chainlesschain 0.166.29 → 0.166.32

package/src/commands/llm.js

@@ -43,7 +43,11 @@ import {
   autoFailStuckRequestsV2,
   getLlmProvidersStatsV2,
 } from "../lib/llm-providers.js";
-import { formatProviderResponseError } from "../lib/provider-http-error.js";
+import {
+  readLlmConnectionInput,
+  saveLlmConnection,
+} from "../lib/llm-connection-config.js";
+import { probeLlmConnection } from "../lib/llm-connection-probe.js";
 
 /**
  * Resolve the effective `cc llm test` target from CLI flags + persisted config.
@@ -109,6 +113,28 @@ export function resolveLlmTestTarget(
 export function registerLlmCommand(program) {
   const llm = program.command("llm").description("LLM provider management");
 
+  llm
+    .command("configure")
+    .description(
+      "Atomically save an LLM connection from stdin JSON (secrets never enter argv)",
+    )
+    .option(
+      "--storage <mode>",
+      "Secret storage: auto, keychain, or file",
+      "auto",
+    )
+    .action(async (options) => {
+      try {
+        const saved = saveLlmConnection(await readLlmConnectionInput(), {
+          storage: options.storage,
+        });
+        console.log(JSON.stringify({ ok: true, ...saved }));
+      } catch (error) {
+        logger.error(error.message);
+        process.exitCode = 1;
+      }
+    });
+
   // llm models - list available models
   llm
     .command("models")
@@ -195,65 +221,11 @@ export function registerLlmCommand(program) {
       try {
         const start = Date.now();
 
-        if (target.isOllama) {
-          const response = await fetch(`${target.baseUrl}/api/generate`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-              model: target.model,
-              prompt: "Say hi in one word.",
-              stream: false,
-            }),
-          });
-
-          if (!response.ok) {
-            throw new Error(
-              await formatProviderResponseError("ollama", response),
-            );
-          }
-
-          const data = await response.json();
-          const elapsed = Date.now() - start;
-
-          spinner.succeed(
-            `${chalk.green("Connected")} to Ollama (${target.model}) in ${elapsed}ms`,
-          );
-          logger.log(
-            `  Response: ${chalk.gray((data.response || "").trim().substring(0, 100))}`,
-          );
-        } else {
-          // OpenAI-compatible path (openai, volcengine, deepseek, dashscope,
-          // kimi, minimax, mistral, …).
-          if (!target.apiKey) throw new Error("API key required");
-
-          const response = await fetch(`${target.baseUrl}/chat/completions`, {
-            method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              Authorization: `Bearer ${target.apiKey}`,
-            },
-            body: JSON.stringify({
-              model: target.model,
-              messages: [{ role: "user", content: "Say hi in one word." }],
-              max_tokens: 10,
-            }),
-          });
-
-          if (!response.ok) {
-            throw new Error(
-              await formatProviderResponseError(target.provider, response),
-            );
-          }
-
-          const data = await response.json();
-          const elapsed = Date.now() - start;
-          const reply = data.choices?.[0]?.message?.content?.trim() || "";
-
-          spinner.succeed(
-            `${chalk.green("Connected")} to ${target.label} (${target.model}) in ${elapsed}ms`,
-          );
-          logger.log(`  Response: ${chalk.gray(reply)}`);
-        }
+        const reply = await probeLlmConnection(target);
+        spinner.succeed(
+          `${chalk.green("Connected")} to ${target.label} (${target.model}) in ${Date.now() - start}ms`,
+        );
+        logger.log(`  Response: ${chalk.gray(reply)}`);
       } catch (err) {
         spinner.fail(`Test failed: ${err.message}`);
         process.exit(1);

package/src/data/changelog.json

@@ -1,6 +1,45 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.32",
+      "cliVersions": ["0.166.30", "0.166.32"],
+      "date": "2026-09-07",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.32: release-compatible web fetch and CI log recovery",
+          "body": "> `chainlesschain` **0.166.30 -> 0.166.32** (2026-09-07). The `0.166.31`\n> candidate was not published because two existing cache tests required the\n> flag-gated `node:sqlite` API on Node 22.12. Its immutable tag is retained.\n\n- Include the hostname-fetch repair, bounded request duration, structured errors\n  and repeated GitHub Actions log recovery prepared in the 0.166.31 candidate.\n- Exercise Desktop cache isolation and encrypted replay with the shipped SQLite\n  driver on the minimum supported Node 22.12, without skipping assertions.\n- Give Windows crash-recovery fixtures enough time to reach their intended\n  checkpoints before lease expiry, while preserving real expiry, stale-fence,\n  single-effect and rollback recovery checks.\n- Verify fresh Wiki-recovery worker instances with child-generated identities\n  bound to the spawned child, since Windows can reuse exited process IDs.\n- Require the complete CLI CI and CLI Strict Sandbox matrices for the new exact\n  release commit before npm publication."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.31",
+      "cliVersions": ["0.166.30", "0.166.31"],
+      "date": "2026-09-07",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.31: reliable web fetch and bounded CI log recovery",
+          "body": "> `chainlesschain` **0.166.30 -> 0.166.31** (2026-09-07). Publication requires\n> successful CLI CI and CLI Strict Sandbox matrices for the exact release commit.\n\n- Fix Node 22 multi-address DNS callbacks that caused hostname fetches to fail\n  with `Invalid IP address: undefined`, while preserving private-address checks.\n- Bound the full fetch duration, including redirects and streaming responses;\n  return structured HTTP, timeout and response-size errors with retry guidance.\n- Recognize repeated failed fetches and unchanged GitHub Actions logs across\n  web pages, `gh run view` and `gh api`; retain bounded evidence through context\n  compaction and offer a recovery turn before stopping persistent retry loops.\n- Preserve status monitoring, new job/log evidence and real local edits as\n  recovery paths, and never skip shell execution based on cached stdout.\n- Validate with 158 focused unit/integration tests covering network failures,\n  resource budgets, compaction, recovery and existing agent-loop behavior."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.30",
+      "cliVersions": ["0.166.29", "0.166.30"],
+      "date": "2026-09-07",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.30: custom LLM connections and page-first IDE workspaces",
+          "body": "> `chainlesschain` **0.166.29 -> 0.166.30** (2026-09-07), paired with\n> VS Code / VSCodium extension **0.37.87**. Publication requires the exact\n> release commit's complete CLI CI, CLI Strict Sandbox and IDE release gates.\n\n- Save custom relay URLs, protocol selections, model aliases and credentials\n  atomically with `llm configure`; accept secrets only through bounded JSON\n  stdin, never argv. Changing destinations requires a destination-specific key.\n- Test OpenAI-compatible, Anthropic, Gemini and Ollama endpoints using their\n  native protocols, bounded request timeouts and no credential-bearing redirects.\n- Open Evolution Workbench on a status overview with a version list, optional\n  filtering, evidence inspection and confirmed, capability-gated decisions.\n- Open the IDE Skill Library on a paginated catalog; task retrieval is optional\n  and preserves canonical digest/conflict/authority validation without execution.\n- Add an isolated source-checkout local Workbench test profile. Test identities\n  remain explicitly marked; this does not provision real identity or approval\n  services or enable mutation in an unconfigured production deployment."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.29",

package/src/lib/evolution/evolution-file-witness.js

@@ -21,6 +21,8 @@ const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}$/u;
 const DEFAULT_MAXIMUM_BYTES = 64 * 1024 * 1024;
 const MAXIMUM_CACHED_RECORDS = 1024;
 const MAXIMUM_CACHED_TEXT_BYTES = 16 * 1024 * 1024;
+const MAXIMUM_TRUST_EPOCH_CHARS = 256;
+const MAXIMUM_TRUST_EPOCH_RETRIES = 2;
 const STORE_KEYS = new Set([
   "current",
   "discardedAnchors",
@@ -140,6 +142,24 @@ function capture(owner, name) {
   return (...args) => Reflect.apply(owner[name], owner, args);
 }
 
+function captureOptional(owner, name) {
+  if (owner?.[name] === undefined) return null;
+  if (typeof owner[name] !== "function")
+    throw new TypeError(`${name} port must be a function`);
+  return (...args) => Reflect.apply(owner[name], owner, args);
+}
+
+function normalizeTrustEpoch(value) {
+  if (
+    typeof value !== "string" ||
+    value.trim() === "" ||
+    value.length > MAXIMUM_TRUST_EPOCH_CHARS
+  ) {
+    throw new Error("witness verifier trust epoch is invalid");
+  }
+  return value;
+}
+
 function sameTrust(value, trust) {
   return (
     value?.algorithm === trust.algorithm &&
@@ -192,6 +212,7 @@ export function createEvolutionFileWitness({
   const trust = normalizeTrust(trustInput);
   const sign = capture(signer, "sign");
   const verify = capture(verifier, "verify");
+  const readTrustEpoch = captureOptional(verifier, "getTrustEpoch");
   if (typeof lock !== "function" || typeof random !== "function") {
     throw new TypeError("witness lock and random ports are required");
   }
@@ -213,7 +234,7 @@ export function createEvolutionFileWitness({
       recordEncodings.size >= MAXIMUM_CACHED_RECORDS ||
       recordEncodings.has(record.witnessDigest)
     )
-      return;
+      return null;
     // Only flat scalar records may share field values with the cache. Caller
     // objects, signature objects and verifier buffers must never be retained.
     for (const key of RECORD_KEYS) {
@@ -223,7 +244,7 @@ export function createEvolutionFileWitness({
         value !== null &&
         !["string", "number", "boolean"].includes(typeof value)
       )
-        return;
+        return null;
     }
     for (const key of SIGNATURE_KEYS) {
       if (typeof record.signature[key] !== "string") return;
@@ -233,16 +254,19 @@ export function createEvolutionFileWitness({
     // strings (bounded by encoded.length). Entry count bounds object overhead;
     // this is not a claim about the entire process's RSS.
     const bytes = 2 * (message.length + 2 * encoded.length);
-    if (cachedTextBytes + bytes > MAXIMUM_CACHED_TEXT_BYTES) return;
+    if (cachedTextBytes + bytes > MAXIMUM_CACHED_TEXT_BYTES) return null;
     // Decode from the small owned encoding so parser substring backing stores
     // cannot retain the entire source history through one cached scalar/key.
     const ownedRecord = JSON.parse(encoded);
-    recordEncodings.set(ownedRecord.witnessDigest, {
+    const cached = {
       record: ownedRecord,
       message,
       encoded,
-    });
+      verifiedTrustEpoch: null,
+    };
+    recordEncodings.set(ownedRecord.witnessDigest, cached);
     cachedTextBytes += bytes;
+    return cached;
   };
   const encodeRecord = (record) =>
     cachedEncoding(record)?.encoded ?? canonical(record);
@@ -266,8 +290,15 @@ export function createEvolutionFileWitness({
     });
   };
 
-  const verifySigned = (record) => {
+  const verifySigned = (record, trustEpoch = null) => {
     const cached = cachedEncoding(record);
+    if (
+      cached &&
+      trustEpoch !== null &&
+      cached.verifiedTrustEpoch === trustEpoch
+    ) {
+      return record;
+    }
     if (cached) {
       // Reconsult the current verifier even for byte-identical historical
       // records. Give it fresh mutable inputs, not the cached representation.
@@ -281,6 +312,7 @@ export function createEvolutionFileWitness({
       ) {
         throw new Error("witness record authentication failed");
       }
+      cached.verifiedTrustEpoch = trustEpoch;
       return record;
     }
     assertExactKeys(record, RECORD_KEYS, "witness record");
@@ -372,10 +404,14 @@ export function createEvolutionFileWitness({
     ) {
       throw new Error("witness record state is inconsistent");
     }
-    rememberEncoding(record, encodedMessage);
+    const remembered = rememberEncoding(record, encodedMessage);
+    if (remembered) remembered.verifiedTrustEpoch = trustEpoch;
     return record;
   };
 
+  const currentTrustEpoch = () =>
+    readTrustEpoch === null ? null : normalizeTrustEpoch(readTrustEpoch());
+
   const emptyDiscardDigest = hash(
     Buffer.from(`${DISCARD_DOMAIN}${canonical([])}`, "utf8"),
   );
@@ -421,7 +457,7 @@ export function createEvolutionFileWitness({
       "witnessDigest",
       "evolution-ledger-witness",
     );
-    return verifySigned(record);
+    return verifySigned(record, currentTrustEpoch());
   };
 
   const emptyStore = () => {
@@ -434,7 +470,7 @@ export function createEvolutionFileWitness({
     };
   };
 
-  const validateStore = (store) => {
+  const validateStore = (store, trustEpoch = null) => {
     assertExactKeys(store, STORE_KEYS, "witness store");
     if (
       store.schema !== EVOLUTION_FILE_WITNESS_STORE_SCHEMA ||
@@ -479,7 +515,7 @@ export function createEvolutionFileWitness({
     }
     let discardIndex = 0;
     for (const [index, record] of store.history.entries()) {
-      verifySigned(record);
+      verifySigned(record, trustEpoch);
       if (index === 0) continue;
       const previous = store.history[index - 1];
       if (
@@ -512,7 +548,7 @@ export function createEvolutionFileWitness({
     if (
       discardIndex !== store.discardedAnchors.length ||
       store.current?.witnessDigest !== store.history.at(-1).witnessDigest ||
-      encodeRecord(verifySigned(store.current)) !==
+      encodeRecord(verifySigned(store.current, trustEpoch)) !==
         encodeRecord(store.history.at(-1))
     ) {
       throw new Error("witness current state is not its durable history");
@@ -564,9 +600,19 @@ export function createEvolutionFileWitness({
       ) {
         throw new Error("witness store changed while reading");
       }
-      return validateStore(
-        JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)),
+      const parsed = JSON.parse(
+        new TextDecoder("utf-8", { fatal: true }).decode(bytes),
       );
+      for (
+        let attempt = 0;
+        attempt < MAXIMUM_TRUST_EPOCH_RETRIES;
+        attempt += 1
+      ) {
+        const trustEpoch = currentTrustEpoch();
+        const store = validateStore(parsed, trustEpoch);
+        if (trustEpoch === currentTrustEpoch()) return store;
+      }
+      throw new Error("witness verifier trust epoch changed while reading");
     } finally {
       if (descriptor !== undefined) fsImpl.closeSync(descriptor);
     }

package/src/lib/evolution/evolution-ledger-file-backend.js

@@ -23,6 +23,11 @@ function capture(owner, name, label) {
   return Object.freeze((...args) => operation(...args));
 }
 
+function captureOptional(owner, name, label) {
+  if (owner?.[name] === undefined) return null;
+  return capture(owner, name, label);
+}
+
 function normalizeAuthority(value, label) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new TypeError(`${label} authority is required`);
@@ -34,6 +39,11 @@ function normalizeAuthority(value, label) {
     verifierIdentity: value.verifier,
     sign: capture(value.signer, "sign", `${label}.signer`),
     verify: capture(value.verifier, "verify", `${label}.verifier`),
+    getTrustEpoch: captureOptional(
+      value.verifier,
+      "getTrustEpoch",
+      `${label}.verifier`,
+    ),
   });
 }
 
@@ -123,7 +133,12 @@ export function createEvolutionLedgerFileBackend({
     filePath: paths.witnessPath,
     trust: witnessAuthority.trust,
     signer: { sign: witnessAuthority.sign },
-    verifier: { verify: witnessAuthority.verify },
+    verifier: {
+      verify: witnessAuthority.verify,
+      ...(witnessAuthority.getTrustEpoch === null
+        ? {}
+        : { getTrustEpoch: witnessAuthority.getTrustEpoch }),
+    },
     fsImpl,
     ...(lock === undefined ? {} : { lock }),
     ...(random === undefined ? {} : { random }),

package/src/lib/llm-connection-config.js

@@ -0,0 +1,131 @@
+import { BUILT_IN_PROVIDERS } from "./llm-providers.js";
+import {
+  setSecretConfigValue,
+  updateConfigAtomically,
+} from "./config-manager.js";
+
+export function normalizeLlmConnection(input) {
+  if (
+    !input ||
+    typeof input !== "object" ||
+    Array.isArray(input) ||
+    Object.keys(input).some(
+      (k) =>
+        ![
+          "provider",
+          "model",
+          "baseUrl",
+          "visionModel",
+          "apiKey",
+          "allowHttp",
+        ].includes(k),
+    )
+  )
+    throw new Error("Invalid LLM connection fields");
+  const value = {};
+  for (const key of ["provider", "model", "baseUrl", "visionModel", "apiKey"]) {
+    if (input[key] != null && typeof input[key] !== "string")
+      throw new Error(`Invalid ${key}`);
+    value[key] = (input[key] || "").trim();
+    if (value[key].length > (key === "apiKey" ? 8192 : 2048))
+      throw new Error(`${key} is too long`);
+  }
+  if (!Object.hasOwn(BUILT_IN_PROVIDERS, value.provider))
+    throw new Error("Choose a supported provider/protocol");
+  if (!value.model || /[\r\n\0]/.test(value.model + value.visionModel))
+    throw new Error("A valid model name is required");
+  let url;
+  try {
+    url = new URL(value.baseUrl);
+  } catch {
+    throw new Error("Invalid LLM Base URL");
+  }
+  if (
+    !["http:", "https:"].includes(url.protocol) ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash
+  )
+    throw new Error(
+      "Base URL must be HTTP(S), without credentials, query or fragment",
+    );
+  if (
+    url.protocol === "http:" &&
+    !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) &&
+    input.allowHttp !== true
+  )
+    throw new Error("Confirm unencrypted HTTP before using a remote endpoint");
+  if (
+    /\/(chat\/completions|messages|responses|api\/generate)\/?$/.test(
+      url.pathname,
+    )
+  )
+    throw new Error(
+      "Use the API base path, not a completion/messages endpoint",
+    );
+  value.baseUrl = url.href.replace(/\/+$/, "");
+  return value;
+}
+
+export function saveLlmConnection(input, { storage = "auto" } = {}) {
+  if (!["auto", "keychain", "file"].includes(storage))
+    throw new Error("Secret storage must be auto, keychain, or file");
+  const value = normalizeLlmConnection(input);
+  const mutate = (config) => {
+    const current = config.llm || {};
+    const sameEndpoint =
+      current.provider === value.provider &&
+      String(
+        current.baseUrl || BUILT_IN_PROVIDERS[current.provider]?.baseUrl || "",
+      ).replace(/\/+$/, "") === value.baseUrl;
+    if (
+      value.provider !== "ollama" &&
+      !value.apiKey &&
+      (!sameEndpoint || !current.apiKey)
+    )
+      throw new Error(
+        "A new endpoint requires its own API key; the existing key was not reused",
+      );
+    config.llm = {
+      ...current,
+      provider: value.provider,
+      model: value.model,
+      baseUrl: value.baseUrl,
+      visionModel: value.visionModel || null,
+    };
+  };
+  // A single lock and atomic rename bind endpoint and credential together.
+  // An interrupted save cannot route the old credential to the new endpoint.
+  if (value.apiKey)
+    setSecretConfigValue("llm.apiKey", value.apiKey, {
+      storage,
+      configMutator: mutate,
+    });
+  else updateConfigAtomically(mutate);
+  return {
+    provider: value.provider,
+    model: value.model,
+    baseUrl: value.baseUrl,
+    visionModel: value.visionModel || null,
+  };
+}
+
+export async function readLlmConnectionInput(stream = process.stdin) {
+  if (stream.isTTY)
+    throw new Error("Send the LLM configuration JSON through stdin");
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of stream) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    size += buffer.length;
+    if (size > 32768) throw new Error("LLM configuration input is too large");
+    chunks.push(buffer);
+  }
+  const input = Buffer.concat(chunks).toString("utf8");
+  try {
+    return JSON.parse(input);
+  } catch {
+    throw new Error("LLM configuration input must be valid JSON");
+  }
+}

package/src/lib/llm-connection-probe.js

@@ -0,0 +1,85 @@
+import { formatProviderResponseError } from "./provider-http-error.js";
+
+export async function probeLlmConnection(
+  target,
+  { fetchImpl = fetch, timeoutMs = 20_000 } = {},
+) {
+  const base = target.baseUrl.replace(/\/+$/, "");
+  const headers = { "Content-Type": "application/json" };
+  let url, body;
+  if (target.provider === "ollama") {
+    url = `${base}/api/generate`;
+    body = {
+      model: target.model,
+      prompt: "Say hi in one word.",
+      stream: false,
+    };
+  } else {
+    if (!target.apiKey) throw new Error("API key required");
+    if (target.provider === "anthropic") {
+      url = `${base}/messages`;
+      headers["x-api-key"] = target.apiKey;
+      headers["anthropic-version"] = "2023-06-01";
+      body = {
+        model: target.model,
+        max_tokens: 16,
+        messages: [{ role: "user", content: "Say hi in one word." }],
+      };
+    } else if (target.provider === "gemini") {
+      url = `${base}/models/${encodeURIComponent(target.model)}:generateContent`;
+      headers["x-goog-api-key"] = target.apiKey;
+      body = {
+        contents: [{ parts: [{ text: "Say hi in one word." }] }],
+        generationConfig: { maxOutputTokens: 16 },
+      };
+    } else {
+      url = `${base}/chat/completions`;
+      headers.Authorization = `Bearer ${target.apiKey}`;
+      body = {
+        model: target.model,
+        messages: [{ role: "user", content: "Say hi in one word." }],
+        max_tokens: 16,
+      };
+    }
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchImpl(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body),
+      signal: controller.signal,
+      redirect: "error",
+    });
+    if (!response.ok)
+      throw new Error(
+        await formatProviderResponseError(target.provider, response),
+      );
+    const data = await response.json();
+    const text =
+      target.provider === "ollama"
+        ? data.response
+        : target.provider === "anthropic"
+          ? data.content
+              ?.filter((p) => p.type === "text")
+              .map((p) => p.text)
+              .join("")
+          : target.provider === "gemini"
+            ? data.candidates?.[0]?.content?.parts
+                ?.map((p) => p.text || "")
+                .join("")
+            : data.choices?.[0]?.message?.content;
+    if (typeof text !== "string" || !text.trim())
+      throw new Error(
+        "The endpoint returned no model text; check the protocol and model",
+      );
+    return text.trim().slice(0, 100);
+  } catch (error) {
+    if (controller.signal.aborted)
+      throw new Error(`Connection test timed out after ${timeoutMs / 1000}s`);
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
+}