chainlesschain 0.166.102 → 0.166.104

package/src/lib/chat-core.js

@@ -1,3 +1,4 @@
+import { providerFetch } from "./formal-budget-provider-scope.js";
 /**
  * Chat Core — transport-independent streaming chat logic
  *
@@ -21,6 +22,7 @@ import {
   waitForStreamRetry,
 } from "./stream-retry.js";
 import { throwIfAborted } from "./abort-utils.js";
+import { isFormalBudgetError } from "./formal-budget-errors.js";
 
 // A streaming chat call must not hang forever if the API accepts the connection
 // but then goes silent (TCP up, no bytes). Abort the request if no data arrives
@@ -132,7 +134,7 @@ export async function streamOllama(
   guard.bump();
   let response;
   try {
-    response = await fetch(`${baseUrl}/api/chat`, {
+    response = await providerFetch(`${baseUrl}/api/chat`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -146,7 +148,7 @@ export async function streamOllama(
     });
   } catch (e) {
     guard.stop();
-    throw guard.stalled()
+    throw guard.stalled() && !isFormalBudgetError(e)
       ? new Error(
           `Ollama request stalled (no response in ${STREAM_STALL_MS / 1000}s)`,
         )
@@ -213,7 +215,7 @@ export async function streamOllama(
     }
   } catch (e) {
     throw attachStreamRetryMetadata(
-      guard.stalled()
+      guard.stalled() && !isFormalBudgetError(e)
         ? new Error(
             `Ollama stream stalled (no data in ${STREAM_STALL_MS / 1000}s)`,
           )
@@ -247,7 +249,7 @@ export async function streamOpenAI(
   guard.bump();
   let response;
   try {
-    response = await fetch(`${baseUrl}/chat/completions`, {
+    response = await providerFetch(`${baseUrl}/chat/completions`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -267,7 +269,7 @@ export async function streamOpenAI(
     });
   } catch (e) {
     guard.stop();
-    throw guard.stalled()
+    throw guard.stalled() && !isFormalBudgetError(e)
       ? new Error(
           `API request stalled (no response in ${STREAM_STALL_MS / 1000}s)`,
         )
@@ -344,7 +346,7 @@ export async function streamOpenAI(
     }
   } catch (e) {
     throw attachStreamRetryMetadata(
-      guard.stalled()
+      guard.stalled() && !isFormalBudgetError(e)
         ? new Error(
             `API stream stalled (no data in ${STREAM_STALL_MS / 1000}s)`,
           )
@@ -392,7 +394,7 @@ export async function streamAnthropic(
   guard.bump();
   let response;
   try {
-    response = await fetch(`${baseUrl}/messages`, {
+    response = await providerFetch(`${baseUrl}/messages`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -412,7 +414,7 @@ export async function streamAnthropic(
     });
   } catch (e) {
     guard.stop();
-    throw guard.stalled()
+    throw guard.stalled() && !isFormalBudgetError(e)
       ? new Error(
           `Anthropic request stalled (no response in ${STREAM_STALL_MS / 1000}s)`,
         )
@@ -486,7 +488,7 @@ export async function streamAnthropic(
     }
   } catch (e) {
     throw attachStreamRetryMetadata(
-      guard.stalled()
+      guard.stalled() && !isFormalBudgetError(e)
         ? new Error(
             `Anthropic stream stalled (no data in ${STREAM_STALL_MS / 1000}s)`,
           )

package/src/lib/cloud/cloud-client.js

@@ -28,6 +28,7 @@ import {
 import { join } from "node:path";
 import { getHomeDir } from "../paths.js";
 import { ResilientGatewayClient } from "../gateway-client-resilience.js";
+import { requireUnscopedDescendantControl } from "../formal-budget-provider-scope.js";
 
 export const _deps = { fetch: (...a) => globalThis.fetch(...a) };
 
@@ -78,6 +79,7 @@ export class CloudClient {
    * @param {object} opts { baseUrl, token, deps? }
    */
   constructor(opts = {}) {
+    requireUnscopedDescendantControl();
     this.baseUrl = String(opts.baseUrl || "").replace(/\/+$/, "");
     if (!this.baseUrl) {
       throw new Error(
@@ -109,6 +111,7 @@ export class CloudClient {
   }
 
   async _json(method, path, body) {
+    requireUnscopedDescendantControl();
     const res = await this.deps.fetch(`${this.baseUrl}${path}`, {
       method,
       headers: this._headers(),
@@ -121,7 +124,9 @@ export class CloudClient {
   }
 
   /** Submit a job. `bundle` is a base64 git bundle of the branch. */
-  async submit({ task, bundle, branch, baseSha }) {
+  async submit(payload) {
+    requireUnscopedDescendantControl();
+    const { task, bundle, branch, baseSha } = payload;
     const data = await this._json("POST", "/v1/jobs", {
       task,
       bundle,
@@ -133,10 +138,12 @@ export class CloudClient {
   }
 
   async status(jobId) {
+    requireUnscopedDescendantControl();
     return this._json("GET", `/v1/jobs/${encodeURIComponent(jobId)}`);
   }
 
   async result(jobId) {
+    requireUnscopedDescendantControl();
     return this._json("GET", `/v1/jobs/${encodeURIComponent(jobId)}/result`);
   }
 
@@ -146,6 +153,7 @@ export class CloudClient {
    * runners remain compatible with status()/result().
    */
   async events(jobId, options = {}) {
+    requireUnscopedDescendantControl();
     if (!/^[\w.-]+$/.test(String(jobId || ""))) {
       throw new Error(`invalid job id: ${jobId}`);
     }
@@ -175,6 +183,7 @@ export const TERMINAL_CLOUD_STATUS = new Set(["done", "failed"]);
  * `sleep`/`now` injected for tests.
  */
 export async function pollUntilDone(client, jobId, opts = {}) {
+  requireUnscopedDescendantControl();
   const intervalMs = opts.intervalMs ?? 3000;
   const timeoutMs = opts.timeoutMs ?? 30 * 60_000;
   const sleep = opts.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));

package/src/lib/cowork-adapter.js

@@ -7,6 +7,7 @@
  *  - Module initialization helper
  */
 
+import { providerFetch } from "./formal-budget-provider-scope.js";
 import { LLMProviderRegistry, BUILT_IN_PROVIDERS } from "./llm-providers.js";
 import { loadConfig } from "./config-manager.js";
 import { applyConfigLlmDefaults } from "./llm-config-defaults.js";
@@ -174,7 +175,7 @@ export function createChatFn(options = {}) {
         currentModel,
         async ({ signal = opts.signal || resolved.signal } = {}) => {
           const modelMessages = await prepareMessages();
-          const res = await fetch(`${baseUrl}/api/chat`, {
+          const res = await providerFetch(`${baseUrl}/api/chat`, {
             method: "POST",
             signal: requestSignal(signal),
             headers: { "Content-Type": "application/json" },
@@ -214,7 +215,7 @@ export function createChatFn(options = {}) {
               ? { system: systemMsgs.map((m) => m.content).join("\n") }
               : {}),
           };
-          const res = await fetch(`${baseUrl}/messages`, {
+          const res = await providerFetch(`${baseUrl}/messages`, {
             method: "POST",
             signal: requestSignal(signal),
             headers: {
@@ -245,7 +246,7 @@ export function createChatFn(options = {}) {
       currentModel,
       async ({ signal = opts.signal || resolved.signal } = {}) => {
         const modelMessages = await prepareMessages();
-        const res = await fetch(`${baseUrl}/chat/completions`, {
+        const res = await providerFetch(`${baseUrl}/chat/completions`, {
           method: "POST",
           signal: requestSignal(signal),
           headers: {

package/src/lib/decision-layer/providers.js

@@ -1,4 +1,5 @@
 import { openDecisionProviderAuthority } from "./provider-authority.js";
+import { providerFetch } from "../formal-budget-provider-scope.js";
 
 const PROVIDERS = Object.freeze({
   typesafe: {
@@ -195,18 +196,22 @@ export function createDecisionProvider({
       if (Buffer.byteLength(body, "utf8") > MAX_DECISION_REQUEST_BYTES) {
         throw bodyTooLarge("request", MAX_DECISION_REQUEST_BYTES);
       }
-      const response = await fetchImpl(endpoint, {
-        method: "POST",
-        headers: {
-          ...(secret === undefined
-            ? {}
-            : { authorization: `Bearer ${secret}` }),
-          "content-type": "application/json",
+      const response = await providerFetch(
+        endpoint,
+        {
+          method: "POST",
+          headers: {
+            ...(secret === undefined
+              ? {}
+              : { authorization: `Bearer ${secret}` }),
+            "content-type": "application/json",
+          },
+          body,
+          signal,
+          redirect: "error",
         },
-        body,
-        signal,
-        redirect: "error",
-      });
+        fetchImpl,
+      );
       if (!response?.ok) {
         throw providerError(response?.status ?? 0, options.provider);
       }

package/src/lib/decision-layer/runtime.js

@@ -12,12 +12,17 @@ import {
   SKILL_DECISION_OBSERVATION_SCHEMA,
 } from "./contracts.js";
 import { captureDecisionProviderAuthority } from "./provider-authority.js";
+import {
+  AGENT_EVOLUTION_INGRESS_FAILED_CODE,
+  captureAgentEvolutionIngress,
+} from "../evolution/agent-evolution-ingress.js";
 
 export const SKILL_DECISION_RUNTIME_SCHEMA =
   "chainlesschain.skill-decision-runtime/v1";
 
 const RUNTIMES = new WeakSet();
 const DEFAULT_TIMEOUT_MS = 800;
+const DEFAULT_BOUNDARY_TIMEOUT_MS = 30_000;
 
 function requiredText(value, label, maximum = 256) {
   if (
@@ -36,6 +41,53 @@ function timeoutSignal(signal, timeoutMs) {
   return signal ? AbortSignal.any([signal, deadline]) : deadline;
 }
 
+function settleBeforeAbort(value, signal) {
+  const pending = Promise.resolve(value);
+  if (!signal) return pending;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (settle, result) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", onAbort);
+      settle(result);
+    };
+    const onAbort = () => finish(reject, signal.reason);
+    pending.then(
+      (result) => finish(resolve, result),
+      (error) => finish(reject, error),
+    );
+    if (signal.aborted) {
+      onAbort();
+      return;
+    }
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+async function waitForGovernedPhase(value, signal, timeoutMs, onTimeout) {
+  const phaseSignal = timeoutSignal(signal, timeoutMs);
+  try {
+    return await settleBeforeAbort(value, phaseSignal);
+  } catch (error) {
+    if (signal?.aborted) throw signal.reason;
+    if (
+      phaseSignal.aborted &&
+      phaseSignal.reason === error &&
+      error?.name === "TimeoutError"
+    ) {
+      throw onTimeout(error);
+    }
+    throw error;
+  }
+}
+
+function admissionTimeoutError(cause) {
+  const error = new Error("Skill decision admission timed out", { cause });
+  error.code = AGENT_EVOLUTION_INGRESS_FAILED_CODE;
+  return error;
+}
+
 function projectUnavailable(error) {
   if (error?.name === "TimeoutError") return "provider-timeout";
   if (error?.code === "CC_DECISION_USAGE_UNKNOWN_BLOCKED") {
@@ -66,7 +118,7 @@ function asPersistenceError(error) {
     return markRuntimeLedgerPersistenceError(error);
   } catch {
     return markRuntimeLedgerPersistenceError(
-      new Error("decision observation persistence failed", { cause: error }),
+      new Error("decision persistence failed", { cause: error }),
     );
   }
 }
@@ -76,12 +128,14 @@ export function createSkillDecisionRuntime({
   tenantId = null,
   sessionId = null,
   provider = null,
+  evolutionIngress = null,
   persist = null,
   observe = null,
   sessionBudget = null,
   initialUsageUnknown = false,
   thresholds = {},
   timeoutMs = DEFAULT_TIMEOUT_MS,
+  boundaryTimeoutMs = DEFAULT_BOUNDARY_TIMEOUT_MS,
   idGenerator = () => randomUUID(),
   now = () => new Date(),
 } = {}) {
@@ -95,17 +149,36 @@ export function createSkillDecisionRuntime({
       "decision timeout must be an integer from 50 to 30000 ms",
     );
   }
+  if (
+    !Number.isSafeInteger(boundaryTimeoutMs) ||
+    boundaryTimeoutMs < 50 ||
+    boundaryTimeoutMs > 30_000
+  ) {
+    throw new TypeError(
+      "decision boundary timeout must be an integer from 50 to 30000 ms",
+    );
+  }
   if (typeof idGenerator !== "function" || typeof now !== "function") {
     throw new TypeError("decision runtime generators must be functions");
   }
   let providerAuthority = null;
   let boundTenantId = null;
   let boundSessionId = null;
+  let ingress = null;
   let unknownUsageSeen = initialUsageUnknown === true;
+  const unsettledUsageCalls = new Set();
+  let usageCallInFlight = false;
+  let usagePersistenceFailure = null;
+  let observationPersistenceFailure = null;
   if (normalizedMode !== "off") {
     providerAuthority = captureDecisionProviderAuthority(provider);
     boundTenantId = requiredText(tenantId, "tenantId");
     boundSessionId = requiredText(sessionId, "sessionId");
+    if (evolutionIngress !== null) {
+      ingress = captureAgentEvolutionIngress(evolutionIngress, {
+        tenantId: boundTenantId,
+      });
+    }
     if (typeof persist !== "function" || typeof observe !== "function") {
       throw new TypeError(
         "enabled decision runtime requires usage and observation persistence",
@@ -118,13 +191,33 @@ export function createSkillDecisionRuntime({
     try {
       await observe(observation);
     } catch (error) {
-      throw asPersistenceError(error);
+      observationPersistenceFailure ??= asPersistenceError(error);
+      throw observationPersistenceFailure;
     }
   };
 
   const persistDecisionUsage = async (type, event) => {
-    await persist(type, event);
-    if (type === "model_usage_unknown") unknownUsageSeen = true;
+    if (usagePersistenceFailure !== null) throw usagePersistenceFailure;
+    try {
+      await waitForGovernedPhase(
+        persist(type, event),
+        null,
+        boundaryTimeoutMs,
+        (cause) =>
+          new Error("Skill decision usage persistence timed out", { cause }),
+      );
+    } catch (error) {
+      usagePersistenceFailure ??= asPersistenceError(error);
+      throw usagePersistenceFailure;
+    }
+    if (type === "model_usage_started") {
+      unsettledUsageCalls.add(event.callId);
+    } else if (type === "model_usage_unknown") {
+      unknownUsageSeen = true;
+      unsettledUsageCalls.delete(event.callId);
+    } else if (type === "token_usage") {
+      unsettledUsageCalls.delete(event.callId);
+    }
   };
 
   const runtime = Object.freeze({
@@ -148,6 +241,10 @@ export function createSkillDecisionRuntime({
         });
       }
       if (signal?.aborted) throw signal.reason;
+      if (usagePersistenceFailure !== null) throw usagePersistenceFailure;
+      if (observationPersistenceFailure !== null) {
+        throw observationPersistenceFailure;
+      }
       const decisionId = `skill-${requiredText(idGenerator(), "decisionId")}`;
       const request = createSkillDecisionRequest({
         decisionId,
@@ -167,11 +264,41 @@ export function createSkillDecisionRuntime({
       }
       let outcome;
       let requestSignal = null;
-      if (unknownUsageSeen) {
+      let admissionReceipt = null;
+      if (unknownUsageSeen || unsettledUsageCalls.size > 0) {
         outcome = unavailableOutcome("provider-usage-unknown-blocked");
       } else {
         try {
-          const { result: raw, settlement } = await runMeteredDirectModelCall({
+          // Admission is not provider work: a refusal must not create an
+          // unknown-charge ledger row or consume the provider's budget turn.
+          const admission =
+            ingress === null
+              ? null
+              : await waitForGovernedPhase(
+                  ingress.prepareSkillDecisionRequest(request),
+                  signal,
+                  boundaryTimeoutMs,
+                  admissionTimeoutError,
+                );
+          signal?.throwIfAborted();
+          admissionReceipt = admission?.receipt ?? null;
+          // Keep local content identities out of the provider capability. Only
+          // the authenticated projection is available for governed dispatch.
+          const providerRequest =
+            admission === null
+              ? request
+              : Object.freeze({ payload: admission.payload });
+          if (
+            unknownUsageSeen ||
+            unsettledUsageCalls.size > 0 ||
+            usageCallInFlight
+          ) {
+            const error = new Error("decision usage recovery is required");
+            error.code = "CC_DECISION_USAGE_UNKNOWN_BLOCKED";
+            throw error;
+          }
+          usageCallInFlight = true;
+          const meteredCall = runMeteredDirectModelCall({
             sessionId: boundSessionId,
             persist: persistDecisionUsage,
             provider: providerAuthority.provider,
@@ -180,18 +307,36 @@ export function createSkillDecisionRuntime({
             operationId: `decision:${decisionId}`,
             sessionBudget,
             includeSettlement: true,
+            dispatchSignal: signal ?? null,
             call: () => {
               if (unknownUsageSeen) {
                 const error = new Error("decision usage recovery is required");
                 error.code = "CC_DECISION_USAGE_UNKNOWN_BLOCKED";
                 throw error;
               }
+              // timeoutMs remains the provider-call deadline. Admission uses
+              // its own authority lifecycle and checks caller cancellation.
               requestSignal = timeoutSignal(signal, timeoutMs);
-              return providerAuthority.decide(request, {
-                signal: requestSignal,
-              });
+              requestSignal.throwIfAborted();
+              return settleBeforeAbort(
+                providerAuthority.decide(providerRequest, {
+                  signal: requestSignal,
+                }),
+                requestSignal,
+              );
             },
           });
+          let meteredResult;
+          try {
+            meteredResult = await meteredCall;
+          } finally {
+            usageCallInFlight = false;
+          }
+          const { result: raw, settlement } = meteredResult;
+          // A provider may resolve successfully after ignoring cancellation or
+          // its deadline. Usage is settled above; the late answer is unusable.
+          signal?.throwIfAborted();
+          requestSignal?.throwIfAborted();
           if (settlement !== "known") {
             // The metered call already persisted model_usage_unknown. Without a
             // budget root it may return the answer; never expose that answer.
@@ -254,6 +399,7 @@ export function createSkillDecisionRuntime({
         reasonCode: outcome.reasonCode,
         selectedDigest: outcome.selectedDigest,
         resultDigest: outcome.resultDigest,
+        ...(admissionReceipt === null ? {} : { admissionReceipt }),
         startedAt: startedAt.toISOString(),
         finishedAt: finishedAt.toISOString(),
         latencyMs: Math.max(0, finishedAt.getTime() - startedAt.getTime()),
@@ -265,7 +411,31 @@ export function createSkillDecisionRuntime({
           observationCore,
         ),
       });
-      await writeObservation(observation);
+      try {
+        await waitForGovernedPhase(
+          writeObservation(observation),
+          signal,
+          boundaryTimeoutMs,
+          (cause) =>
+            asPersistenceError(
+              new Error("Skill decision observation timed out", { cause }),
+            ),
+        );
+      } catch (error) {
+        if (error?.runtimeLedgerPersistence === true) {
+          observationPersistenceFailure ??= error;
+        } else if (signal?.aborted) {
+          // The caller stops waiting before the durable observer acknowledges
+          // the write. Its eventual outcome is unknown to this runtime.
+          observationPersistenceFailure ??= asPersistenceError(
+            new Error("Skill decision observation completion is unknown", {
+              cause: error,
+            }),
+          );
+        }
+        throw error;
+      }
+      signal?.throwIfAborted();
       return Object.freeze({
         schema: SKILL_DECISION_OBSERVATION_SCHEMA,
         decisionId,

package/src/lib/direct-model-usage.js

@@ -54,6 +54,8 @@ function unknownUsageEvent({
  * Meter one direct provider call that runs outside agentLoop. The started row is
  * durable before the callback resumes into provider work; every outcome then
  * settles known or unknown without persisting prompts, responses, or errors.
+ * A dispatch signal closes an acknowledged, canceled pre-dispatch intent with
+ * locally proven zero usage; cancellation after dispatch remains unknown.
  * Opt-in includeSettlement returns that persisted status with the raw result.
  */
 export async function runMeteredDirectModelCall({
@@ -65,11 +67,20 @@ export async function runMeteredDirectModelCall({
   operationId = undefined,
   sessionBudget = null,
   includeSettlement = false,
+  dispatchSignal = null,
   call,
 }) {
   if (typeof call !== "function") {
     throw new TypeError("metered direct model call requires a callback");
   }
+  if (
+    dispatchSignal !== null &&
+    (typeof dispatchSignal.aborted !== "boolean" ||
+      typeof dispatchSignal.throwIfAborted !== "function")
+  ) {
+    throw new TypeError("metered direct model dispatch signal is invalid");
+  }
+  dispatchSignal?.throwIfAborted();
   const callId = `direct-${randomUUID()}`;
   if (typeof sessionBudget?.consumeTurn === "function") {
     const admission = sessionBudget.consumeTurn({ id: callId });
@@ -84,6 +95,7 @@ export async function runMeteredDirectModelCall({
     if (includeSettlement) {
       throw new TypeError("direct model settlement requires a session");
     }
+    dispatchSignal?.throwIfAborted();
     return call();
   }
   if (typeof persist !== "function") {
@@ -102,6 +114,28 @@ export async function runMeteredDirectModelCall({
     { callId, provider, model, source, operationId },
     `direct model call ${source}`,
   );
+  if (dispatchSignal?.aborted) {
+    // A durable intent exists, but no provider callback has run. Close it as
+    // a locally proven zero-charge call instead of inventing unknown usage.
+    const notDispatched = {
+      ...projectRuntimeTokenUsage({
+        callId,
+        provider,
+        model,
+        source,
+        operationId,
+        usage: { input_tokens: 0, output_tokens: 0 },
+      }),
+      settlementOrigin: "local-no-dispatch",
+    };
+    await persistUsageEvent(persist, "token_usage", notDispatched);
+    recordSessionBudgetUsage(
+      sessionBudget,
+      { callId, usage: null },
+      `direct model call ${source} canceled before dispatch`,
+    );
+    throw dispatchSignal.reason;
+  }
   let result;
   let settlement = "unknown";
   const returnSettled = (status) =>