chainlesschain 0.166.129 → 0.166.131

package/src/lib/goal-workspace-evidence.js

@@ -0,0 +1,299 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import executionBroker from "./process-execution-broker/index.js";
+import {
+  fileStatIdentity,
+  sameFileStatIdentity,
+  samePathHandleFileIdentity,
+} from "./secure-file-identity.js";
+
+const fsp = fs.promises;
+const sha256 = (value) =>
+  `sha256:${createHash("sha256").update(value).digest("hex")}`;
+const fail = (code) => {
+  throw Object.assign(new Error(code), { goalWorkspaceCode: code });
+};
+const LIMITS = Object.freeze({
+  maxFiles: 50_000,
+  maxBytes: 512 * 1024 * 1024,
+  maxFileBytes: 64 * 1024 * 1024,
+  maxMs: 15_000,
+});
+
+function inside(root, target) {
+  const relative = path.relative(root, target);
+  return (
+    relative !== ".." &&
+    !relative.startsWith(`..${path.sep}`) &&
+    !path.isAbsolute(relative)
+  );
+}
+
+function samePath(left, right) {
+  return process.platform === "win32"
+    ? left.toLowerCase() === right.toLowerCase()
+    : left === right;
+}
+
+async function hasGitAncestor(root) {
+  for (let current = root; ; current = path.dirname(current)) {
+    try {
+      await fsp.lstat(path.join(current, ".git"));
+      return true;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    if (path.dirname(current) === current) return false;
+  }
+}
+
+function gitFiles(root, maxFiles) {
+  // No shell, index writes, filters, hooks, or inherited Git redirection. The
+  // broker remains the sole process boundary; no provider credentials needed.
+  const env = Object.fromEntries(
+    Object.entries(process.env).filter(([key]) =>
+      /^(path|systemroot|windir|temp|tmp|home|userprofile)$/i.test(key),
+    ),
+  );
+  const result = executionBroker.spawnSync(
+    "git",
+    [
+      "-c",
+      "core.fsmonitor=false",
+      "ls-files",
+      "-z",
+      "--cached",
+      "--others",
+      "--exclude-standard",
+      "--",
+      ".",
+    ],
+    {
+      cwd: root,
+      shell: false,
+      windowsHide: true,
+      encoding: "utf8",
+      timeout: 5000,
+      maxBuffer: 8 * 1024 * 1024,
+      origin: "headless-goal:workspace-evidence",
+      scope: "headless-goal",
+      policy: "allow",
+      env: { ...env, GIT_OPTIONAL_LOCKS: "0", GIT_TERMINAL_PROMPT: "0" },
+    },
+  );
+  if (result.error || result.signal || result.status !== 0)
+    fail("source-list-unavailable");
+  const files = [...new Set(result.stdout.split("\0").filter(Boolean))].sort();
+  if (files.length > maxFiles) fail("resource-limit");
+  return files;
+}
+
+async function directoryFiles(root, check, maxFiles) {
+  const files = [];
+  let entries = 0;
+  const walk = async (relative) => {
+    check();
+    const dir = await fsp.opendir(path.join(root, relative));
+    for await (const entry of dir) {
+      check();
+      if (++entries > maxFiles) fail("resource-limit");
+      const name = path.join(relative, entry.name);
+      if (entry.name === ".git") continue;
+      if (entry.isDirectory()) await walk(name);
+      else files.push(name);
+    }
+  };
+  await walk("");
+  return files.sort();
+}
+
+/** Read-only content evidence. Git scope is tracked + nonignored files under
+ * cwd; artifact reads also cover ignored output files. No Git scope is silently
+ * replaced by a smaller directory scan when Git fails. This detects ordinary
+ * concurrent changes, not a hostile writer that can perform undetectable ABA.
+ */
+export async function captureGoalWorkspace(
+  cwd,
+  call,
+  { signal, limits = {} } = {},
+) {
+  const bounds = { ...LIMITS, ...limits };
+  const started = Date.now();
+  let rootHandle;
+  const check = () => {
+    if (signal?.aborted) fail("cancelled");
+    if (Date.now() - started > bounds.maxMs) fail("resource-limit");
+  };
+  try {
+    check();
+    const artifact = call?.tool === "read_file";
+    const workspaceTool = call?.tool === "run_shell";
+    if (!artifact && !workspaceTool) fail("tool-scope-unavailable");
+    const root = await fsp.realpath(path.resolve(cwd));
+    const rootStat = await fsp.stat(root, { bigint: true });
+    if (!rootStat.isDirectory()) fail("workspace-unavailable");
+    rootHandle = await fsp.open(root, fs.constants.O_RDONLY);
+    const rootDevice = (await rootHandle.stat({ bigint: true })).dev;
+    const workspaceId = sha256(
+      JSON.stringify([
+        root,
+        String(rootStat.dev),
+        String(rootStat.ino),
+        String(rootStat.birthtimeNs),
+      ]),
+    );
+    let scope;
+    let list;
+    if (artifact) {
+      if (typeof call.args?.path !== "string" || !call.args.path)
+        fail("artifact-path-unavailable");
+      const target = path.resolve(root, call.args.path);
+      if (!inside(root, target) || target === root) fail("outside-workspace");
+      scope = "artifact";
+      list = async () => [path.relative(root, target)];
+    } else if (await hasGitAncestor(root)) {
+      scope = "git-visible-files-under-cwd";
+      list = async () => gitFiles(root, bounds.maxFiles);
+    } else {
+      scope = "directory-files-under-cwd";
+      list = () => directoryFiles(root, check, bounds.maxFiles);
+    }
+    const files = await list();
+    check();
+    const content = createHash("sha256");
+    const freshness = createHash("sha256");
+    const identities = [];
+    const artifacts = [];
+    let totalBytes = 0;
+    for (const relative of files) {
+      check();
+      const target = path.resolve(root, relative);
+      if (!inside(root, target)) fail("outside-workspace");
+      // Canonical parents must stay within this exact workspace. Symlinks,
+      // submodules, special files and unreadable entries are not partial proof.
+      let before;
+      try {
+        before = await fsp.lstat(target, { bigint: true });
+      } catch (error) {
+        // Deleted tracked files are part of the current source version. A
+        // missing requested artifact, however, cannot support completion.
+        if (scope !== "git-visible-files-under-cwd" || error.code !== "ENOENT")
+          throw error;
+        content.update(
+          JSON.stringify({ path: relative, missing: true }) + "\n",
+        );
+        freshness.update(
+          JSON.stringify({ path: relative, missing: true }) + "\n",
+        );
+        identities.push([target, null]);
+        continue;
+      }
+      const canonical = await fsp.realpath(target);
+      if (!samePath(canonical, target) || !inside(root, canonical))
+        fail("linked-entry");
+      if (!before.isFile() || before.nlink !== 1n) fail("unsupported-entry");
+      if (before.size > BigInt(bounds.maxFileBytes)) fail("resource-limit");
+      totalBytes += Number(before.size);
+      if (totalBytes > bounds.maxBytes) fail("resource-limit");
+      let handle;
+      try {
+        handle = await fsp.open(
+          target,
+          fs.constants.O_RDONLY |
+            (fs.constants.O_NOFOLLOW || 0) |
+            (fs.constants.O_NONBLOCK || 0),
+        );
+        const opened = await handle.stat({ bigint: true });
+        if (!samePathHandleFileIdentity(before, opened, rootDevice))
+          fail("workspace-changed");
+        const digest = createHash("sha256");
+        const buffer = Buffer.alloc(64 * 1024);
+        let size = 0;
+        while (true) {
+          check();
+          const { bytesRead } = await handle.read(
+            buffer,
+            0,
+            buffer.length,
+            null,
+          );
+          if (bytesRead === 0) break;
+          size += bytesRead;
+          if (size > Number(before.size)) fail("workspace-changed");
+          digest.update(buffer.subarray(0, bytesRead));
+        }
+        const after = await fsp.lstat(target, { bigint: true });
+        if (
+          size !== Number(before.size) ||
+          !sameFileStatIdentity(before, after) ||
+          !samePathHandleFileIdentity(
+            after,
+            await handle.stat({ bigint: true }),
+            rootDevice,
+          )
+        )
+          fail("workspace-changed");
+        const entry = {
+          path: relative.split(path.sep).join("/"),
+          size,
+          digest: `sha256:${digest.digest("hex")}`,
+        };
+        content.update(JSON.stringify(entry) + "\n");
+        freshness.update(
+          JSON.stringify([entry.path, fileStatIdentity(after)]) + "\n",
+        );
+        identities.push([target, after]);
+        if (artifact) artifacts.push(entry);
+      } finally {
+        await handle?.close();
+      }
+    }
+    if (JSON.stringify(await list()) !== JSON.stringify(files))
+      fail("workspace-changed");
+    check();
+    for (const [target, stat] of identities) {
+      check();
+      let current = null;
+      try {
+        current = await fsp.lstat(target, { bigint: true });
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      if (
+        stat === null
+          ? current !== null
+          : !current || !sameFileStatIdentity(stat, current)
+      )
+        fail("workspace-changed");
+    }
+    const finalRoot = await fsp.stat(root, { bigint: true });
+    if (
+      (await fsp.realpath(path.resolve(cwd))) !== root ||
+      finalRoot.ino !== rootStat.ino ||
+      finalRoot.dev !== rootStat.dev ||
+      finalRoot.birthtimeNs !== rootStat.birthtimeNs
+    )
+      fail("workspace-changed");
+    check();
+    return {
+      verified: true,
+      scope,
+      workspaceId,
+      digest: `sha256:${content.digest("hex")}`,
+      freshnessDigest: `sha256:${freshness.digest("hex")}`,
+      fileCount: files.length,
+      totalBytes,
+      ...(artifact ? { artifacts } : {}),
+    };
+  } catch (error) {
+    // File/provider text is not a diagnostic channel. Missing/denied/unstable
+    // coverage remains unavailable and must not become a positive verdict.
+    return {
+      verified: false,
+      reason: error.goalWorkspaceCode || "workspace-unavailable",
+    };
+  } finally {
+    await rootHandle?.close();
+  }
+}

package/src/lib/llm-connection-probe.js

@@ -4,6 +4,10 @@ import { providerFetch } from "./formal-budget-provider-scope.js";
 import { isFormalBudgetError } from "./formal-budget-errors.js";
 import { normalizeOllamaBaseUrl } from "./ollama-base-url.js";
 import { resolveModelCapabilityProfile } from "./model-capabilities.js";
+import {
+  projectEnvelopePricingContext,
+  projectUsagePricingContext,
+} from "./usage-pricing-context.js";
 import {
   createOpenAIResponsesBody,
   normalizeOpenAIResponsesResponse,
@@ -23,10 +27,6 @@ export function normalizeLlmProbeUsage(provider, data, runtimeProtocol = null) {
   if (!data || typeof data !== "object" || Array.isArray(data)) return null;
   let usage;
   if (provider === "openai" && runtimeProtocol === "openai-responses") {
-    // The existing Responses codec owns cached/reasoning token accounting.
-    // Do not invent a priced cache-write split that the probe has not verified.
-    const writes = data.usage?.input_tokens_details?.cache_write_tokens;
-    if (writes !== undefined && writes !== 0) return null;
     usage = normalizeOpenAIResponsesUsage(data.usage);
   } else if (provider === "ollama") {
     usage = {
@@ -91,7 +91,9 @@ export function normalizeLlmProbeUsage(provider, data, runtimeProtocol = null) {
         ? 0
         : usage.cache_creation_input_tokens,
   };
-  return Object.values(normalized).every(count) ? normalized : null;
+  return Object.values(normalized).every(count)
+    ? { ...normalized, ...projectEnvelopePricingContext(usage, data) }
+    : null;
 }
 
 export function priceLlmProbeUsage(target, usage) {
@@ -105,6 +107,7 @@ export function priceLlmProbeUsage(target, usage) {
     ].every(count)
   )
     return null;
+  const context = projectUsagePricingContext(usage);
   const estimate = estimateCost({
     provider: target.provider,
     model: target.model,
@@ -112,6 +115,9 @@ export function priceLlmProbeUsage(target, usage) {
     outputTokens: usage.output_tokens,
     cacheReadTokens: usage.cache_read_input_tokens,
     cacheCreationTokens: usage.cache_creation_input_tokens,
+    ...context,
+    serviceTier: context.service_tier ?? "standard",
+    regionalProcessing: context.regional_processing === true,
   });
   return estimate.matched && Number.isFinite(estimate.totalCost)
     ? estimate.totalCost
@@ -130,6 +136,7 @@ export function llmProbeReceipt(
           output_tokens: usage.output_tokens,
           cache_read_input_tokens: usage.cache_read_input_tokens,
           cache_creation_input_tokens: usage.cache_creation_input_tokens,
+          ...projectUsagePricingContext(usage),
         };
   return {
     schema: LLM_PROBE_SCHEMA,

package/src/lib/llm-onboarding-catalog.json

@@ -1,6 +1,6 @@
 {
   "schema": "chainlesschain.llm-onboarding-catalog/v1",
-  "capabilityCatalogVersion": "2026-10-15",
+  "capabilityCatalogVersion": "2026-10-29",
   "scope": "new-connections",
   "runtimeVerified": false,
   "accountVerified": false,
@@ -10,7 +10,7 @@
       "label": "Volcengine / Doubao (volcengine)",
       "cliLabel": "Volcengine (火山引擎/豆包)",
       "baseUrl": "https://ark.cn-beijing.volces.com/api/v3",
-      "defaultModel": "deepseek-v4-1-flash-260910",
+      "defaultModel": "deepseek-v4-1-flash-economy-261017",
       "needsKey": true,
       "visionModel": "doubao-seed-2-0-lite-260215"
     },

package/src/lib/llm-pricing.js

@@ -220,6 +220,7 @@ export function normalizePricingTerms(value) {
     "cacheReadMultiplier",
     "cacheWriteMultiplier",
     "cacheWrite1hMultiplier",
+    "cacheWrite12hMultiplier",
     "longContext",
     "serviceMultipliers",
   ]);
@@ -230,6 +231,7 @@ export function normalizePricingTerms(value) {
     "cacheReadMultiplier",
     "cacheWriteMultiplier",
     "cacheWrite1hMultiplier",
+    "cacheWrite12hMultiplier",
   ]) {
     if (!Object.hasOwn(value, key)) continue;
     if (!finite(value[key])) fail();
@@ -333,8 +335,8 @@ export function lookupRate(provider, model, table = PRICE_TABLE) {
  *             currency:string, matched:boolean, free:boolean, rate:object|null }}
  */
 // Prompt-cache price multipliers relative to the input rate. A cache WRITE
-// (Anthropic 5-minute ephemeral breakpoint) bills at ~125%; only Anthropic
-// reports cache creation. Cache READ pricing differs per provider — Anthropic
+// (Anthropic 5-minute / OpenAI 30-minute) bills at 125%; longer TTLs have
+// separate rates and require usage evidence. Cache READ pricing differs — Anthropic
 // ~10%, OpenAI ~50%, DeepSeek ~25% of the input rate — so the default below is
 // overridden per provider. Applied only when cache token counts are present, so
 // non-caching usage is priced exactly as before. Public list-price estimates
@@ -361,6 +363,8 @@ export function estimateCost({
   cacheCreationTokens = 0,
   cacheCreation5mTokens,
   cacheCreation1hTokens,
+  cacheCreation30mTokens,
+  cacheCreation12hTokens,
   cacheCreationInvalid = false,
   pricingContextInvalid = false,
   requestInputTokens,
@@ -378,9 +382,25 @@ export function estimateCost({
     Number.isSafeInteger(cacheCreation1hTokens) &&
     cacheCreation1hTokens >= 0 &&
     cacheCreation5mTokens + cacheCreation1hTokens === cacheCreationTokens;
+  const openaiSplitPresent =
+    cacheCreation30mTokens != null || cacheCreation12hTokens != null;
+  const openaiSplitValid =
+    openaiSplitPresent &&
+    Number.isSafeInteger(cacheCreation30mTokens) &&
+    cacheCreation30mTokens >= 0 &&
+    Number.isSafeInteger(cacheCreation12hTokens) &&
+    cacheCreation12hTokens >= 0 &&
+    cacheCreation30mTokens + cacheCreation12hTokens === cacheCreationTokens;
   const missingCacheEvidence =
     cacheCreationInvalid ||
     (splitPresent && !splitValid) ||
+    (openaiSplitPresent && !openaiSplitValid) ||
+    (openaiSplitPresent && splitPresent) ||
+    (openaiSplitPresent && rate?.terms?.cacheWrite12hMultiplier == null) ||
+    (splitPresent && rate?.terms?.cacheWrite12hMultiplier != null) ||
+    (rate?.terms?.cacheWrite12hMultiplier != null &&
+      cacheCreationTokens > 0 &&
+      !openaiSplitValid) ||
     (rate?.terms?.cacheWrite1hMultiplier != null &&
       cacheCreationTokens > 0 &&
       !splitValid);
@@ -432,12 +452,16 @@ export function estimateCost({
     inputMultiplier *
     multiplier;
   const cacheCreationCost =
-    ((splitValid
-      ? cacheCreation5mTokens *
-          (rate.terms?.cacheWriteMultiplier ?? CACHE_WRITE_MULTIPLIER) +
-        cacheCreation1hTokens * (rate.terms?.cacheWrite1hMultiplier ?? 2)
-      : Number(cacheCreationTokens) *
-        (rate.terms?.cacheWriteMultiplier ?? CACHE_WRITE_MULTIPLIER)) /
+    ((openaiSplitValid
+      ? cacheCreation30mTokens *
+          (rate.terms.cacheWriteMultiplier ?? CACHE_WRITE_MULTIPLIER) +
+        cacheCreation12hTokens * rate.terms.cacheWrite12hMultiplier
+      : splitValid
+        ? cacheCreation5mTokens *
+            (rate.terms?.cacheWriteMultiplier ?? CACHE_WRITE_MULTIPLIER) +
+          cacheCreation1hTokens * (rate.terms?.cacheWrite1hMultiplier ?? 2)
+        : Number(cacheCreationTokens) *
+          (rate.terms?.cacheWriteMultiplier ?? CACHE_WRITE_MULTIPLIER)) /
       1e6) *
     rate.in *
     inputMultiplier *
@@ -474,6 +498,8 @@ export function priceRollup(aggregate, { table } = {}) {
       cacheCreationTokens: row.cacheCreationTokens,
       cacheCreation5mTokens: row.cacheCreation5mTokens,
       cacheCreation1hTokens: row.cacheCreation1hTokens,
+      cacheCreation30mTokens: row.cacheCreation30mTokens,
+      cacheCreation12hTokens: row.cacheCreation12hTokens,
       cacheCreationInvalid: row.cacheCreationInvalid,
       pricingContextInvalid:
         row.pricingContextInvalid === true ||

package/src/lib/llm-providers.js

@@ -91,6 +91,7 @@ export const BUILT_IN_PROVIDERS = {
     baseUrl: "https://ark.cn-beijing.volces.com/api/v3",
     apiKeyEnv: "VOLCENGINE_API_KEY",
     models: [
+      "deepseek-v4-1-flash-economy-261017",
       "deepseek-v4-1-flash-260910",
       "deepseek-v4-flash-ga-260731",
       "deepseek-v4-flash-260425",