requireUnscopedDescendantControl();
   if (!opts.messageBridge || isFormalQualityHermeticRuntime(process.env)) {
     return spawnAgentProcess(prompt, cwd, opts);
   }
@@ -1492,20 +1497,22 @@ function applyBudgetReservation(contract, budgetReservation) {
 }
 
 export function makeAgentRunTask(opts = {}) {
-  return function runTask({
-    key,
-    task,
-    holder,
-    inbox = [],
-    sendMessage = null,
-    messageAuthority = null,
-    recipientState = null,
-    requestFollowupWake = null,
-    requestHandoff = null,
-    mailbox = null,
-    budgetReservation = null,
-    signal = null,
-  }) {
+  return function runTask(payload) {
+    requireUnscopedDescendantControl();
+    const {
+      key,
+      task,
+      holder,
+      inbox = [],
+      sendMessage = null,
+      messageAuthority = null,
+      recipientState = null,
+      requestFollowupWake = null,
+      requestHandoff = null,
+      mailbox = null,
+      budgetReservation = null,
+      signal = null,
+    } = payload;
     const prompt = task.metadata?.prompt || task?.prompt;
     if (!prompt) {
       throw new Error(`task "${key}" has no \`prompt\` to --agent`);
@@ -3087,8 +3094,9 @@ export function registerTeamCommand(program, { logger } = {}) {
         let recorder = null;
         let collectorEnabled = false;
         try {
-          const { isOtlpCollectorEnabled } =
-            await import("../lib/observability/index.js");
+          const { isOtlpCollectorEnabled } = await import(
+            "../lib/observability/index.js"
+          );
           collectorEnabled = isOtlpCollectorEnabled();
         } catch {
           collectorEnabled = false;
@@ -3096,8 +3104,9 @@ export function registerTeamCommand(program, { logger } = {}) {
         const workflowRunId = `team-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
         const workflowName = path.basename(options.tasks);
         if (options.otlp || collectorEnabled) {
-          const { TelemetryRecorder } =
-            await import("../lib/telemetry/span-recorder.js");
+          const { TelemetryRecorder } = await import(
+            "../lib/telemetry/span-recorder.js"
+          );
           recorder = new TelemetryRecorder({
             defaultAttributes: {
               "workflow.run_id": workflowRunId,

package/src/data/changelog.json

@@ -1,6 +1,19 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.103",
+      "cliVersions": ["0.166.103"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.103: reject ungoverned formal budget exits",
+          "body": "- Keep formal paid evaluation closed while budgeted requests lack production\n  account, checkpoint and host isolation evidence.\n- Reject direct Agent tools, subprocess and worker launches, credential and\n  network paths when entered from the formal budget scope; propagate rejection\n  through parallel tool execution.\n- Bind the frozen all-Volcengine 36-task and 9-first-run plan to its exact\n  model, endpoint and shared historical $99 budget without counting diagnostic\n  calls as formal observations.\n- Pair VS Code 0.37.147 and JetBrains 0.4.165 with CLI 0.166.103 only after\n  the exact release commit passes its complete Actions gates and npm readback."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.102",

package/src/harness/prompt-compressor.js

@@ -17,6 +17,7 @@ import {
 } from "../lib/read-file-page.js";
 import { feature, featureVariant } from "../lib/feature-flags.js";
 import { isAbortError } from "../lib/abort-utils.js";
+import { isFormalBudgetError } from "../lib/formal-budget-errors.js";
 import {
   CONTEXT_WINDOWS,
   getContextWindow,
@@ -680,6 +681,7 @@ export class PromptCompressor {
       // A durable-ledger write failure is authoritative too. Falling back here
       // would let the host continue after losing the model-call boundary.
       if (error?.runtimeLedgerPersistence === true) throw error;
+      if (isFormalBudgetError(error)) throw error;
       if (error?.code === "CC_AGENT_EVOLUTION_INGRESS_FAILED") throw error;
       // A workflow-bound query may already have reached the provider. An
       // extractive fallback would make the outer durable effect look completed

package/src/lib/advisor-runtime.js

@@ -9,6 +9,7 @@
 
 import { createHash, randomUUID } from "node:crypto";
 import { CostBudget } from "./cost-budget.js";
+import { isFormalBudgetError } from "./formal-budget-errors.js";
 import { FREE_PROVIDERS, mergePricing } from "./llm-pricing.js";
 import { redactSecrets } from "./secret-scan.js";
 import { firstBalancedJson } from "./json-schema-output.js";
@@ -179,8 +180,8 @@ export function resolveAdvisorConfig({
   );
   const hasManagedAdvisorPolicy = Boolean(
     Object.keys(managedAdvisor).length > 0 ||
-    managed?.advisorAllowedProviders !== undefined ||
-    managed?.advisorAllowedModels !== undefined,
+      managed?.advisorAllowedProviders !== undefined ||
+      managed?.advisorAllowedModels !== undefined,
   );
   let policyReason = null;
   if (managedAdvisor.enabled === false) {
@@ -937,6 +938,7 @@ export class AdvisorRuntime {
       };
     } catch (error) {
       if (error?.runtimeLedgerPersistence === true) throw error;
+      if (isFormalBudgetError(error)) throw error;
       if (error?.code === "CC_AGENT_EVOLUTION_INGRESS_FAILED") throw error;
       const failure = {
         callId,

package/src/lib/agent-ipc-bus.js

@@ -13,6 +13,7 @@ import { EventEmitter } from "node:events";
 import crypto from "node:crypto";
 import { EventRuntimeProducer } from "./event-runtime-producer.js";
 import { EventRuntimeStore } from "./event-runtime-store.js";
+import { requireUnscopedDescendantControl } from "./formal-budget-provider-scope.js";
 import executionBroker from "./process-execution-broker/index.js";
 import {
   AGENT_IPC_DEFAULT_LIMITS,
@@ -284,6 +285,7 @@ class AgentIPCBus extends EventEmitter {
    * @returns {Promise<{process: ChildProcess, agentId: string}>}
    */
   async spawnAgentProcess(command, args = [], options = {}) {
+    requireUnscopedDescendantControl();
     const agentId = options.agentId || crypto.randomUUID();
     if (
       this._childTransports.has(agentId) ||

package/src/lib/background-agent-keeper-client.js

@@ -1,6 +1,7 @@
 import net from "node:net";
 import { randomBytes } from "node:crypto";
 import { createNdjsonReader } from "./background-session-transport.js";
+import { requireUnscopedDescendantControl } from "./formal-budget-provider-scope.js";
 import {
   BACKGROUND_AGENT_KEEPER_ARM,
   BACKGROUND_AGENT_KEEPER_ARMED,
@@ -67,6 +68,7 @@ async function connectWithDeadline(pipePath, timeoutMs) {
 }
 
 export async function connectBackgroundAgentKeeper(options = {}) {
+  requireUnscopedDescendantControl();
   const hello = normalizeBackgroundAgentKeeperHello(options);
   const connectTimeoutMs = Math.max(
     1,
@@ -234,6 +236,7 @@ export async function connectBackgroundAgentKeeper(options = {}) {
 
   return Object.freeze({
     async arm(turn) {
+      requireUnscopedDescendantControl();
       const normalized = normalizeBackgroundAgentKeeperTurn(turn);
       if (activeTurn) {
         throw keeperError(

package/src/lib/browser-automation.js

@@ -3,10 +3,13 @@
  * Uses built-in fetch for basic operations, optional playwright for screenshots.
  */
 
+import { requireUnscopedExternalToolAccess } from "./formal-budget-provider-scope.js";
+
 /**
  * Fetch a URL and return the raw HTML.
  */
 export async function fetchPage(url, options = {}) {
+  requireUnscopedExternalToolAccess();
   const timeout = options.timeout || 30000;
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeout);
@@ -179,6 +182,7 @@ export function extractLinks(html, baseUrl) {
  * Returns null if playwright is not installed.
  */
 export async function takeScreenshot(url, outputPath, options = {}) {
+  requireUnscopedExternalToolAccess();
   try {
     const { chromium } = await import("playwright");
     const browser = await chromium.launch({ headless: true });

package/src/lib/cc-android-bridge.js

@@ -32,6 +32,7 @@
 
 import { readFileSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
+import { requireUnscopedExternalToolAccess } from "./formal-budget-provider-scope.js";
 
 const ANDROID_PREFIX = "/data/data/com.chainlesschain.android/";
 
@@ -72,6 +73,7 @@ function resolveBridgeConfigDir() {
  * (server not started yet, or running off-device without override).
  */
 export function loadBridgeConfig() {
+  requireUnscopedExternalToolAccess();
   const dir = resolveBridgeConfigDir();
   if (!dir) return null;
   try {
@@ -109,6 +111,7 @@ export class AndroidBridgeUnavailableError extends Error {
  *  - Method name unknown (server returns {"error": "UNKNOWN_METHOD"})
  */
 export async function invoke(method, params = {}) {
+  requireUnscopedExternalToolAccess();
   if (typeof method !== "string" || method.length === 0) {
     throw new TypeError(
       "cc-android-bridge.invoke: method must be non-empty string",
@@ -170,6 +173,7 @@ export async function invoke(method, params = {}) {
  * Returns `{ available: boolean, reason?: string, port?: number }`.
  */
 export function caps() {
+  requireUnscopedExternalToolAccess();
   if (process.env.CC_ANDROID_BRIDGE_OVERRIDE === "1") {
     return { available: true, reason: "test-override" };
   }

package/src/lib/chat-core.js

@@ -1,3 +1,4 @@
+import { providerFetch } from "./formal-budget-provider-scope.js";
 /**
  * Chat Core — transport-independent streaming chat logic
  *
@@ -21,6 +22,7 @@ import {
   waitForStreamRetry,
 } from "./stream-retry.js";
 import { throwIfAborted } from "./abort-utils.js";
+import { isFormalBudgetError } from "./formal-budget-errors.js";
 
 // A streaming chat call must not hang forever if the API accepts the connection
 // but then goes silent (TCP up, no bytes). Abort the request if no data arrives
@@ -132,7 +134,7 @@ export async function streamOllama(
   guard.bump();
   let response;
   try {
-    response = await fetch(`${baseUrl}/api/chat`, {
+    response = await providerFetch(`${baseUrl}/api/chat`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -146,7 +148,7 @@ export async function streamOllama(
     });
   } catch (e) {
     guard.stop();
-    throw guard.stalled()
+    throw guard.stalled() && !isFormalBudgetError(e)
       ? new Error(
           `Ollama request stalled (no response in ${STREAM_STALL_MS / 1000}s)`,
         )
@@ -213,7 +215,7 @@ export async function streamOllama(
     }
   } catch (e) {
     throw attachStreamRetryMetadata(
-      guard.stalled()
+      guard.stalled() && !isFormalBudgetError(e)
         ? new Error(
             `Ollama stream stalled (no data in ${STREAM_STALL_MS / 1000}s)`,
           )
@@ -247,7 +249,7 @@ export async function streamOpenAI(
   guard.bump();
   let response;
   try {
-    response = await fetch(`${baseUrl}/chat/completions`, {
+    response = await providerFetch(`${baseUrl}/chat/completions`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -267,7 +269,7 @@ export async function streamOpenAI(
     });
   } catch (e) {
     guard.stop();
-    throw guard.stalled()
+    throw guard.stalled() && !isFormalBudgetError(e)
       ? new Error(
           `API request stalled (no response in ${STREAM_STALL_MS / 1000}s)`,
         )
@@ -344,7 +346,7 @@ export async function streamOpenAI(
     }
   } catch (e) {
     throw attachStreamRetryMetadata(
-      guard.stalled()
+      guard.stalled() && !isFormalBudgetError(e)
         ? new Error(
             `API stream stalled (no data in ${STREAM_STALL_MS / 1000}s)`,
           )
@@ -392,7 +394,7 @@ export async function streamAnthropic(
   guard.bump();
   let response;
   try {
-    response = await fetch(`${baseUrl}/messages`, {
+    response = await providerFetch(`${baseUrl}/messages`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -412,7 +414,7 @@ export async function streamAnthropic(
     });
   } catch (e) {
     guard.stop();
-    throw guard.stalled()
+    throw guard.stalled() && !isFormalBudgetError(e)
       ? new Error(
           `Anthropic request stalled (no response in ${STREAM_STALL_MS / 1000}s)`,
         )
@@ -486,7 +488,7 @@ export async function streamAnthropic(
     }
   } catch (e) {
     throw attachStreamRetryMetadata(
-      guard.stalled()
+      guard.stalled() && !isFormalBudgetError(e)
         ? new Error(
             `Anthropic stream stalled (no data in ${STREAM_STALL_MS / 1000}s)`,
           )

package/src/lib/cloud/cloud-client.js

@@ -28,6 +28,7 @@ import {
 import { join } from "node:path";
 import { getHomeDir } from "../paths.js";
 import { ResilientGatewayClient } from "../gateway-client-resilience.js";
+import { requireUnscopedDescendantControl } from "../formal-budget-provider-scope.js";
 
 export const _deps = { fetch: (...a) => globalThis.fetch(...a) };
 
@@ -78,6 +79,7 @@ export class CloudClient {
    * @param {object} opts { baseUrl, token, deps? }
    */
   constructor(opts = {}) {
+    requireUnscopedDescendantControl();
     this.baseUrl = String(opts.baseUrl || "").replace(/\/+$/, "");
     if (!this.baseUrl) {
       throw new Error(
@@ -109,6 +111,7 @@ export class CloudClient {
   }
 
   async _json(method, path, body) {
+    requireUnscopedDescendantControl();
     const res = await this.deps.fetch(`${this.baseUrl}${path}`, {
       method,
       headers: this._headers(),
@@ -121,7 +124,9 @@ export class CloudClient {
   }
 
   /** Submit a job. `bundle` is a base64 git bundle of the branch. */
-  async submit({ task, bundle, branch, baseSha }) {
+  async submit(payload) {
+    requireUnscopedDescendantControl();
+    const { task, bundle, branch, baseSha } = payload;
     const data = await this._json("POST", "/v1/jobs", {
       task,
       bundle,
@@ -133,10 +138,12 @@ export class CloudClient {
   }
 
   async status(jobId) {
+    requireUnscopedDescendantControl();
     return this._json("GET", `/v1/jobs/${encodeURIComponent(jobId)}`);
   }
 
   async result(jobId) {
+    requireUnscopedDescendantControl();
     return this._json("GET", `/v1/jobs/${encodeURIComponent(jobId)}/result`);
   }
 
@@ -146,6 +153,7 @@ export class CloudClient {
    * runners remain compatible with status()/result().
    */
   async events(jobId, options = {}) {
+    requireUnscopedDescendantControl();
     if (!/^[\w.-]+$/.test(String(jobId || ""))) {
       throw new Error(`invalid job id: ${jobId}`);
     }
@@ -175,6 +183,7 @@ export const TERMINAL_CLOUD_STATUS = new Set(["done", "failed"]);
  * `sleep`/`now` injected for tests.
  */
 export async function pollUntilDone(client, jobId, opts = {}) {
+  requireUnscopedDescendantControl();
   const intervalMs = opts.intervalMs ?? 3000;
   const timeoutMs = opts.timeoutMs ?? 30 * 60_000;
   const sleep = opts.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));

package/src/lib/cowork-adapter.js

@@ -7,6 +7,7 @@
  *  - Module initialization helper
  */
 
+import { providerFetch } from "./formal-budget-provider-scope.js";
 import { LLMProviderRegistry, BUILT_IN_PROVIDERS } from "./llm-providers.js";
 import { loadConfig } from "./config-manager.js";
 import { applyConfigLlmDefaults } from "./llm-config-defaults.js";
@@ -174,7 +175,7 @@ export function createChatFn(options = {}) {
         currentModel,
         async ({ signal = opts.signal || resolved.signal } = {}) => {
           const modelMessages = await prepareMessages();
-          const res = await fetch(`${baseUrl}/api/chat`, {
+          const res = await providerFetch(`${baseUrl}/api/chat`, {
             method: "POST",
             signal: requestSignal(signal),
             headers: { "Content-Type": "application/json" },
@@ -214,7 +215,7 @@ export function createChatFn(options = {}) {
               ? { system: systemMsgs.map((m) => m.content).join("\n") }
               : {}),
           };
-          const res = await fetch(`${baseUrl}/messages`, {
+          const res = await providerFetch(`${baseUrl}/messages`, {
             method: "POST",
             signal: requestSignal(signal),
             headers: {
@@ -245,7 +246,7 @@ export function createChatFn(options = {}) {
       currentModel,
       async ({ signal = opts.signal || resolved.signal } = {}) => {
         const modelMessages = await prepareMessages();
-        const res = await fetch(`${baseUrl}/chat/completions`, {
+        const res = await providerFetch(`${baseUrl}/chat/completions`, {
           method: "POST",
           signal: requestSignal(signal),
           headers: {

package/src/lib/decision-layer/providers.js

@@ -1,4 +1,5 @@
 import { openDecisionProviderAuthority } from "./provider-authority.js";
+import { providerFetch } from "../formal-budget-provider-scope.js";
 
 const PROVIDERS = Object.freeze({
   typesafe: {
@@ -195,18 +196,22 @@ export function createDecisionProvider({
       if (Buffer.byteLength(body, "utf8") > MAX_DECISION_REQUEST_BYTES) {
         throw bodyTooLarge("request", MAX_DECISION_REQUEST_BYTES);
       }
-      const response = await fetchImpl(endpoint, {
-        method: "POST",
-        headers: {
-          ...(secret === undefined
-            ? {}
-            : { authorization: `Bearer ${secret}` }),
-          "content-type": "application/json",
+      const response = await providerFetch(
+        endpoint,
+        {
+          method: "POST",
+          headers: {
+            ...(secret === undefined
+              ? {}
+              : { authorization: `Bearer ${secret}` }),
+            "content-type": "application/json",
+          },
+          body,
+          signal,
+          redirect: "error",
         },
-        body,
-        signal,
-        redirect: "error",
-      });
+        fetchImpl,
+      );
       if (!response?.ok) {
         throw providerError(response?.status ?? 0, options.provider);
       }

package/src/lib/evolution/governed-hub-llm.js

@@ -1,6 +1,10 @@
 import { createRequire } from "node:module";
 import { types } from "node:util";
 import { prepareGovernedModelTurn } from "./governed-model-turn.js";
+import {
+  providerFetch,
+  requireUnscopedModelTransport,
+} from "../formal-budget-provider-scope.js";
 
 const { createAuthenticatedEvolutionModelClient } = createRequire(
   import.meta.url,
@@ -97,21 +101,25 @@ function captureHubTransport(llm, sdk) {
           const signal = options.signal
             ? AbortSignal.any([controller.signal, options.signal])
             : controller.signal;
-          const response = await fetchImpl(`${baseUrl}/api/chat`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            redirect: "error",
-            signal,
-            body: JSON.stringify({
-              model,
-              messages,
-              stream: false,
-              options: {
-                temperature: options.temperature ?? 0.2,
-                ...(options.numCtx ? { num_ctx: options.numCtx } : {}),
-              },
-            }),
-          });
+          const response = await providerFetch(
+            `${baseUrl}/api/chat`,
+            {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              redirect: "error",
+              signal,
+              body: JSON.stringify({
+                model,
+                messages,
+                stream: false,
+                options: {
+                  temperature: options.temperature ?? 0.2,
+                  ...(options.numCtx ? { num_ctx: options.numCtx } : {}),
+                },
+              }),
+            },
+            fetchImpl,
+          );
           if (!response.ok)
             throw new Error(
               `Hub Ollama request failed: HTTP ${response.status}`,
@@ -202,6 +210,7 @@ function captureHubTransport(llm, sdk) {
           );
       },
       async chat(messages, options) {
+        requireUnscopedModelTransport();
         const result = await chat(messages, options);
         const text =
           result?.content ??
@@ -233,7 +242,13 @@ function captureHubTransport(llm, sdk) {
       },
     };
   }
-  return { assertIdentity() {}, chat: llm.chat.bind(llm) };
+  return {
+    assertIdentity() {},
+    chat(messages, options) {
+      requireUnscopedModelTransport();
+      return llm.chat(messages, options);
+    },
+  };
 }
 
 // A scoped wrapper preserves the Hub's independent local/cloud consent check.

package/src/lib/evolution/governed-hub-resolver.js

@@ -1,4 +1,5 @@
 import { prepareGovernedModelTurn } from "./governed-model-turn.js";
+import { requireUnscopedModelTransport } from "../formal-budget-provider-scope.js";
 import {
   captureGovernedHubSdkPorts,
   createGovernedHubLlm,
@@ -48,6 +49,9 @@ function captureEmbeddingTransport(stage, sdk) {
         );
     },
     async embed(profile) {
+      // Neither arbitrary embedding callbacks nor the native embeddings
+      // protocol have a verified Chat billing contract in this scope.
+      requireUnscopedModelTransport();
       if (!defaultOllama) return await embed.call(stage, profile);
       // The raw SDK ollamaEmbed remains closed. This private transport is only
       // invoked below, after the scoped Run projected the profile.

package/src/lib/evolution/governed-skill-synthesis-process-grader.js

@@ -8,6 +8,7 @@ import executionBroker, {
   SANDBOX_BOUNDARIES,
 } from "../process-execution-broker/index.js";
 import { BUILT_IN_PROVIDERS } from "../llm-providers.js";
+import { requireUnscopedModelTransport } from "../formal-budget-provider-scope.js";
 
 export const GOVERNED_SKILL_SYNTHESIS_PROCESS_GRADER_SCHEMA =
   "chainlesschain.governed-skill-synthesis-process-grader/v2";
@@ -399,6 +400,9 @@ export function createGovernedSkillSynthesisProcessGrader(options = {}) {
     persistentProcessAuditRequired: true,
   });
   const port = async (messages) => {
+    // This worker owns a separate credential reference and cannot inherit an
+    // async-local authority. Refuse before provisioning or launching it.
+    requireUnscopedModelTransport();
     const current = executionSnapshot();
     if (!executionSnapshotMatches(current, snapshot)) {
       throw new Error(