chainlesschain 0.166.140 → 0.166.142

package/src/lib/read-file-loop-guard.js

@@ -26,6 +26,13 @@ function mergeSpan(spans, span) {
   return merged;
 }
 
+function rereadFingerprint(span, restoring) {
+  return (
+    (restoring ? "restore:" : "review:") +
+    createHash("sha256").update(JSON.stringify(span)).digest("hex")
+  );
+}
+
 /** Per-run read coverage and recovery, independent of compacted transcripts. */
 export class ReadFileLoopGuard {
   constructor() {
@@ -309,9 +316,7 @@ export class ReadFileLoopGuard {
         this.visiblePages !== null &&
         entry.lastReadRequest < this.visibleRequest &&
         !this.isPageVisible(page);
-      const fingerprint =
-        (restoring ? "restore:" : "review:") +
-        createHash("sha256").update(JSON.stringify(span)).digest("hex");
+      const fingerprint = rereadFingerprint(span, restoring);
       if (
         targeted &&
         !entry.rereads.has(fingerprint) &&
@@ -354,6 +359,40 @@ export class ReadFileLoopGuard {
               hint: "This range has a read pending in the current tool batch. Historical source coverage is recorded only after content reaches the model.",
             };
           }
+          const recoveryRead = {
+            path: filePath,
+            offset: explicitRange ? page.range.startLine : 1,
+            limit: 80,
+            ...(args.hashed === true ? { hashed: true } : {}),
+            ...(args.raw === true ? { raw: true } : {}),
+          };
+          const recoveryPage = readPage(recoveryRead);
+          const validRecoveryPage =
+            !recoveryPage.error &&
+            !!recoveryPage.readSpan &&
+            !recoveryPage.truncated;
+          const recoveryCovered =
+            validRecoveryPage &&
+            entry.spans.some(
+              ([start, end]) =>
+                start <= recoveryPage.readSpan.start &&
+                end >= recoveryPage.readSpan.end,
+            );
+          const recoveryRestoring =
+            validRecoveryPage &&
+            this.visiblePages !== null &&
+            entry.lastReadRequest < this.visibleRequest &&
+            !this.isPageVisible(recoveryPage);
+          // A recovery hint is a contract. Do not prescribe a read that this
+          // same guard would immediately omit again. This checks a pure page
+          // from the already-authorized file without minting a new allowance.
+          const canRecover =
+            validRecoveryPage &&
+            (!recoveryCovered ||
+              (entry.rereads.size < 3 &&
+                !entry.rereads.has(
+                  rereadFingerprint(recoveryPage.readSpan, recoveryRestoring),
+                )));
           return {
             path: filePath,
             fileVersion,
@@ -367,14 +406,10 @@ export class ReadFileLoopGuard {
             ...(entry.summary?.outline
               ? { outline: entry.summary.outline }
               : {}),
-            recoveryRead: {
-              path: filePath,
-              offset: explicitRange ? page.range.startLine : 1,
-              limit: 80,
-              ...(args.hashed === true ? { hashed: true } : {}),
-              ...(args.raw === true ? { raw: true } : {}),
-            },
-            hint: "This requested range was read earlier, but historical coverage does not mean its source is visible now. The runtime has not substituted an unrelated file range. Use source actually present in this request; recover missing details with a focused search or the bounded recoveryRead. Reading the file is not task completion.",
+            ...(canRecover ? { recoveryRead } : {}),
+            hint: canRecover
+              ? "This requested range was read earlier, but historical coverage does not mean its source is visible now. Recover missing details with a focused search or the bounded recoveryRead. Reading the file is not task completion."
+              : "This unchanged range cannot be reread within the remaining read allowance. Do not repeat it. Use source still visible in this request, or search_files for a precise symbol (set regex:true when using a regular expression). If required source is unavailable, report the limitation instead of guessing APIs.",
           };
         }
       }

package/src/lib/tool-result-preview.js

@@ -36,6 +36,7 @@ const PREVIEW_HINT =
 export function canProjectHostToolExcerpt(text, tool) {
   const scan = createEvidenceJsonTextBoundary((message) => new Error(message), {
     ...EVIDENCE_JSON_POLICY,
+    sourceExpressionPolicy: "bounded-source-tokens-v1",
     sourceLiteralPolicy: "explicit-source-containers-v1",
     maxSourceTokens: 32768,
   });

package/src/runtime/agent-core.js

@@ -7,6 +7,12 @@ import {
   requireUnscopedToolExecution,
 } from "../lib/formal-budget-provider-scope.js";
 import { isFormalBudgetError } from "../lib/formal-budget-errors.js";
+import {
+  FORMAL_QUALITY_ALLOWED_FILES_ENV,
+  FORMAL_QUALITY_FILE_TOOLS,
+  formalQualityAllowedFiles,
+  isFormalQualityHermeticRuntime,
+} from "../lib/formal-quality-eval-runtime.js";
 import { normalizeOllamaBaseUrl } from "../lib/ollama-base-url.js";
 import { ollamaProviderFetch } from "../lib/ollama-provider-fetch.js";
 import {
@@ -14987,7 +14993,59 @@ function permissionDecision(callId, tool, result) {
   });
 }
 
+function bindFormalQualityLoopOptions(options) {
+  // The launcher owns this binding. Apply it at the shared loop so direct
+  // gateway/IDE callers receive the same schema and execution guard as CLI.
+  // Legacy hermetic callers without a file binding retain their own boundary.
+  if (
+    !isFormalQualityHermeticRuntime(process.env) ||
+    !Object.hasOwn(process.env, FORMAL_QUALITY_ALLOWED_FILES_ENV)
+  ) {
+    return options;
+  }
+  const allowedPaths = formalQualityAllowedFiles(process.env);
+  const cwd = options.cwd || process.cwd();
+  const launcherScope = normalizeExactFileMutationScope(
+    { exact: true, worktreeRoot: canonicalRealpath(cwd), allowedPaths },
+    { cwd },
+  );
+  const callerScope = normalizeExactFileMutationScope(
+    options.fileMutationScope,
+    {
+      cwd,
+    },
+  );
+  if (
+    callerScope &&
+    callerScope.allowedPaths.some((file) => !allowedPaths.includes(file))
+  ) {
+    throw new Error("mutation scope widens the formal quality file binding");
+  }
+  if (
+    options.enabledToolNames != null &&
+    !Array.isArray(options.enabledToolNames)
+  ) {
+    throw new Error("formal quality enabled tool names must be an array");
+  }
+  return {
+    ...options,
+    fileMutationScope: callerScope || launcherScope,
+    hermeticExecution: true,
+    exactToolNames: true,
+    // Hermetic execution ignores host executors. Match that on the provider
+    // side too: a same-named host executor must not suppress the path enum
+    // for the built-in mutation tool that will actually execute.
+    externalToolExecutors: null,
+    enabledToolNames: Object.freeze(
+      (options.enabledToolNames ?? FORMAL_QUALITY_FILE_TOOLS).filter((name) =>
+        FORMAL_QUALITY_FILE_TOOLS.includes(name),
+      ),
+    ),
+  };
+}
+
 export async function* agentLoop(messages, options) {
+  options = bindFormalQualityLoopOptions(options);
   // Bind the actual task before compaction, runtime nudges or provider projection.
   // A new host-admitted user turn starts a new loop and receives its own binding.
   const currentUserTask = messages.findLast(