chainlesschain 0.166.131 → 0.166.133

package/src/lib/context-memory-kernel/message-adapter.js

@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from "node:util";
 import {
   canonicalDigest,
   canonicalJson,
@@ -205,6 +206,17 @@ export function messagesToContextItems(messagesInput, options = {}) {
     ? [...options.allowedSinks]
     : DEFAULT_ALLOWED_SINKS;
   const items = [];
+  const requiredUser = options.requiredUserMessage;
+  if (
+    requiredUser != null &&
+    (!Number.isSafeInteger(requiredUser.index) ||
+      requiredUser.index < 0 ||
+      requiredUser.index >= messages.length ||
+      requiredUser.message?.role !== "user" ||
+      !isDeepStrictEqual(messages[requiredUser.index], requiredUser.message))
+  ) {
+    throw new TypeError("Invalid current-user task binding");
+  }
   const trustedSystemIndexes = new Set(
     Array.isArray(options.trustedSystemIndexes)
       ? options.trustedSystemIndexes.filter(Number.isSafeInteger)
@@ -289,11 +301,20 @@ export function messagesToContextItems(messagesInput, options = {}) {
   const lastIndex = items.findLastIndex(
     (item) => item.kind !== "system-policy",
   );
-  const last = items[lastIndex];
-  if (last) {
-    const payload = JSON.parse(loadBundleContent(last, sessionId));
-    if (payload.messages.at(-1)?.role === "user") {
-      const protectedItem = { ...last };
+  for (let index = 0; index < items.length; index++) {
+    const item = items[index];
+    if (
+      index !== lastIndex &&
+      item.sourceRef.eventSequence !== requiredUser?.index
+    )
+      continue;
+    const payload = JSON.parse(loadBundleContent(item, sessionId));
+    if (
+      payload.messages.at(-1)?.role === "user" &&
+      (index === lastIndex ||
+        item.sourceRef.eventSequence === requiredUser?.index)
+    ) {
+      const protectedItem = { ...item };
       delete protectedItem.digest;
       protectedItem.kind = "task-state";
       protectedItem.priority = 900_000;
@@ -301,7 +322,7 @@ export function messagesToContextItems(messagesInput, options = {}) {
         taskState: "waiting",
         requiredForRecovery: true,
       };
-      items[lastIndex] = normalizeContextItem(protectedItem);
+      items[index] = normalizeContextItem(protectedItem);
     }
   }
   return items;

package/src/lib/context-memory-kernel/provider-context.js

@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from "node:util";
 import {
   canonicalDigest,
   canonicalJson,
@@ -203,6 +204,40 @@ export async function prepareCanonicalProviderContext(
     };
   }
 
+  // Resolve against the final provider projection, never a pre-projection index.
+  // Exact role/content/metadata matching prevents a transformed tool result or
+  // an ambiguous duplicate from taking the original user's task-state binding.
+  const taskBinding = options.contextMemoryRequiredUserBinding;
+  const requiredUserMessage = taskBinding?.message;
+  function resolveRequiredUserIndex() {
+    if (requiredUserMessage == null) return null;
+    const identities = messages.flatMap((message, index) =>
+      message === taskBinding.original ? [index] : [],
+    );
+    const candidates = identities.length
+      ? identities
+      : taskBinding.allowContentRelocation === true
+        ? messages.map((_, index) => index)
+        : [];
+    const matches = candidates.filter((index) => {
+      const message = messages[index];
+      return (
+        message?.role === "user" &&
+        requiredUserMessage.role === "user" &&
+        isDeepStrictEqual(message, requiredUserMessage)
+      );
+    });
+    if (matches.length !== 1 || identities.length > 1) {
+      const error = new Error(
+        "The current user task was lost, changed or duplicated in provider context",
+      );
+      error.code = "CC_AGENT_TASK_CONTEXT_LOST";
+      throw error;
+    }
+    return matches[0];
+  }
+  let requiredUserIndex = resolveRequiredUserIndex();
+
   // Review can exclude recalled author/session data while retaining the exact
   // canonical context, tool and output-token planning boundary.
   const recallEnabled = options.contextMemoryRecall !== false;
@@ -211,9 +246,9 @@ export async function prepareCanonicalProviderContext(
     : null;
   const sink = String(options.contextMemorySink || `provider.${provider}`);
   const scopeAdmissions = defaultAdmissions(sessionId, options);
-  const lastUser = [...messages]
-    .reverse()
-    .find((message) => message?.role === "user");
+  const lastUser =
+    requiredUserMessage ||
+    [...messages].reverse().find((message) => message?.role === "user");
   const query =
     typeof lastUser?.content === "string" && lastUser.content.trim()
       ? lastUser.content.trim().slice(0, 32 * 1024)
@@ -254,6 +289,9 @@ export async function prepareCanonicalProviderContext(
         }),
       };
   options.signal?.throwIfAborted();
+  // Recall awaits host and storage work. Revalidate the captured task and its
+  // current position before image transformation and immutable item creation.
+  requiredUserIndex = resolveRequiredUserIndex();
   const imageTransport = captureContextImageTransport(messages);
   const messageItems = adjustContextImageTokenEstimates(
     messagesToContextItems(imageTransport.messages, {
@@ -261,6 +299,13 @@ export async function prepareCanonicalProviderContext(
       allowedSinks: [sink],
       trustCurrentSystemPolicy: true,
       trustedSystemIndexes: options.contextMemoryTrustedSystemIndexes,
+      requiredUserMessage:
+        requiredUserIndex === null
+          ? null
+          : {
+              index: requiredUserIndex,
+              message: imageTransport.messages[requiredUserIndex],
+            },
       allowExternalization: false,
     }),
     imageTransport.captures,

package/src/lib/evolution/agent-model-projection.js

@@ -221,7 +221,6 @@ function openAIReasoningItem(value) {
   if (Object.hasOwn(value, "summary")) {
     if (
       !Array.isArray(value.summary) ||
-      value.summary.length < 1 ||
       value.summary.length > 16 ||
       value.summary.some(
         (part) =>

package/src/lib/evolution/governed-hub-llm.js

@@ -264,7 +264,10 @@ export function createGovernedHubLlm(llm, factory, options = {}, sdkPorts) {
       "A Hub model client with declared locality is required",
     );
   }
-  if (typeof factory !== "function")
+  if (
+    typeof factory !== "function" &&
+    !(factory === null && options.evolutionDisabled === true)
+  )
     throw new TypeError("A Hub evolution factory is required");
   if (options.onFailure != null && typeof options.onFailure !== "function")
     throw new TypeError("onFailure must be a function");
@@ -298,6 +301,7 @@ export function createGovernedHubLlm(llm, factory, options = {}, sdkPorts) {
         mode: "hub-analysis",
         messages,
         signal: chatOptions.signal,
+        evolutionDisabled: options.evolutionDisabled === true,
       });
     },
     async transport(messages, chatOptions = {}) {

package/src/lib/evolution/governed-hub-resolver.js

@@ -77,8 +77,16 @@ function captureEmbeddingTransport(stage, sdk) {
   };
 }
 
-export function createGovernedHubResolver(ports, factory, sdkPorts) {
-  if (typeof factory !== "function")
+export function createGovernedHubResolver(
+  ports,
+  factory,
+  sdkPorts,
+  options = {},
+) {
+  if (
+    typeof factory !== "function" &&
+    !(factory === null && options.evolutionDisabled === true)
+  )
     throw new TypeError("A resolver evolution factory is required");
   const {
     resolver,
@@ -102,13 +110,14 @@ export function createGovernedHubResolver(ports, factory, sdkPorts) {
         const turn = await prepareGovernedModelTurn(factory, {
           mode: "hub-embedding",
           messages: [{ role: "user", content: profile }],
+          evolutionDisabled: options.evolutionDisabled === true,
         });
         // Chat projection prepends host provenance. Embed only the projected
         // profile: per-Run evidence IDs must not change semantic similarity.
-        const profileMessage = turn.messages[1];
+        const profileMessage = turn.messages[turn.governed ? 1 : 0];
         if (
-          turn.messages.length !== 2 ||
-          turn.messages[0].role !== "system" ||
+          turn.messages.length !== (turn.governed ? 2 : 1) ||
+          (turn.governed && turn.messages[0].role !== "system") ||
           profileMessage?.role !== "user" ||
           typeof profileMessage.content !== "string"
         )
@@ -133,7 +142,7 @@ export function createGovernedHubResolver(ports, factory, sdkPorts) {
   const model =
     resolver._llmStage &&
     new LLMStage({
-      llm: createGovernedHubLlm(llm, factory, {}, sdk),
+      llm: createGovernedHubLlm(llm, factory, options, sdk),
       acceptNonLocal: false,
     });
   return new EntityResolver({

package/src/lib/evolution/governed-hub-skill.js

@@ -9,6 +9,7 @@ export async function runGovernedHubSkill(
   name,
   options,
   sdkPorts,
+  modelTurnOptions = {},
 ) {
   let failure;
   let failed = false;
@@ -16,6 +17,7 @@ export async function runGovernedHubSkill(
     hub.llm,
     factory,
     {
+      evolutionDisabled: modelTurnOptions.evolutionDisabled === true,
       onFailure(error) {
         failure = error;
         failed = true;

package/src/lib/evolution/optional-ui-model-turn.js

@@ -12,9 +12,20 @@ export async function loadConfiguredUiEvolutionFactory(options = {}) {
 }
 
 export async function resolveServerEvolutionFactory(server) {
-  return typeof server.resolveEvolutionCompositionFactory === "function"
+  return typeof server?.resolveEvolutionCompositionFactory === "function"
     ? server.resolveEvolutionCompositionFactory()
-    : (server.evolutionCompositionFactory ?? null);
+    : (server?.evolutionCompositionFactory ?? null);
+}
+
+/** Apply the host's current UI policy for every turn, including old sessions. */
+export async function prepareServerUiModelTurn(server, context) {
+  if (typeof server?.prepareUiModelTurn === "function") {
+    return server.prepareUiModelTurn(context);
+  }
+  return prepareGovernedModelTurn(
+    await resolveServerEvolutionFactory(server),
+    context,
+  );
 }
 
 export async function prepareConfiguredUiModelTurn(context, options = {}) {

package/src/lib/llm-config-defaults.js

@@ -35,7 +35,12 @@
  * so an intentionally-custom endpoint is left untouched.
  */
 export async function reconcileConfigLlmProvider(cfgLlm = {}) {
-  if (!cfgLlm || !cfgLlm.provider || !cfgLlm.baseUrl) {
+  if (
+    !cfgLlm ||
+    !cfgLlm.provider ||
+    !cfgLlm.baseUrl ||
+    cfgLlm.provider === "custom"
+  ) {
     return { llm: cfgLlm, changed: false };
   }
   const { inferProviderFromBaseUrl, modelForeignToProvider } = await import(
@@ -71,22 +76,29 @@ export function applyConfigLlmDefaults(options = {}, cfgLlm = {}, opts = {}) {
   // credentials are exactly right. Mixing config into a DIFFERENT explicit
   // provider is still avoided (handled by the early return below).
   if (options.provider && configMatchesTarget) {
-    if (!options.baseUrl && cfgLlm.baseUrl) options.baseUrl = connection.baseUrl;
+    if (!options.baseUrl && cfgLlm.baseUrl)
+      options.baseUrl = connection.baseUrl;
     if (options.serviceTier == null && cfgLlm.serviceTier != null)
       options.serviceTier = cfgLlm.serviceTier;
-    if (!options.apiKey && connection.apiKey) options.apiKey = connection.apiKey;
+    if (!options.apiKey && connection.apiKey)
+      options.apiKey = connection.apiKey;
     if (!options.model && !opts.explicitModel && cfgLlm.model) {
       options.model = cfgLlm.model;
     }
     return options;
   }
   if (options.provider) {
-    if (!options.apiKey && connection.apiKey) options.apiKey = connection.apiKey;
+    if (!options.apiKey && connection.apiKey)
+      options.apiKey = connection.apiKey;
     return options;
   }
   if (!cfgLlm.provider) return options;
   options.provider = connection.provider;
-  if (configMatchesTarget && options.serviceTier == null && cfgLlm.serviceTier != null)
+  if (
+    configMatchesTarget &&
+    options.serviceTier == null &&
+    cfgLlm.serviceTier != null
+  )
     options.serviceTier = cfgLlm.serviceTier;
   if (opts.explicitModel) {
     options.model = opts.explicitModel;

package/src/lib/llm-connection-config.js

@@ -31,7 +31,10 @@ export function normalizeLlmConnection(input) {
     if (value[key].length > (key === "apiKey" ? 8192 : 2048))
       throw new Error(`${key} is too long`);
   }
-  if (!Object.hasOwn(BUILT_IN_PROVIDERS, value.provider))
+  if (
+    value.provider !== "custom" &&
+    !Object.hasOwn(BUILT_IN_PROVIDERS, value.provider)
+  )
     throw new Error("Choose a supported provider/protocol");
   if (!value.model || /[\r\n\0]/.test(value.model + value.visionModel))
     throw new Error("A valid model name is required");
@@ -84,7 +87,7 @@ export function saveLlmConnection(input, { storage = "auto" } = {}) {
         current.baseUrl || BUILT_IN_PROVIDERS[current.provider]?.baseUrl || "",
       ).replace(/\/+$/, "") === value.baseUrl;
     if (
-      value.provider !== "ollama" &&
+      !["ollama", "custom"].includes(value.provider) &&
       !value.apiKey &&
       (!sameEndpoint || !current.apiKey)
     )
@@ -98,6 +101,11 @@ export function saveLlmConnection(input, { storage = "auto" } = {}) {
       baseUrl: value.baseUrl,
       visionModel: value.visionModel || null,
     };
+    // A keyless custom endpoint must never receive the previous target's key.
+    if (!sameEndpoint && !value.apiKey && value.provider === "custom") {
+      delete config.llm.apiKey;
+      delete config.llm.apiKeyHelper;
+    }
   };
   // A single lock and atomic rename bind endpoint and credential together.
   // An interrupted save cannot route the old credential to the new endpoint.

package/src/lib/llm-connection-probe.js

@@ -3,6 +3,7 @@ import { estimateCost } from "./llm-pricing.js";
 import { providerFetch } from "./formal-budget-provider-scope.js";
 import { isFormalBudgetError } from "./formal-budget-errors.js";
 import { normalizeOllamaBaseUrl } from "./ollama-base-url.js";
+import { assertCustomProviderConnection } from "./provider-protocol.js";
 import { resolveModelCapabilityProfile } from "./model-capabilities.js";
 import {
   projectEnvelopePricingContext,
@@ -159,6 +160,7 @@ export async function probeLlmConnection(
   target,
   { fetchImpl = fetch, timeoutMs = 20_000, includeUsage = false } = {},
 ) {
+  assertCustomProviderConnection(target.provider, target);
   const base =
     target.provider === "ollama"
       ? normalizeOllamaBaseUrl(target.baseUrl)
@@ -183,7 +185,8 @@ export async function probeLlmConnection(
       options: { num_predict: PROBE_OUTPUT_TOKENS },
     };
   } else {
-    if (!target.apiKey) throw new Error("API key required");
+    if (!target.apiKey && target.provider !== "custom")
+      throw new Error("API key required");
     if (target.provider === "anthropic") {
       url = `${base}/messages`;
       headers["x-api-key"] = target.apiKey;
@@ -211,7 +214,7 @@ export async function probeLlmConnection(
       });
     } else {
       url = `${base}/chat/completions`;
-      headers.Authorization = `Bearer ${target.apiKey}`;
+      if (target.apiKey) headers.Authorization = `Bearer ${target.apiKey}`;
       body = {
         model: target.model,
         messages: [{ role: "user", content: "Say hi in one word." }],

package/src/lib/llm-connection-resolution.js

@@ -1,6 +1,9 @@
 import { BUILT_IN_PROVIDERS } from "./llm-providers.js";
 import { normalizeOllamaBaseUrl } from "./ollama-base-url.js";
-import { normalizeProviderBaseUrl } from "./provider-protocol.js";
+import {
+  assertCustomProviderConnection,
+  normalizeProviderBaseUrl,
+} from "./provider-protocol.js";
 import { resolveApiKeyFromHelper } from "./api-key-helper.js";
 
 const DEFAULT_PROVIDER = "ollama";
@@ -33,9 +36,8 @@ export function resolveLlmConnection(
     defaultBaseUrl = null,
   } = {},
 ) {
-  const sources = (Array.isArray(configuredSources)
-    ? configuredSources
-    : [configuredSources]
+  const sources = (
+    Array.isArray(configuredSources) ? configuredSources : [configuredSources]
   ).filter((source) => source && typeof source === "object");
   const provider =
     (nonEmpty(options.provider) && options.provider) ||
@@ -67,6 +69,7 @@ export function resolveLlmConnection(
     defaultModel ||
     definition?.models?.[0] ||
     null;
+  assertCustomProviderConnection(provider, { baseUrl, model });
   let apiKey =
     (nonEmpty(options.apiKey) && options.apiKey) ||
     (nonEmpty(env?.CC_API_KEY) && env.CC_API_KEY) ||

package/src/lib/llm-providers.js

@@ -127,6 +127,19 @@ export const BUILT_IN_PROVIDERS = {
   },
 };
 
+/** Custom platforms use Chat Completions with an explicit endpoint and model. */
+export function resolveProviderDefinition(provider) {
+  return provider === "custom"
+    ? {
+        name: "custom",
+        baseUrl: null,
+        models: [],
+        apiKeyEnv: "CC_API_KEY",
+        custom: true,
+      }
+    : BUILT_IN_PROVIDERS[provider];
+}
+
 // A connectivity probe (`testProvider`) sends a tiny "Hi" and expects a quick
 // reply, so it must fail fast — a probe that hangs forever defeats its purpose
 // (it backs `cc llm test`, provider selection, doctor). Bound it with a total
@@ -402,17 +415,17 @@ export class LLMProviderRegistry {
       const res = await _fetchWithTimeout(
         `${normalizeProviderBaseUrl(provider.baseUrl)}/messages`,
         {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "x-api-key": key,
-          "anthropic-version": "2023-06-01",
-        },
-        body: JSON.stringify({
-          model: testModel,
-          max_tokens: 10,
-          messages: [{ role: "user", content: "Hi" }],
-        }),
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "x-api-key": key,
+            "anthropic-version": "2023-06-01",
+          },
+          body: JSON.stringify({
+            model: testModel,
+            max_tokens: 10,
+            messages: [{ role: "user", content: "Hi" }],
+          }),
         },
       );
       if (!res.ok) throw new Error(`HTTP ${res.status}`);

package/src/lib/openai-responses.js

@@ -103,7 +103,8 @@ function sanitizeReasoningItems(items) {
       type: "reasoning",
       ...(id ? { id } : {}),
       ...(encryptedContent ? { encrypted_content: encryptedContent } : {}),
-      ...(summary.length ? { summary } : {}),
+      // Responses requires this field even when no summary was requested.
+      summary,
       ...(status ? { status } : {}),
     });
   }