chainlesschain 0.166.43 → 0.166.45

package/src/commands/eval.js

@@ -19,12 +19,23 @@ import {
   formatTelemetry,
 } from "../lib/telemetry/span-recorder.js";
 import { computeTrend, formatTrend } from "../lib/eval/trend.js";
+import {
+  createEvalComparison,
+  createEvalHistoryRecord,
+  evalDigest,
+  evaluateStrictEvalGate,
+  EVAL_EXECUTION_PROTOCOL,
+  readComparisonContext,
+  readEvalHistory,
+} from "../lib/eval/evidence.js";
 
 export const _deps = {
   platform: process.platform,
   kill: process.kill.bind(process),
   spawn: executionBroker.spawn.bind(executionBroker),
   spawnSync: executionBroker.spawnSync.bind(executionBroker),
+  runEvalSuite,
+  getSuite,
 };
 
 /** Append a run summary as one JSONL line to the history file. */
@@ -32,26 +43,21 @@ function appendHistory(file, record) {
   fs.appendFileSync(file, JSON.stringify(record) + "\n", "utf8");
 }
 
-/** Read a JSONL eval-history file into an array of run records (skips bad lines). */
-function readHistory(file) {
-  if (!fs.existsSync(file)) return [];
-  const out = [];
-  for (const line of fs.readFileSync(file, "utf8").split(/\r?\n/)) {
-    const t = line.trim();
-    if (!t) continue;
-    try {
-      out.push(JSON.parse(t));
-    } catch {
-      /* skip a corrupt history line rather than abort the report */
-    }
-  }
-  return out;
-}
-
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // This file is src/commands/eval.js → the CLI entry is bin/chainlesschain.js.
 const BIN = path.resolve(__dirname, "..", "..", "bin", "chainlesschain.js");
 
+function verifyAgentTerminal(output) {
+  try {
+    const events = output.split(/\r?\n/u).filter((line) => line.trim()).map((line) => JSON.parse(line));
+    const results = events.filter((event) => event?.type === "result");
+    const terminal = results[0];
+    return results.length === 1 && events.at(-1) === terminal &&
+      terminal.subtype === "success" && terminal.is_error !== true &&
+      !events.some((event) => event?.type === "error");
+  } catch { return false; }
+}
+
 /**
  * Kill an agent child AND its tool grandchildren. A bare child.kill("SIGTERM")
  * only reaches the direct child (and on Windows TerminateProcess never reaches
@@ -111,7 +117,7 @@ function makeHeadlessRunAgent(opts = {}) {
           "--permission-mode",
           "acceptEdits",
           "--output-format",
-          "text",
+          "stream-json",
         ];
         if (opts.model) args.push("--model", opts.model);
         if (opts.provider) args.push("--provider", opts.provider);
@@ -136,7 +142,15 @@ function makeHeadlessRunAgent(opts = {}) {
         if (settled) return;
         settled = true;
         clearTimeout(graceTimer);
-        resolve(result);
+        resolve({
+          ...result,
+          executionEvidence: {
+            protocol: EVAL_EXECUTION_PROTOCOL,
+            exitCode: result.exitCode ?? null,
+            signal: result.signal ?? null,
+            terminalVerified: result.terminalVerified === true,
+          },
+        });
       };
       const timer = setTimeout(() => {
         // Kill the WHOLE tree, then settle on `close` — resolving immediately
@@ -162,17 +176,27 @@ function makeHeadlessRunAgent(opts = {}) {
         clearTimeout(timer);
         done({ ok: false, output: out, error: e.message });
       });
-      child.on("close", (code) => {
+      child.on("close", (code, signal) => {
         clearTimeout(timer);
         if (timedOut) {
           done({
             ok: false,
             output: out,
+            exitCode: code,
+            signal: signal || null,
             error: `timed out after ${timeoutMs || 120000}ms`,
           });
           return;
         }
-        done({ ok: code === 0, output: out, error: code === 0 ? null : err });
+        const terminalVerified = !opts._argv && verifyAgentTerminal(out);
+        const ok = code === 0 && !signal && (opts._argv || terminalVerified);
+        done({
+          ok: Boolean(ok), output: out, exitCode: code, signal: signal || null,
+          terminalVerified,
+          error: ok ? null : code === 0 && !signal
+            ? "agent stream lacks a valid success terminal"
+            : err || `agent process exited with ${signal || code}`,
+        });
       });
     });
   };
@@ -211,14 +235,22 @@ export function registerEvalCommand(program, { logger } = {}) {
     )
     .option(
       "--trend",
-      "Report the pass-rate trend from --history instead of running (CI gate)",
+      "Report the diagnostic pass-rate trend from --history instead of running",
     )
+    .option("--strict", "With --trend: require complete, comparable recent evidence; legacy history cannot pass")
+    .option("--max-age-hours <hours>", "With --strict: maximum age of both compared runs", "168")
+    .option("--comparison-context <file>", "Bind explicit provider/model to operator-declared modelRevision and environment/permission/inference digests (not production attestation)")
     .option(
       "--regression-threshold <pct>",
       "With --trend: pass-rate drop (in points) that fails the gate on its own",
       "0",
     )
     .action(async (options) => {
+      if (options.strict && !options.trend) {
+        (log.error || console.error)("--strict requires --trend --history <file>");
+        process.exitCode = 1;
+        return;
+      }
       // Trend mode: don't run the suite — read the recorded history and report
       // the pass-rate trend + per-task regressions. This is the release-pipeline
       // consumer (the runs themselves need a real model; the report is pure).
@@ -228,19 +260,50 @@ export function registerEvalCommand(program, { logger } = {}) {
           process.exitCode = 1;
           return;
         }
-        const runs = readHistory(options.history);
-        const threshold =
-          Math.max(0, Number(options.regressionThreshold) || 0) / 100;
-        const trend = computeTrend(runs, { regressionThreshold: threshold });
+        let history;
+        try { history = readEvalHistory(options.history); }
+        catch {
+          history = { runs: [], issues: [{ code: "history_unreadable" }] };
+        }
+        const threshold = Number(options.regressionThreshold) / 100;
+        if (options.strict) {
+          const gate = evaluateStrictEvalGate(history, {
+            maxAgeMs: Number(options.maxAgeHours) * 60 * 60 * 1000,
+            regressionThreshold: threshold,
+          });
+          if (options.json) console.log(JSON.stringify(gate, null, 2));
+          else (log.log || console.log)(
+            `Eval comparison: ${gate.status}\n` +
+            `  Scope: local configuration comparison; operator declarations are not production attestation.\n` +
+            (gate.reasons.length ? `  ${gate.reasons.join(", ")}` : "  Comparable executions and candidate checks passed."),
+          );
+          if (!gate.passed) process.exitCode = 1;
+          return;
+        }
+        const trend = computeTrend(history.runs, { regressionThreshold: Math.max(0, threshold || 0) });
+        if (history.issues.length) trend.historyIssues = history.issues;
         if (options.json) console.log(JSON.stringify(trend, null, 2));
-        else (log.log || console.log)(formatTrend(trend));
+        else {
+          (log.log || console.log)(formatTrend(trend));
+          if (history.issues.length) (log.error || console.error)("History contains invalid or unreadable records; this diagnostic is not release evidence.");
+        }
         if (trend.regressed) process.exitCode = 1;
         return;
       }
 
       let tasks;
+      let comparison;
       try {
-        tasks = getSuite(options.suite);
+        tasks = _deps.getSuite(options.suite);
+        comparison = createEvalComparison({
+          suite: options.suite,
+          corpusDigest: evalDigest(fs.readFileSync(new URL("../lib/eval/tasks.js", import.meta.url))),
+          provider: options.provider,
+          model: options.model,
+          context: options.comparisonContext
+            ? readComparisonContext(options.comparisonContext, { provider: options.provider, model: options.model })
+            : null,
+        });
       } catch (err) {
         log.error ? log.error(err.message) : console.error(err.message);
         process.exitCode = 1;
@@ -256,7 +319,7 @@ export function registerEvalCommand(program, { logger } = {}) {
       // OTel-shaped telemetry for the run (per-task span + failure class).
       const recorder = new TelemetryRecorder({ serviceName: "cc-eval" });
 
-      const summary = await runEvalSuite(tasks, {
+      const summary = await _deps.runEvalSuite(tasks, {
         runAgent,
         recorder,
         keepWorkspaces: options.keep === true,
@@ -272,6 +335,11 @@ export function registerEvalCommand(program, { logger } = {}) {
                       : ""),
               ),
       });
+      const record = createEvalHistoryRecord(summary, {
+        comparison,
+        dryRun: options.dryRun === true,
+        label: options.label || null,
+      });
 
       if (options.otlp) {
         try {
@@ -296,28 +364,15 @@ export function registerEvalCommand(program, { logger } = {}) {
       // pass/fail + a timestamp/label — so `cc eval --trend` can chart it).
       if (options.history) {
         try {
-          appendHistory(options.history, {
-            ranAt: new Date().toISOString(),
-            label: options.label || null,
-            // Tagged so --trend can exclude it: a dry-run is always 0% and
-            // would otherwise report every passing task as a regression.
-            ...(options.dryRun ? { dryRun: true } : {}),
-            passed: summary.passed,
-            total: summary.total,
-            passRate: summary.passRate,
-            unrelatedChangeRate: summary.unrelatedChangeRate,
-            results: (summary.results || []).map((r) => ({
-              id: r.id,
-              pass: r.pass,
-            })),
-          });
+          appendHistory(options.history, record);
         } catch (e) {
           (log.error || console.error)(`  history write failed: ${e.message}`);
+          process.exitCode = 1;
         }
       }
 
       if (options.json) {
-        console.log(JSON.stringify(summary, null, 2));
+        console.log(JSON.stringify({ ...summary, ...record }, null, 2));
       } else {
         // Per-task lines already streamed via onResult; print the summary +
         // the telemetry metrics (durations / failure classification).
@@ -336,7 +391,7 @@ export function registerEvalCommand(program, { logger } = {}) {
         }
       }
       // Non-zero exit when not every task passed — usable as a CI gate.
-      if (summary.passed < summary.total) process.exitCode = 1;
+      if (summary.total === 0 || summary.passed < summary.total) process.exitCode = 1;
     });
   return program;
 }

package/src/commands/evolution-deployment.js

@@ -3,6 +3,7 @@ import { logger } from "../lib/logger.js";
 import {
   configureEvolutionDeployment,
   getEvolutionDeploymentStatus,
+  revokeEvolutionDeploymentDescriptorRevisions,
   setEvolutionDeploymentEnabled,
 } from "../lib/evolution/evolution-deployment-config.js";
 
@@ -21,8 +22,24 @@ function printStatus(status) {
     logger.log(`  Descriptor:      ${status.descriptorPath}`);
   if (status.trustRootPath)
     logger.log(`  Trust root:      ${status.trustRootPath}`);
+  if (status.activeTrustRootDigest)
+    logger.log(`  Active root:     ${status.activeTrustRootDigest}`);
+  if (status.revisionFloor)
+    logger.log(`  Revision floor:  ${status.revisionFloor}`);
   if (status.commands?.length)
     logger.log(`  Commands:        ${status.commands.join(", ")}`);
+  if (status.readiness) {
+    for (const command of ["ask", "agent"]) {
+      const admission = status.readiness[command];
+      if (admission)
+        logger.log(
+          `  ${command} admission: ${admission.state} — ${admission.detail}`,
+        );
+    }
+    logger.log(
+      "  Runtime:         not checked (host composition and model execution)",
+    );
+  }
   if (status.error) logger.log(chalk.red(`  Error:           ${status.error}`));
 }
 
@@ -38,6 +55,16 @@ function fail(error, json) {
   process.exitCode = 1;
 }
 
+/** Standalone configuration route: never assemble the configured host. */
+export function registerEvolutionDeploymentCommand(program) {
+  const evolution = program
+    .command("evolution")
+    .description(
+      "Evolution metrics and governance records — not model training or active Skill promotion",
+    );
+  registerEvolutionDeploymentCommands(evolution);
+}
+
 export function registerEvolutionDeploymentCommands(parent) {
   const deployment = parent
     .command("deployment")
@@ -60,6 +87,14 @@ export function registerEvolutionDeploymentCommands(parent) {
     .description("Verify, save, and enable a signed deployment")
     .requiredOption("--descriptor <path>", "Absolute signed descriptor path")
     .requiredOption("--trust-root <path>", "Absolute Ed25519 public key path")
+    .option(
+      "--root-rotation <path>",
+      "Certificate signed by the current root when changing trust roots",
+    )
+    .option(
+      "--descriptor-revocations <path>",
+      "Signed descriptor-revocation record for this trust root",
+    )
     .option("--disabled", "Save without enabling")
     .option("--json", "Output as JSON")
     .action(async (options) => {
@@ -68,6 +103,8 @@ export function registerEvolutionDeploymentCommands(parent) {
           await configureEvolutionDeployment({
             descriptorPath: options.descriptor,
             trustRootPath: options.trustRoot,
+            rootRotationPath: options.rootRotation || null,
+            revocationPath: options.descriptorRevocations || null,
             enabled: options.disabled !== true,
           }),
           options.json,
@@ -92,4 +129,25 @@ export function registerEvolutionDeploymentCommands(parent) {
         }
       });
   }
+
+  deployment
+    .command("revoke")
+    .description("Record signed descriptor revocations and disable the profile")
+    .requiredOption(
+      "--descriptor-revocations <path>",
+      "Signed descriptor-revocation record for the active trust root",
+    )
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+      try {
+        output(
+          await revokeEvolutionDeploymentDescriptorRevisions({
+            revocationPath: options.descriptorRevocations,
+          }),
+          options.json,
+        );
+      } catch (error) {
+        fail(error, options.json);
+      }
+    });
 }

package/src/commands/hub.js

@@ -3448,13 +3448,19 @@ function _defaultKnownVendors() {
 
 export function registerHubCommand(program, dependencies = {}) {
   const factory = readEvolutionCompositionFactory(dependencies);
-  const invocationOptions = (options) =>
-    factory === null
-      ? options
-      : {
-          ...options,
-          _getHub: () => getGovernedAnalysisHub(factory),
-        };
+  const invocationOptions = (options) => {
+    if (factory === null) {
+      const error = new Error(
+        "Hub model egress requires an authenticated evolution composition factory",
+      );
+      error.code = "CC_AGENT_EVOLUTION_INGRESS_FAILED";
+      throw error;
+    }
+    return {
+      ...options,
+      _getHub: () => getGovernedAnalysisHub(factory),
+    };
+  };
   const hub = program
     .command("hub")
     .description(

package/src/commands/setup.js

@@ -26,6 +26,10 @@ import {
   askPassword,
 } from "../lib/prompts.js";
 import logger from "../lib/logger.js";
+import {
+  assessEvolutionDeploymentReadiness,
+  getEvolutionDeploymentStatus,
+} from "../lib/evolution/evolution-deployment-config.js";
 
 export function registerSetupCommand(program) {
   program
@@ -180,6 +184,24 @@ async function runSetup(options) {
   }
   logger.success("Configuration saved");
 
+  // Saving a provider setting does not itself authorize a content-bearing
+  // request. Check command-specific deployment admission without executing the
+  // host module; a successful preflight is not a model execution probe.
+  const modelReadiness = assessEvolutionDeploymentReadiness(
+    await getEvolutionDeploymentStatus(),
+  );
+  if (modelReadiness.ready) {
+    logger.success("Signed deployment admits ask and agent");
+    logger.info(
+      "Runtime composition and model execution will be checked when you run a task.",
+    );
+  } else {
+    logger.warn(
+      `Model deployment prerequisites not met: ${modelReadiness.detail}`,
+    );
+    logger.info(`To enable it: ${modelReadiness.remediation}`);
+  }
+
   // Step 8: Docker services
   if (!options.skipServices && dockerOk && composeOk) {
     logger.newline();
@@ -207,7 +229,15 @@ async function runSetup(options) {
 
   // Done
   logger.newline();
-  logger.log(chalk.bold.green("  Setup complete!\n"));
+  logger.log(
+    modelReadiness.ready
+      ? chalk.bold.green(
+          "  Setup saved; deployment prerequisites checked (model execution not tested).\n",
+        )
+      : chalk.bold.yellow(
+          "  Setup saved; ask/agent deployment prerequisites remain incomplete.\n",
+        ),
+  );
   logger.log("  Next steps:");
   logger.log(
     `    ${chalk.cyan("chainlesschain start")}      Launch the desktop app`,

package/src/constants.js

@@ -30,7 +30,7 @@ export const LLM_PROVIDERS = {
   volcengine: {
     name: "Volcengine (火山引擎/豆包)",
     defaultBaseUrl: "https://ark.cn-beijing.volces.com/api/v3",
-    defaultModel: "deepseek-v4-flash-260425",
+    defaultModel: "deepseek-v4-flash-ga-260731",
     requiresApiKey: true,
   },
   openai: {
@@ -144,7 +144,7 @@ export const DEFAULT_CONFIG = {
     provider: "volcengine",
     apiKey: null,
     baseUrl: "https://ark.cn-beijing.volces.com/api/v3",
-    model: "deepseek-v4-flash-260425",
+    model: "deepseek-v4-flash-ga-260731",
     // When true, `cc ask` (provider=ollama only) overrides baseUrl to point at
     // the Android LocalLlmServer (127.0.0.1:18484). User opt-in toggle:
     //   cc config set llm.preferAndroidLocal true