chainlesschain 0.166.102 → 0.166.104

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.104",
+      "cliVersions": ["0.166.104"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.104: recover governed sessions safely",
+          "body": "- Verify Jev model usage starts and settlements before resuming a durable\n  session; stop further provider calls when usage or persistence is unresolved.\n- Bind session budget roots to verified JSONL for single-prompt, stream-json and\n  REPL entry points, retaining the original limits across resume.\n- Preserve UTF-8 in background, batch and SDK process streams; reject malformed\n  background frames and stale MCP tool catalogs before dispatch.\n- Publish Agent SDK 0.2.15 before this CLI release, then pair VS Code 0.37.149\n  and JetBrains 0.4.166 with CLI 0.166.104 after exact-commit gates and public\n  npm readback. Formal paid evaluation remains NOT_RUN."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.103",
+      "cliVersions": ["0.166.103"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.103: reject ungoverned formal budget exits",
+          "body": "- Keep formal paid evaluation closed while budgeted requests lack production\n  account, checkpoint and host isolation evidence.\n- Reject direct Agent tools, subprocess and worker launches, credential and\n  network paths when entered from the formal budget scope; propagate rejection\n  through parallel tool execution.\n- Bind the frozen all-Volcengine 36-task and 9-first-run plan to its exact\n  model, endpoint and shared historical $99 budget without counting diagnostic\n  calls as formal observations.\n- Pair VS Code 0.37.147 and JetBrains 0.4.165 with CLI 0.166.103 only after\n  the exact release commit passes its complete Actions gates and npm readback."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.102",

package/src/harness/mcp-client.js

@@ -744,6 +744,51 @@ function mcpTransportError(code, message, details = {}) {
   return error;
 }
 
+function pendingToolFailure(error, entry, method, dispatched) {
+  const httpStatus = safeRpcProperty(error, "status");
+  if (
+    method !== "tools/call" ||
+    !dispatched ||
+    isMcpRpcError(error) ||
+    safeRpcProperty(error, "outcomeUnknown") != null ||
+    (safeRpcProperty(error, "code") === "CC_MCP_HTTP_STATUS" &&
+      (httpStatus === 401 || httpStatus === 403 || httpStatus === 404))
+  ) {
+    return error;
+  }
+  const originalCode = safeRpcProperty(error, "code");
+  if (
+    typeof originalCode === "string" &&
+    originalCode.startsWith("CC_MCP_") &&
+    !isProxy(error) &&
+    error instanceof Error
+  ) {
+    try {
+      error.dispatched = true;
+      error.outcomeUnknown = true;
+      return error;
+    } catch {
+      // A frozen host error still needs a public uncertainty marker.
+    }
+  }
+  const message = safeRpcErrorText(error) || "MCP tool request failed";
+  return mcpTransportError(
+    typeof originalCode === "string" && originalCode.startsWith("CC_MCP_")
+      ? originalCode
+      : "CC_MCP_TOOL_OUTCOME_UNKNOWN",
+    `${message}; tool outcome is unknown and was not replayed`,
+    {
+      transport: entry?.transportKind,
+      url: entry?.config?.url,
+      status: httpStatus,
+      closeCode: safeRpcProperty(error, "closeCode"),
+      limitBytes: safeRpcProperty(error, "limitBytes"),
+      dispatched: true,
+      outcomeUnknown: true,
+    },
+  );
+}
+
 function dispatchMcpToolRequest(options, metadata, dispatch) {
   const admission = options?.dispatchAdmission ?? null;
   if (metadata.method !== "tools/call" || admission === null) {
@@ -916,8 +961,8 @@ function mcpInboundBudgetError(serverName, entry, budget) {
 function mcpJsonBudgetError(serverName, entry, budget) {
   const dispatched = Boolean(
     (entry?._pending instanceof Map && entry._pending.size > 0) ||
-    (entry?._httpRequestControllers instanceof Set &&
-      entry._httpRequestControllers.size > 0),
+      (entry?._httpRequestControllers instanceof Set &&
+        entry._httpRequestControllers.size > 0),
   );
   if (budget === "depth") {
     const limitDepth = mcpJsonDepthLimit(entry?.config?.maxJsonDepth);
@@ -956,6 +1001,15 @@ function mcpSseEventTimeoutError(timeoutMs) {
   return error;
 }
 
+function mcpSseHeaderTimeoutError(timeoutMs) {
+  const error = new Error(
+    `MCP HTTP message stream headers exceeded the ${timeoutMs}ms host deadline`,
+  );
+  error.code = "CC_MCP_SSE_HEADER_TIMEOUT";
+  error.timeoutMs = timeoutMs;
+  return error;
+}
+
 function mcpHttpResponseTimeoutError(
   serverName,
   entry,
@@ -999,6 +1053,7 @@ const MCP_NON_RETRYABLE_PROTOCOL_ERROR_CODES = new Set([
   "CC_MCP_HTTP_RESPONSE_TIMEOUT",
   "CC_MCP_HTTP_DISCARD_TIMEOUT",
   "CC_MCP_SSE_EVENT_TIMEOUT",
+  "CC_MCP_SSE_HEADER_TIMEOUT",
   "CC_MCP_INBOUND_RATE_EXCEEDED",
   "CC_MCP_INBOUND_TRAFFIC_EXCEEDED",
   "CC_MCP_JSON_DEPTH_EXCEEDED",
@@ -1009,6 +1064,8 @@ const MCP_NON_RETRYABLE_PROTOCOL_ERROR_CODES = new Set([
   "CC_MCP_RPC_ERROR_INVALID",
   "CC_MCP_RPC_RESPONSE_INVALID",
   "CC_MCP_RPC_MESSAGE_INVALID",
+  "CC_MCP_TOOL_CATALOG_STALE",
+  "CC_MCP_TOOL_NOT_ADVERTISED",
 ]);
 
 function isMcpNonRetryableProtocolError(error) {
@@ -1422,6 +1479,7 @@ export class MCPClient extends EventEmitter {
     this._toolMetadataBytes = 0;
     this._nextId = 1;
     this._reconnectors = new Map(); // name → async () => config|null
+    this._unknownOutcomeRecovery = new Set(); // reconnect only for future explicit calls
     this._reconnecting = new Map(); // name → in-flight reconnect promise
     // progressToken → reset-idle callback for in-flight tools/call requests.
     // Tokens are generated by this client and are removed on every terminal
@@ -2162,15 +2220,25 @@ export class MCPClient extends EventEmitter {
    * Register a reconnector for a server: an async function that returns a
    * FRESH connection config (or null when the server can't be found anymore).
    * When a `callTool` on that server fails with a connection-shaped error,
-   * the client re-resolves the config, reconnects, and retries the call once.
+   * the client re-resolves the config. An opt-in bridge may also reconnect
+   * after an unknown tool outcome, without replaying that call.
    *
    * Used by the IDE bridge: a window reload / extension update restarts the
    * editor's MCP server on a new port with a new token, so the original
    * config is permanently dead but a lockfile re-scan finds the new one.
    */
-  setReconnector(name, fn) {
-    if (typeof fn === "function") this._reconnectors.set(name, fn);
-    else this._reconnectors.delete(name);
+  setReconnector(name, fn, options = {}) {
+    if (typeof fn === "function") {
+      this._reconnectors.set(name, fn);
+      if (options.recoverUnknownOutcome === true) {
+        this._unknownOutcomeRecovery.add(name);
+      } else {
+        this._unknownOutcomeRecovery.delete(name);
+      }
+    } else {
+      this._reconnectors.delete(name);
+      this._unknownOutcomeRecovery.delete(name);
+    }
   }
 
   /** Return the opaque host authority used to resolve policy-bearing MCP cwd. */
@@ -3057,6 +3125,7 @@ export class MCPClient extends EventEmitter {
           this._replaceToolInventory(name, entry, toolsResult?.tools || []);
         } catch (err) {
           if (isMcpFatalDiscoveryError(err)) throw err;
+          entry._toolInventoryReady = true;
           if (advertisesTools) {
             toolsDiscoveryFailed = true;
             entry.toolsError = err?.message || String(err);
@@ -3464,6 +3533,7 @@ export class MCPClient extends EventEmitter {
       clientBytesUsed,
     });
     entry.tools = admitted.tools;
+    entry._toolInventoryReady = true;
     entry._toolMetadataBytes = admitted.metadataBytes;
     this._toolMetadataBytes = clientBytesUsed + admitted.metadataBytes;
     return entry.tools;
@@ -3525,9 +3595,9 @@ export class MCPClient extends EventEmitter {
    * Call a tool on a specific server. If the server has a registered
    * reconnector and the call fails with a connection-shaped error (server
    * restarted / token rotated / entry dropped), re-resolve the config,
-   * reconnect, and retry the call exactly once. HTTP 404 only reinitializes
-   * the connection: an already-dispatched tool has an unknown outcome and
-   * must never be retried automatically just because its session expired.
+   * reconnect, and retry a call only when its outcome is known not to have
+   * occurred. An already-dispatched tool with an unknown outcome may refresh
+   * the connection for a later explicit call, but is never replayed here.
    * @param {string} serverName - Server name
    * @param {string} toolName - Tool name
    * @param {object} args - Tool arguments
@@ -3589,7 +3659,28 @@ export class MCPClient extends EventEmitter {
         // Retry exactly once after every out-of-band flow reports completion.
         return this._callToolOnce(serverName, toolName, args, options);
       }
-      if (safeRpcProperty(err, "outcomeUnknown") === true) throw err;
+      if (safeRpcProperty(err, "outcomeUnknown") === true) {
+        if (
+          !options?.signal?.aborted &&
+          isLikelyConnectionError(err) &&
+          this._unknownOutcomeRecovery.has(serverName)
+        ) {
+          const current = this.servers.get(serverName);
+          const recovered =
+            current && current !== attemptedEntry
+              ? current.state === ServerState.CONNECTED
+              : await this._tryReconnect(serverName, {
+                  connectAuthRetryUsed: true,
+                  expectedEntry: attemptedEntry,
+                });
+          try {
+            err.connectionRecovered = Boolean(recovered);
+          } catch {
+            // A frozen error still retains its original unknown-outcome marker.
+          }
+        }
+        throw err;
+      }
       if (
         !this._reconnectors.has(serverName) &&
         !this.servers.get(serverName)?.config?.headersHelper
@@ -3704,6 +3795,23 @@ export class MCPClient extends EventEmitter {
     if (entry.state !== ServerState.CONNECTED) {
       throw new Error(`Server "${serverName}" is not connected`);
     }
+    if (entry._toolInventoryDirty) {
+      throw mcpTransportError(
+        "CC_MCP_TOOL_CATALOG_STALE",
+        `MCP tool catalog for server "${serverName}" is refreshing; retry after it settles`,
+        { transport: entry.transportKind, dispatched: false },
+      );
+    }
+    if (
+      entry._toolInventoryReady &&
+      !entry.tools.some((tool) => tool.name === toolName)
+    ) {
+      throw mcpTransportError(
+        "CC_MCP_TOOL_NOT_ADVERTISED",
+        `MCP tool "${toolName}" is not advertised by server "${serverName}"`,
+        { transport: entry.transportKind, dispatched: false },
+      );
+    }
 
     const timeoutMs = mcpToolIdleTimeoutMs(entry.config, options);
     const progressToken = `cc:${randomUUID()}`;
@@ -4137,7 +4245,8 @@ export class MCPClient extends EventEmitter {
       };
       const pending = {
         resolve: (value) => settle(resolve, value),
-        reject: (error) => settle(reject, error),
+        reject: (error) =>
+          settle(reject, pendingToolFailure(error, entry, method, dispatched)),
       };
       entry._pending.set(id, pending);
 
@@ -4184,7 +4293,7 @@ export class MCPClient extends EventEmitter {
       if (!longRunning && timeoutMs > 0) {
         timeout = setTimeout(() => {
           const timeoutError = new Error(`Request timeout: ${method}`);
-          if (!settle(reject, timeoutError)) return;
+          if (!pending.reject(timeoutError)) return;
           this._sendRequestCancellation(
             serverName,
             method,
@@ -4276,7 +4385,8 @@ export class MCPClient extends EventEmitter {
       };
       const pending = {
         resolve: (value) => settle(resolve, value),
-        reject: (error) => settle(reject, error),
+        reject: (error) =>
+          settle(reject, pendingToolFailure(error, entry, method, dispatched)),
       };
       entry._pending.set(id, pending);
 
@@ -4314,7 +4424,7 @@ export class MCPClient extends EventEmitter {
             `Request timeout: ${method} (WebSocket, no response in ${timeoutMs}ms)`,
             { transport: entry.transportKind, url: entry.config?.url },
           );
-          if (!settle(reject, timeoutError)) return;
+          if (!pending.reject(timeoutError)) return;
           this._sendRequestCancellation(
             serverName,
             method,
@@ -4472,7 +4582,10 @@ export class MCPClient extends EventEmitter {
                   ? { dispatcher: entry._httpDispatcher }
                   : {}),
               }),
-              stream.controller?.signal,
+              {
+                controller: stream.controller,
+                timeoutMs: _sseEventTimeout(entry.config?.requestTimeoutMs),
+              },
             );
             if (response.status === 405) {
               _cancelHttpResponseBody(response);
@@ -4547,6 +4660,7 @@ export class MCPClient extends EventEmitter {
               return;
             }
             if (error?.code === "CC_MCP_SSE_EVENT_TIMEOUT") return;
+            if (error?.code === "CC_MCP_SSE_HEADER_TIMEOUT") return;
             if (error?.code === "CC_MCP_INBOUND_RATE_EXCEEDED") return;
             if (error?.code === "CC_MCP_INBOUND_TRAFFIC_EXCEEDED") return;
             if (error?.code === "CC_MCP_JSON_DEPTH_EXCEEDED") return;
@@ -4853,10 +4967,15 @@ export class MCPClient extends EventEmitter {
         throwIfAborted();
       } catch (abortError) {
         settleLifecycle("failed-closed");
-        throw abortError;
+        throw pendingToolFailure(
+          abortError,
+          entry,
+          method,
+          request?.dispatched,
+        );
       }
       settleLifecycle("failed-closed");
-      throw err;
+      throw pendingToolFailure(err, entry, method, request?.dispatched);
     } finally {
       if (timer) clearTimeout(timer);
       if (responseTimer) clearTimeout(responseTimer);
@@ -5272,15 +5391,22 @@ export class MCPClient extends EventEmitter {
   async _refreshServerList(serverName, kind) {
     const entry = this.servers.get(serverName);
     if (!entry) return;
+    if (kind === "tools") {
+      entry._toolInventoryDirty = true;
+    }
     const flags = (entry._listRefresh = entry._listRefresh || {});
     if (flags[`${kind}Running`]) {
       flags[`${kind}Dirty`] = true;
       return;
     }
     flags[`${kind}Running`] = true;
+    let refreshed = false;
+    let toolCount = 0;
     try {
       do {
+        if (this.servers.get(serverName) !== entry) return;
         flags[`${kind}Dirty`] = false;
+        refreshed = false;
         try {
           const method =
             kind === "tools"
@@ -5289,6 +5415,10 @@ export class MCPClient extends EventEmitter {
                 ? "resources/templates/list"
                 : "resources/list";
           const result = await this._sendRequest(serverName, method, {});
+          // A reconnect can replace this entry while the old list request is
+          // pending. Never let its late result mutate the replacement's global
+          // metadata budget or publish a stale inventory event.
+          if (this.servers.get(serverName) !== entry) return;
           const list =
             (kind === "tools"
               ? result?.tools
@@ -5298,14 +5428,17 @@ export class MCPClient extends EventEmitter {
           if (kind === "tools") {
             this._replaceToolInventory(serverName, entry, list);
             entry.toolsError = null;
+            toolCount = list.length;
           } else {
             entry[kind] = list;
+            this.emit(`${kind}-changed`, {
+              server: serverName,
+              count: list.length,
+            });
           }
-          this.emit(`${kind}-changed`, {
-            server: serverName,
-            count: list.length,
-          });
+          refreshed = true;
         } catch (error) {
+          if (this.servers.get(serverName) !== entry) return;
           if (kind === "tools" && isMcpToolMetadataError(error)) {
             entry.toolsError = error.message;
             this.emit("server-error", {
@@ -5331,6 +5464,19 @@ export class MCPClient extends EventEmitter {
       } while (flags[`${kind}Dirty`]);
     } finally {
       flags[`${kind}Running`] = false;
+      if (
+        kind === "tools" &&
+        refreshed &&
+        this.servers.get(serverName) === entry
+      ) {
+        // Event listeners may call a newly advertised tool immediately.
+        entry._toolInventoryDirty = false;
+        try {
+          this.emit("tools-changed", { server: serverName, count: toolCount });
+        } catch {
+          // An observer cannot make a successfully refreshed catalog stale.
+        }
+      }
     }
   }
 
@@ -5601,9 +5747,12 @@ function _readHttpReaderChunk(reader, signal) {
   });
 }
 
-function _waitForHttpMessageStreamResponse(responsePromise, signal) {
-  if (!signal?.addEventListener) return Promise.resolve(responsePromise);
-  if (signal.aborted) {
+function _waitForHttpMessageStreamResponse(
+  responsePromise,
+  { controller, timeoutMs } = {},
+) {
+  const signal = controller?.signal;
+  if (signal?.aborted) {
     Promise.resolve(responsePromise).then(
       (response) => _cancelHttpResponseBody(response),
       () => {},
@@ -5613,7 +5762,11 @@ function _waitForHttpMessageStreamResponse(responsePromise, signal) {
   return new Promise((resolve, reject) => {
     let settled = false;
     let aborted = false;
-    const cleanup = () => signal.removeEventListener?.("abort", onAbort);
+    let timer;
+    const cleanup = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener?.("abort", onAbort);
+    };
     const finish = (settler, value) => {
       if (settled) return false;
       settled = true;
@@ -5625,7 +5778,15 @@ function _waitForHttpMessageStreamResponse(responsePromise, signal) {
       aborted = true;
       finish(reject, _httpReadAbortedError());
     };
-    signal.addEventListener("abort", onAbort, { once: true });
+    if (Number.isFinite(timeoutMs) && timeoutMs > 0) {
+      timer = setTimeout(() => {
+        aborted = true;
+        if (finish(reject, mcpSseHeaderTimeoutError(timeoutMs))) {
+          controller?.abort();
+        }
+      }, timeoutMs);
+    }
+    signal?.addEventListener?.("abort", onAbort, { once: true });
     Promise.resolve(responsePromise).then(
       (response) => {
         if (!finish(resolve, response) && aborted) {

package/src/harness/prompt-compressor.js

@@ -17,6 +17,7 @@ import {
 } from "../lib/read-file-page.js";
 import { feature, featureVariant } from "../lib/feature-flags.js";
 import { isAbortError } from "../lib/abort-utils.js";
+import { isFormalBudgetError } from "../lib/formal-budget-errors.js";
 import {
   CONTEXT_WINDOWS,
   getContextWindow,
@@ -680,6 +681,7 @@ export class PromptCompressor {
       // A durable-ledger write failure is authoritative too. Falling back here
       // would let the host continue after losing the model-call boundary.
       if (error?.runtimeLedgerPersistence === true) throw error;
+      if (isFormalBudgetError(error)) throw error;
       if (error?.code === "CC_AGENT_EVOLUTION_INGRESS_FAILED") throw error;
       // A workflow-bound query may already have reached the provider. An
       // extractive fallback would make the outer durable effect look completed

package/src/lib/advisor-runtime.js

@@ -9,6 +9,7 @@
 
 import { createHash, randomUUID } from "node:crypto";
 import { CostBudget } from "./cost-budget.js";
+import { isFormalBudgetError } from "./formal-budget-errors.js";
 import { FREE_PROVIDERS, mergePricing } from "./llm-pricing.js";
 import { redactSecrets } from "./secret-scan.js";
 import { firstBalancedJson } from "./json-schema-output.js";
@@ -179,8 +180,8 @@ export function resolveAdvisorConfig({
   );
   const hasManagedAdvisorPolicy = Boolean(
     Object.keys(managedAdvisor).length > 0 ||
-    managed?.advisorAllowedProviders !== undefined ||
-    managed?.advisorAllowedModels !== undefined,
+      managed?.advisorAllowedProviders !== undefined ||
+      managed?.advisorAllowedModels !== undefined,
   );
   let policyReason = null;
   if (managedAdvisor.enabled === false) {
@@ -937,6 +938,7 @@ export class AdvisorRuntime {
       };
     } catch (error) {
       if (error?.runtimeLedgerPersistence === true) throw error;
+      if (isFormalBudgetError(error)) throw error;
       if (error?.code === "CC_AGENT_EVOLUTION_INGRESS_FAILED") throw error;
       const failure = {
         callId,

package/src/lib/agent-ipc-bus.js

@@ -13,6 +13,7 @@ import { EventEmitter } from "node:events";
 import crypto from "node:crypto";
 import { EventRuntimeProducer } from "./event-runtime-producer.js";
 import { EventRuntimeStore } from "./event-runtime-store.js";
+import { requireUnscopedDescendantControl } from "./formal-budget-provider-scope.js";
 import executionBroker from "./process-execution-broker/index.js";
 import {
   AGENT_IPC_DEFAULT_LIMITS,
@@ -284,6 +285,7 @@ class AgentIPCBus extends EventEmitter {
    * @returns {Promise<{process: ChildProcess, agentId: string}>}
    */
   async spawnAgentProcess(command, args = [], options = {}) {
+    requireUnscopedDescendantControl();
     const agentId = options.agentId || crypto.randomUUID();
     if (
       this._childTransports.has(agentId) ||

package/src/lib/background-agent-keeper-client.js

@@ -1,6 +1,7 @@
 import net from "node:net";
 import { randomBytes } from "node:crypto";
 import { createNdjsonReader } from "./background-session-transport.js";
+import { requireUnscopedDescendantControl } from "./formal-budget-provider-scope.js";
 import {
   BACKGROUND_AGENT_KEEPER_ARM,
   BACKGROUND_AGENT_KEEPER_ARMED,
@@ -67,6 +68,7 @@ async function connectWithDeadline(pipePath, timeoutMs) {
 }
 
 export async function connectBackgroundAgentKeeper(options = {}) {
+  requireUnscopedDescendantControl();
   const hello = normalizeBackgroundAgentKeeperHello(options);
   const connectTimeoutMs = Math.max(
     1,
@@ -234,6 +236,7 @@ export async function connectBackgroundAgentKeeper(options = {}) {
 
   return Object.freeze({
     async arm(turn) {
+      requireUnscopedDescendantControl();
       const normalized = normalizeBackgroundAgentKeeperTurn(turn);
       if (activeTurn) {
         throw keeperError(

package/src/lib/background-session-transport.js

@@ -50,17 +50,28 @@ export function transportPipePath(id, dir, options = {}) {
  */
 export function createNdjsonReader(onMessage, onError = () => {}) {
   let carry = "";
+  let droppingOversizedLine = false;
+  const decoder = new TextDecoder("utf-8");
   return (chunk) => {
-    carry += chunk.toString("utf8");
-    if (carry.length > MAX_LINE_BYTES) {
-      carry = "";
-      onError(new Error("line too long"));
-      return;
+    let text =
+      typeof chunk === "string"
+        ? chunk
+        : decoder.decode(chunk, { stream: true });
+    if (droppingOversizedLine) {
+      const end = text.indexOf("\n");
+      if (end < 0) return;
+      droppingOversizedLine = false;
+      text = text.slice(end + 1);
     }
+    carry += text;
     let index;
     while ((index = carry.indexOf("\n")) !== -1) {
       const line = carry.slice(0, index).replace(/\r$/, "");
       carry = carry.slice(index + 1);
+      if (Buffer.byteLength(line, "utf8") > MAX_LINE_BYTES) {
+        onError(new Error("line too long"));
+        continue;
+      }
       if (!line.trim()) continue;
       let message;
       try {
@@ -71,6 +82,11 @@ export function createNdjsonReader(onMessage, onError = () => {}) {
       }
       onMessage(message);
     }
+    if (Buffer.byteLength(carry, "utf8") > MAX_LINE_BYTES) {
+      carry = "";
+      droppingOversizedLine = true;
+      onError(new Error("line too long"));
+    }
   };
 }
 

package/src/lib/browser-automation.js

@@ -3,10 +3,13 @@
  * Uses built-in fetch for basic operations, optional playwright for screenshots.
  */
 
+import { requireUnscopedExternalToolAccess } from "./formal-budget-provider-scope.js";
+
 /**
  * Fetch a URL and return the raw HTML.
  */
 export async function fetchPage(url, options = {}) {
+  requireUnscopedExternalToolAccess();
   const timeout = options.timeout || 30000;
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeout);
@@ -179,6 +182,7 @@ export function extractLinks(html, baseUrl) {
  * Returns null if playwright is not installed.
  */
 export async function takeScreenshot(url, outputPath, options = {}) {
+  requireUnscopedExternalToolAccess();
   try {
     const { chromium } = await import("playwright");
     const browser = await chromium.launch({ headless: true });

package/src/lib/cc-android-bridge.js

@@ -32,6 +32,7 @@
 
 import { readFileSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
+import { requireUnscopedExternalToolAccess } from "./formal-budget-provider-scope.js";
 
 const ANDROID_PREFIX = "/data/data/com.chainlesschain.android/";
 
@@ -72,6 +73,7 @@ function resolveBridgeConfigDir() {
  * (server not started yet, or running off-device without override).
  */
 export function loadBridgeConfig() {
+  requireUnscopedExternalToolAccess();
   const dir = resolveBridgeConfigDir();
   if (!dir) return null;
   try {
@@ -109,6 +111,7 @@ export class AndroidBridgeUnavailableError extends Error {
  *  - Method name unknown (server returns {"error": "UNKNOWN_METHOD"})
  */
 export async function invoke(method, params = {}) {
+  requireUnscopedExternalToolAccess();
   if (typeof method !== "string" || method.length === 0) {
     throw new TypeError(
       "cc-android-bridge.invoke: method must be non-empty string",
@@ -170,6 +173,7 @@ export async function invoke(method, params = {}) {
  * Returns `{ available: boolean, reason?: string, port?: number }`.
  */
 export function caps() {
+  requireUnscopedExternalToolAccess();
   if (process.env.CC_ANDROID_BRIDGE_OVERRIDE === "1") {
     return { available: true, reason: "test-override" };
   }