chainlesschain 0.166.102 → 0.166.104

package/src/lib/model-failure-policy.js

@@ -1,4 +1,5 @@
 import { isAbortError } from "./abort-utils.js";
+import { isFormalBudgetError } from "./formal-budget-errors.js";
 
 export function isEvolutionIngressFailure(error) {
   const visited = new Set();
@@ -21,6 +22,7 @@ export function isTerminalModelFailure(error) {
       current.code === "CC_AGENT_EVOLUTION_INGRESS_FAILED" ||
       current.runtimeLedgerPersistence === true ||
       current.workflowEffectOutcomeUnknown === true ||
+      isFormalBudgetError(current) ||
       /^(?:CC|ERR)_SESSION_BUDGET_/u.test(current.code || "") ||
       isAbortError(current)
     ) {

package/src/lib/plugin-runtime/marketplace-network.js

@@ -3,6 +3,10 @@ import fs from "node:fs";
 import tls from "node:tls";
 import { Worker } from "node:worker_threads";
 import { Agent, ProxyAgent, fetch as undiciFetch } from "undici";
+import {
+  requireUnscopedDescendantControl,
+  requireUnscopedExternalToolAccess,
+} from "../formal-budget-provider-scope.js";
 
 export const MAX_MARKETPLACE_CA_BUNDLE_BYTES = 1024 * 1024;
 export const MAX_MARKETPLACE_PROXY_URL_LENGTH = 4096;
@@ -15,6 +19,7 @@ export const DEFAULT_MARKETPLACE_PAC_TIMEOUT_MS = 2_000;
  * deliberately ignored: callers pass CLI flags or CC_PLUGIN_REGISTRY_* values.
  */
 export function createMarketplaceNetworkTransport(options = {}) {
+  requireUnscopedExternalToolAccess();
   const proxy = normalizeProxyUrl(options.proxyUrl);
   const pac = options.pacFile ? readMarketplacePacFile(options.pacFile) : null;
   if (proxy && pac) {
@@ -49,6 +54,7 @@ export function createMarketplaceNetworkTransport(options = {}) {
 
   return {
     fetch: async (url, fetchOptions = {}) => {
+      requireUnscopedExternalToolAccess();
       const route = pac
         ? parsePacResult(
             await resolveMarketplacePac(pac.script, url, {
@@ -99,11 +105,9 @@ export function readMarketplacePacFile(file) {
   };
 }
 
-export function resolveMarketplacePac(
-  script,
-  url,
-  { timeoutMs = DEFAULT_MARKETPLACE_PAC_TIMEOUT_MS } = {},
-) {
+export function resolveMarketplacePac(script, url, options = {}) {
+  requireUnscopedDescendantControl();
+  const { timeoutMs = DEFAULT_MARKETPLACE_PAC_TIMEOUT_MS } = options;
   const timeout = Number(timeoutMs);
   if (!Number.isInteger(timeout) || timeout < 100 || timeout > 10_000) {
     throw new Error("Marketplace PAC timeout must be between 100 and 10000 ms");

package/src/lib/process-execution-broker/credential-agent.js

@@ -14,6 +14,7 @@
 
 import crypto from "node:crypto";
 import { CredentialTransport } from "./credential-transport.js";
+import { requireUnscopedDescendantControl } from "../formal-budget-provider-scope.js";
 
 const REDACTED_VALUE = "***REDACTED***";
 const DEFAULT_TTL_MS = 60_000;
@@ -644,6 +645,7 @@ class CredentialAgent {
    * self-asserted approval metadata.
    */
   issueCredentialRef(request = {}) {
+    requireUnscopedDescendantControl();
     if (!this.isEnabled()) {
       this._recordAudit({
         event: "credential_ref_issue",
@@ -842,6 +844,7 @@ class CredentialAgent {
    * request object; child-provided claims are not sufficient attestation.
    */
   resolveCredentialRef(refId, request = {}) {
+    requireUnscopedDescendantControl();
     const refFingerprint = this._fingerprint(refId);
     if (!this.isEnabled()) {
       this._recordAudit({
@@ -1002,8 +1005,8 @@ class CredentialAgent {
   _canIssueForContext(context) {
     return Boolean(
       context?.approved === true &&
-      context.approvalId &&
-      normalizeProcessTarget(context.target?.process ?? context.process),
+        context.approvalId &&
+        normalizeProcessTarget(context.target?.process ?? context.process),
     );
   }
 
@@ -1025,6 +1028,7 @@ class CredentialAgent {
    * Strip sensitive and reserved environment variables from spawn options.
    */
   filterEnvironment(env = process.env, context = null) {
+    requireUnscopedDescendantControl();
     const safeEnv = {};
     const redacted = [];
     const reservedRemoved = [];
@@ -1232,6 +1236,7 @@ class CredentialAgent {
    * Apply filtering and issue references for a broker-approved spawn.
    */
   applyWithReport(spawnOptions) {
+    requireUnscopedDescendantControl();
     if (!spawnOptions || typeof spawnOptions !== "object") {
       throw credentialError(
         CREDENTIAL_ERROR_CODES.INVALID_REQUEST,

package/src/lib/process-execution-broker/credential-transport.js

@@ -10,6 +10,7 @@ import net from "node:net";
 import os from "node:os";
 import path from "node:path";
 import { Worker } from "node:worker_threads";
+import { requireUnscopedDescendantControl } from "../formal-budget-provider-scope.js";
 
 const TRANSPORT_VERSION = "local-ipc-v1";
 const DEFAULT_TIMEOUT_MS = 5000;
@@ -34,6 +35,7 @@ export function credentialTransportEndpoint(agentId, options = {}) {
 
 export class CredentialTransport {
   constructor(options = {}) {
+    requireUnscopedDescendantControl();
     if (!options.agentId) {
       throw transportError(
         "CC_CREDENTIAL_INVALID_REQUEST",
@@ -156,6 +158,7 @@ export class CredentialTransport {
   }
 
   registerCredential(record) {
+    requireUnscopedDescendantControl();
     if (!this.isAvailable()) {
       throw (
         this.error ||
@@ -265,6 +268,7 @@ async function connectWithRetry(endpoint, deadline) {
  * approved target process.
  */
 export async function resolveCredentialRefOverTransport(refId, options = {}) {
+  requireUnscopedDescendantControl();
   const env = options.env || process.env;
   const endpoint = options.endpoint || env.CC_CREDENTIAL_ENDPOINT;
   const capabilityToken =

package/src/lib/process-execution-broker/index.js

@@ -30,6 +30,7 @@ import * as fs from "node:fs";
 import * as tty from "node:tty";
 import { createRequire } from "node:module";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { requireUnscopedDescendantControl } from "../formal-budget-provider-scope.js";
 
 const require = createRequire(import.meta.url);
 
@@ -4692,6 +4693,7 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   spawn(command, args, options = {}) {
+    requireUnscopedDescendantControl();
     assertProcessOwnershipAvailable();
     options = this._withAmbientProcessContext(command, options);
     const executionId = crypto.randomUUID();
@@ -5156,6 +5158,7 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   spawnSync(command, args, options = {}) {
+    requireUnscopedDescendantControl();
     assertProcessOwnershipAvailable();
     options = this._withAmbientProcessContext(command, options);
     const executionId = crypto.randomUUID();
@@ -5745,6 +5748,7 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   exec(command, options, callback) {
+    requireUnscopedDescendantControl();
     const opts = typeof options === "function" ? {} : options;
     const cb = typeof options === "function" ? options : callback;
     if (this._requiresExplicitLinuxWorkspaceShell(opts.cwd || process.cwd())) {
@@ -5763,6 +5767,7 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   execSync(command, options = {}) {
+    requireUnscopedDescendantControl();
     if (
       this._requiresExplicitLinuxWorkspaceShell(options.cwd || process.cwd())
     ) {
@@ -5804,6 +5809,7 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   execFile(file, args, options, callback) {
+    requireUnscopedDescendantControl();
     if (typeof args === "function") {
       callback = args;
       args = [];
@@ -5897,6 +5903,7 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   execFileSync(file, args, options = {}) {
+    requireUnscopedDescendantControl();
     if (!Array.isArray(args)) {
       options = args || {};
       args = [];
@@ -5917,6 +5924,7 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   fork(modulePath, args, options = {}) {
+    requireUnscopedDescendantControl();
     return this.spawn(process.execPath, [modulePath, ...(args || [])], {
       ...options,
       origin: options.origin || "fork",

package/src/lib/provider-stream.js

@@ -1,3 +1,7 @@
+import {
+  hasFormalBudgetProviderScope,
+  providerFetch,
+} from "./formal-budget-provider-scope.js";
 /**
  * Provider streaming adapters — shared by `cc stream` and the Hosted Session
  * API `stream.run` WS route. Each builder returns an AsyncIterable<string>
@@ -47,16 +51,19 @@ export async function* ollamaTokenStream({
   signal,
   requireCompletion = false,
 }) {
-  const res = await fetch(`${baseUrl}/api/${messages ? "chat" : "generate"}`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(
-      messages
-        ? { model, messages, stream: true }
-        : { model, prompt, stream: true },
-    ),
-    signal,
-  });
+  const res = await providerFetch(
+    `${baseUrl}/api/${messages ? "chat" : "generate"}`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(
+        messages
+          ? { model, messages, stream: true }
+          : { model, prompt, stream: true },
+      ),
+      signal,
+    },
+  );
   if (!res.ok || !res.body) {
     throw new Error(`Ollama ${res.status} ${res.statusText}`);
   }
@@ -88,7 +95,8 @@ export async function* openAIStream({
   signal,
   requireCompletion = false,
 }) {
-  const res = await fetch(`${baseUrl}/chat/completions`, {
+  const governed = hasFormalBudgetProviderScope();
+  const res = await providerFetch(`${baseUrl}/chat/completions`, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
@@ -98,17 +106,24 @@ export async function* openAIStream({
       model,
       messages: messages ?? [{ role: "user", content: prompt }],
       stream: true,
+      ...(governed ? { stream_options: { include_usage: true } } : {}),
     }),
     signal,
   });
   if (!res.ok || !res.body) {
     throw new Error(`${res.status} ${res.statusText}`);
   }
+  let completed = false;
   for await (const raw of responseLines(res.body)) {
     const line = raw.trim();
     if (!line || !line.startsWith("data:")) continue;
     const payload = line.slice(5).trim();
-    if (payload === "[DONE]") return;
+    if (payload === "[DONE]") {
+      completed = true;
+      if (!governed) return;
+      // A governed stream must reach EOF so durable accounting can settle.
+      continue;
+    }
     try {
       const obj = JSON.parse(payload);
       if (requireCompletion && obj.error)
@@ -120,7 +135,7 @@ export async function* openAIStream({
       /* skip */
     }
   }
-  if (requireCompletion)
+  if (requireCompletion && !completed)
     throw new Error("OpenAI stream ended before its completion marker");
 }
 

package/src/lib/sandbox-egress-worker.js

@@ -5,6 +5,7 @@
  */
 import { Worker } from "node:worker_threads";
 import path from "node:path";
+import { requireUnscopedDescendantControl } from "./formal-budget-provider-scope.js";
 
 const RESPONSE_TIMEOUT_MS = 10_000;
 
@@ -15,6 +16,7 @@ function workerError(code) {
 }
 
 export async function startEgressProxyWorker(policy, options = {}) {
+  requireUnscopedDescendantControl();
   const bindHost = options.bindHost || "127.0.0.1";
   const socketPath = options.socketPath || null;
   if (socketPath) {
@@ -156,6 +158,7 @@ export async function startEgressProxyWorker(policy, options = {}) {
       return revision;
     },
     async updatePolicy(nextPolicy, expectedRevision) {
+      requireUnscopedDescendantControl();
       const response = await request("update", {
         policy: nextPolicy,
         expectedRevision,

package/src/lib/skill-loader.js

@@ -392,6 +392,7 @@ export class CLISkillLoader {
       throw new TypeError("reauthorizeSkill must be a function or null");
     }
     this._cache = null;
+    this._lastLoadOptions = null;
     bindSkillRuntimeAdmission(this, skillRuntimeAdmission, {
       required: skillRuntimeAdmissionRequired,
     });
@@ -1264,6 +1265,12 @@ export class CLISkillLoader {
    */
   loadAll(options = {}) {
     this._cacheStats.descriptorScans += 1;
+    // Preserve explicit layer policy for a later freshness scan. In particular,
+    // refreshing an opt-in decision must not re-enable a disabled skill layer.
+    this._lastLoadOptions = {
+      ...options,
+      ...(options.env ? { env: { ...options.env } } : {}),
+    };
     // `cc agent --bare` (CC_SKILLS=0): no skill layer loads at all — cache the
     // empty result so getResolvedSkills stays cheap on every call.
     if (allSkillsDisabled(options)) {
@@ -1336,6 +1343,14 @@ export class CLISkillLoader {
     return this.loadAll();
   }
 
+  /** Rescan the same layers under the options used for the current cache. */
+  refreshResolvedSkills() {
+    // A failed scan must not leave a previous descriptor set available as if
+    // it were current on the next lookup.
+    this._cache = null;
+    return this.loadAll(this._lastLoadOptions ?? {});
+  }
+
   /**
    * Get auto-activated persona skills
    * @returns {object[]} skills with category "persona" and activation "auto"
@@ -1367,6 +1382,7 @@ export class CLISkillLoader {
    */
   clearCache() {
     this._cache = null;
+    this._lastLoadOptions = null;
     this._bodyCache.clear();
     this._cacheStats = {
       descriptorScans: 0,

package/src/lib/stream-retry.js

@@ -18,6 +18,7 @@ import {
   raceWithAbort,
   throwIfAborted,
 } from "./abort-utils.js";
+import { isFormalBudgetError } from "./formal-budget-errors.js";
 
 /** Bounded auto-retry budget for streaming connection drops (Claude-Code 2.1.181). */
 export const STREAM_RETRY_MAX = 2;
@@ -243,6 +244,7 @@ export function resolveStreamRetryMax(env = process.env) {
  * @returns {boolean}
  */
 export function isRetryableStreamError(err, signal) {
+  if (isFormalBudgetError(err)) return false;
   if (isAbortError(err)) return false;
   if (signal && signal.aborted) return false;
   if (!err) return false;

package/src/lib/sub-agent-context.js

@@ -21,6 +21,7 @@ import {
 } from "../runtime/agent-core.js";
 import { feature } from "./feature-flags.js";
 import { isEvolutionIngressFailure } from "./model-failure-policy.js";
+import { isFormalBudgetError } from "./formal-budget-errors.js";
 import { captureAgentEvolutionIngress } from "./evolution/agent-evolution-ingress.js";
 import {
   createWorktree,
@@ -609,6 +610,7 @@ export class SubAgentContext {
     } catch (err) {
       if (
         isEvolutionIngressFailure(err) ||
+        isFormalBudgetError(err) ||
         err?.runtimeLedgerPersistence === true ||
         this._workflowEffectId
       ) {
@@ -1212,6 +1214,7 @@ export class SubAgentContext {
     } catch (err) {
       if (
         isEvolutionIngressFailure(err) ||
+        isFormalBudgetError(err) ||
         err?.runtimeLedgerPersistence === true ||
         this._workflowEffectId
       ) {
@@ -1543,9 +1546,9 @@ export class SubAgentContext {
   isAborted() {
     return Boolean(
       this._signal?.aborted ||
-      this._abortController.signal.aborted ||
-      this._runAbortController?.signal.aborted ||
-      this.sessionBudget?.signal?.aborted,
+        this._abortController.signal.aborted ||
+        this._runAbortController?.signal.aborted ||
+        this.sessionBudget?.signal?.aborted,
     );
   }
 

package/src/lib/web-fetch.js

@@ -12,6 +12,7 @@ import { URL } from "node:url";
 import { createHash } from "node:crypto";
 import { StringDecoder } from "node:string_decoder";
 import { webFetchSnapshots } from "./web-fetch-snapshots.js";
+import { requireUnscopedExternalToolAccess } from "./formal-budget-provider-scope.js";
 
 const DEFAULT_MAX_BYTES = 10_000_000;
 const DEFAULT_MAX_CHARS = 20_000;
@@ -343,6 +344,7 @@ async function _doRequest(
 }
 
 export async function webFetch(url, options = {}) {
+  requireUnscopedExternalToolAccess();
   const {
     format = "markdown",
     maxBytes = DEFAULT_MAX_BYTES,

package/src/lib/web-search.js

@@ -14,6 +14,7 @@
 import http from "http";
 import https from "https";
 import { URL } from "url";
+import { requireUnscopedPaidService } from "./formal-budget-provider-scope.js";
 
 const DEFAULT_MAX_BYTES = 10_000_000;
 const DEFAULT_TIMEOUT_MS = 15_000;
@@ -510,6 +511,10 @@ export async function webSearch(query, options = {}) {
   const q = String(query || "").trim();
   if (!q) return { error: "web_search: empty query" };
 
+  // A model-token reservation does not price API search or configured proxy
+  // services. Reject before resolving keys or opening an HTTP request.
+  requireUnscopedPaidService();
+
   const config = options.config || {};
   const provider = resolveProvider(options, config);
   let maxResults = normalizeMaxResults(options.maxResults ?? config.maxResults);

package/src/repl/agent-repl.js

@@ -86,7 +86,9 @@ import {
 } from "../lib/session-host-snapshot.js";
 import { acquireSessionHostLease } from "../lib/session-host-lease.js";
 import {
+  normalizeSessionBudgetRootConfig,
   openProductionSessionBudgetRoot,
+  readProductionSessionBudget,
   sessionBudgetAdmissionError,
 } from "../lib/session-budget-production-root.js";
 import {
@@ -2265,9 +2267,25 @@ export function prepareReplJsonlResumeCandidate(sessionId, dependencies = {}) {
       error.code = "CC_REPL_SESSION_AUTHORITY_MISMATCH";
       throw error;
     }
+    const declaredBudget = dataDescriptorValue(
+      stateDescriptors,
+      "sessionBudgetRoot",
+      "REPL session host resume state",
+      { required: false },
+    );
+    const sessionBudgetRoot =
+      declaredBudget == null
+        ? null
+        : normalizeSessionBudgetRootConfig(
+            snapshotReplMessageValue(
+              declaredBudget,
+              "REPL session budget declaration",
+            ),
+          );
     return brandedFrozenCandidate(REPL_JSONL_RESUME_CANDIDATES, {
       ok: true,
       sessionId,
+      sessionBudgetRoot,
       rebuiltMessages,
       replayMessages: normalizedReplay.replayMessages,
       canonicalSystemMessages: normalizedReplay.canonicalSystemMessages,
@@ -2786,8 +2804,60 @@ export async function runReplStartupBoundary(options, startupDependencies) {
   ) {
     leaseScope.lease = acquireHostLease(leaseSessionId, { hostKind: "repl" });
   }
-  let workspaceOptions = options;
-  if (options.sessionBudgetRoot?.enabled === true) {
+  const injectedBudgetReader = dependencyDataFunction(
+    startupDependencies,
+    "readProductionSessionBudget",
+    null,
+  );
+  const sidecar =
+    leaseSessionId &&
+    (process.platform === "linux" || injectedBudgetReader !== null)
+      ? synchronousReplRecoveryValue(
+          (injectedBudgetReader || readProductionSessionBudget)(leaseSessionId),
+          "REPL budget sidecar",
+        )
+      : null;
+  let effectiveBudgetConfig = options.sessionBudgetRoot;
+  const declaredBudgetConfig = startupCandidate?.sessionBudgetRoot;
+  const requestedBudgetConfig = options.sessionBudgetRoot?.enabled
+    ? normalizeSessionBudgetRootConfig(options.sessionBudgetRoot)
+    : null;
+  if (startupCandidate?.ok === true) {
+    if (declaredBudgetConfig?.enabled) {
+      if (!sidecar) {
+        throw Object.assign(
+          new Error("budgeted REPL session is missing its budget sidecar"),
+          { code: "CC_SESSION_BUDGET_SIDECAR_REQUIRED" },
+        );
+      }
+      if (
+        requestedBudgetConfig &&
+        JSON.stringify(requestedBudgetConfig) !==
+          JSON.stringify(declaredBudgetConfig)
+      ) {
+        throw Object.assign(
+          new Error("REPL budget does not match its JSONL declaration"),
+          { code: "CC_SESSION_BUDGET_CONFIG_MISMATCH" },
+        );
+      }
+      effectiveBudgetConfig = declaredBudgetConfig;
+    } else if (requestedBudgetConfig || sidecar) {
+      throw Object.assign(
+        new Error("existing REPL session has no canonical budget declaration"),
+        { code: "CC_SESSION_BUDGET_JSONL_REQUIRED" },
+      );
+    }
+  } else if (sidecar) {
+    throw Object.assign(
+      new Error("budget sidecar has no canonical REPL session"),
+      { code: "CC_SESSION_BUDGET_JSONL_REQUIRED" },
+    );
+  }
+  let workspaceOptions = {
+    ...options,
+    sessionBudgetRoot: effectiveBudgetConfig,
+  };
+  if (effectiveBudgetConfig?.enabled === true) {
     if (!leaseSessionId || !leaseScope?.lease) {
       throw Object.assign(
         new Error(
@@ -2813,10 +2883,10 @@ export async function runReplStartupBoundary(options, startupDependencies) {
         "CC_REPL_STARTUP_DEPENDENCY_INVALID",
       );
     }
-    const root = openBudgetRoot(leaseSessionId, options.sessionBudgetRoot, {
+    const root = openBudgetRoot(leaseSessionId, effectiveBudgetConfig, {
       persist: true,
       signal: combineReplSignals(options.signal, leaseScope.lease.signal),
-      table: options.sessionBudgetRoot.table,
+      table: effectiveBudgetConfig.table,
     });
     if (
       root?.enabled !== true ||
@@ -2850,7 +2920,7 @@ export async function runReplStartupBoundary(options, startupDependencies) {
       throw admissionError;
     }
     budgetScope.root = root;
-    workspaceOptions = { ...options, ...root.options };
+    workspaceOptions = { ...workspaceOptions, ...root.options };
   }
   const trustedWorkspaceRoot = readCwd();
   return enterWorkspace(trustedWorkspaceRoot, () =>
@@ -2867,11 +2937,17 @@ export function startReplJsonlSession(
   options = {},
 ) {
   const requireDurable =
-    observabilityScope != null || options.requireDurable === true;
+    observabilityScope != null ||
+    options.requireDurable === true ||
+    options.sessionBudgetRoot?.enabled === true;
   try {
+    const budgetDeclaration = options.sessionBudgetRoot?.enabled
+      ? normalizeSessionBudgetRootConfig(options.sessionBudgetRoot)
+      : null;
     const sessionId = startSession(requestedId, {
       ...meta,
       ...(observabilityScope != null ? { observabilityScope } : {}),
+      ...(budgetDeclaration ? { sessionBudgetRoot: budgetDeclaration } : {}),
     });
     if (requireDurable && (typeof sessionId !== "string" || !sessionId)) {
       throw new Error("JSONL session creation returned no durable session id");
@@ -3966,7 +4042,10 @@ async function startAgentReplInWorkspaceOwned(
         options.sessionId || null,
         meta,
         options.observabilityScope,
-        { requireDurable: Boolean(_sessionBudget) },
+        {
+          requireDurable: Boolean(_sessionBudget),
+          sessionBudgetRoot: options.sessionBudgetRoot,
+        },
       );
       if (
         sessionId &&