chainlesschain 0.166.48 → 0.166.58

package/src/lib/llm-config-defaults.js

@@ -55,6 +55,7 @@ export async function reconcileConfigLlmProvider(cfgLlm = {}) {
 }
 
 import { resolveApiKeyFromHelper } from "./api-key-helper.js";
+import { modelForeignToProvider } from "./runnable-provider.js";
 
 /**
  * Key backfill order: config llm.apiKey (plaintext, legacy) first, then
@@ -111,12 +112,27 @@ function optionalModel(value) {
   return model || null;
 }
 
+/**
+ * Claude settings and ANTHROPIC_MODEL carry a model name but no provider.
+ * Do not pair an unmistakably provider-specific inherited model with another
+ * configured provider. Explicit CLI/--settings choices may opt out because
+ * they provide the user's intent for this invocation.
+ */
+export function inheritedModelCompatible(provider, model) {
+  const candidate = optionalModel(model);
+  return (
+    !candidate || !provider || !modelForeignToProvider(provider, candidate)
+  );
+}
+
 /**
  * Resolve the model precedence used by `cc agent` without allowing a default
  * from one source to silently outrank an explicit choice from another:
  *
- *   CLI --model > ANTHROPIC_MODEL > settings.model > config/organization model
- *   > ANTHROPIC_DEFAULT_MODEL (new sessions only) > runtime provider default.
+ *   CLI --model > provider-compatible ANTHROPIC_MODEL/settings.model >
+ *   config/organization model > ANTHROPIC_DEFAULT_MODEL (new sessions only)
+ *   > runtime provider default. An explicit --settings file or managed setting
+ *   may authorize a foreign-looking alias for a custom provider endpoint.
  *
  * Environment values are supplied by the caller from the process startup
  * environment, before settings-file `env` entries are merged. That prevents a
@@ -128,18 +144,25 @@ export function applyAgentModelDefaults(options = {}, cfgLlm = {}, opts = {}) {
   const settingsModel = optionalModel(opts.settingsModel);
   const defaultModel = optionalModel(opts.anthropicDefaultModel);
 
-  if (!explicitModel) {
-    if (environmentModel) {
-      options.model = environmentModel;
-    } else if (settingsModel) {
-      options.model = settingsModel;
-    }
+  let inheritedModel = environmentModel || settingsModel;
+  const targetProvider = options.provider || cfgLlm.provider;
+  if (
+    inheritedModel &&
+    opts.allowForeignInheritedModel !== true &&
+    !inheritedModelCompatible(targetProvider, inheritedModel)
+  ) {
+    if (options.model === inheritedModel) delete options.model;
+    inheritedModel = null;
+  }
+
+  if (!explicitModel && inheritedModel) {
+    options.model = inheritedModel;
   }
 
   applyConfigLlmDefaults(options, cfgLlm, {
     // Reuse the existing config/provider wiring, but do not let its configured
     // model overwrite one selected by a higher-priority source above.
-    explicitModel: explicitModel || environmentModel || settingsModel,
+    explicitModel: explicitModel || inheritedModel,
   });
 
   if (!options.model && opts.isNewSession !== false && defaultModel) {

package/src/lib/model-context-window.js

@@ -2,6 +2,7 @@ import { resolveModelCapabilityProfile } from "./model-capabilities.js";
 
 export { CONTEXT_WINDOWS } from "./model-context-catalog.js";
 
-export function getContextWindow(model, provider) {
-  return resolveModelCapabilityProfile({ model, provider }).contextWindowTokens;
+export function getContextWindow(model, provider, options = {}) {
+  return resolveModelCapabilityProfile({ ...options, model, provider })
+    .contextWindowTokens;
 }

package/src/lib/read-file-loop-guard.js

@@ -30,6 +30,46 @@ export class ReadFileLoopGuard {
     this.recoveryOfferedAt = 0;
     this.batch = null;
     this.largeOutputs = new Set();
+    this.editRecoveryReads = new Map();
+  }
+
+  recordEditRecovery(result) {
+    if (result?.success === true && result.path) {
+      this.editRecoveryReads.delete(keyFor(result.path, { hashed: true }));
+      return;
+    }
+    const request = result?.recoveryRead;
+    if (
+      !request ||
+      !["hash_mismatch", "content_mismatch"].includes(result.error)
+    )
+      return;
+    const key = keyFor(request.path, { hashed: true });
+    // One refresh per file until an edit succeeds. Repeating the failed edit
+    // must not mint an unlimited read allowance.
+    if (
+      !this.editRecoveryReads.has(key) &&
+      this.editRecoveryReads.size < MAX_FILES
+    ) {
+      this.editRecoveryReads.set(key, { ...request, used: false });
+    }
+  }
+
+  get hasEditRecoveryReads() {
+    return [...this.editRecoveryReads.values()].some((entry) => !entry.used);
+  }
+
+  canRecoverEdit(filePath, args = {}) {
+    const entry = this.editRecoveryReads.get(keyFor(filePath, args));
+    return !!(
+      entry &&
+      !entry.used &&
+      args.hashed === true &&
+      args.raw !== true &&
+      args.column == null &&
+      args.offset === entry.offset &&
+      args.limit === entry.limit
+    );
   }
 
   startBatch() {
@@ -51,6 +91,16 @@ export class ReadFileLoopGuard {
     }
     let page = readPage(args);
     if (page.error || !page.readSpan) return page;
+    if (this.canRecoverEdit(filePath, args)) {
+      this.editRecoveryReads.get(key).used = true;
+      // The authorized read implementation has already refreshed stat/content.
+      // Return the requested anchors even if ordinary coverage is exhausted.
+      return {
+        ...page,
+        readRecovery: { action: "edit-anchor-refresh" },
+        readProgress: { newContent: false },
+      };
+    }
     const span = page.readSpan;
     const covered = entry.spans.some(
       ([start, end]) => start <= span.start && end >= span.end,
@@ -160,6 +210,8 @@ export class ReadFileLoopGuard {
     )
       return;
     if (tool === "read_file") {
+      if (result?.readRecovery?.action === "edit-anchor-refresh")
+        this.batch.advanced = true;
       if (result?.readProgress?.newContent === true) this.batch.advanced = true;
       if (result?.readProgress?.newContent === false) this.batch.duplicates++;
     } else if (
@@ -207,12 +259,14 @@ export class ReadFileLoopGuard {
 
   get hasRecoveryReads() {
     return (
+      this.hasEditRecoveryReads ||
       this.hasUnreadPages ||
       [...this.progress.values()].some((entry) => entry.rereads.size < 3)
     );
   }
 
   canContinue(filePath, args = {}) {
+    if (this.canRecoverEdit(filePath, args)) return true;
     const entry = this.progress.get(keyFor(filePath, args));
     return (
       entry?.summary?.reachedEnd === false ||

package/src/lib/remote-read-loop-guard.js

@@ -1,4 +1,6 @@
 import { createHash } from "node:crypto";
+import { diagnosticExcerpt } from "./diagnostic-excerpt.js";
+import { DIAGNOSTIC_WORKFLOW_GUIDANCE } from "./diagnostic-workflow.js";
 
 const MAX_TARGETS = 32;
 const RECOVERY_AFTER = 3;
@@ -196,19 +198,7 @@ function failedResult(result) {
 }
 
 function excerpt(value) {
-  const text = typeof value === "string" ? value : JSON.stringify(value ?? "");
-  if (text.length <= 1600) return text;
-  // Retain failure lines from full CI logs as well as the opening context.
-  const failures = text
-    .split("\n")
-    .filter((line) => /FAIL|Error:|AssertionError|error TS|×|✕/.test(line))
-    .slice(0, 12)
-    .join("\n");
-  return (
-    text.slice(0, 400) +
-    "\n[excerpt]\n" +
-    (failures || text.slice(-1100)).slice(0, 1100)
-  );
+  return diagnosticExcerpt(value);
 }
 
 /** Per agentLoop, independent of history compaction and other agents' evidence. */
@@ -290,13 +280,19 @@ export class RemoteReadLoopGuard {
     this.activeKey = target.key;
     const previous = this.targets.get(target.key);
     const digests = previous?.digests || new Set();
-    const content =
+    const primaryContent =
       result?.output ??
       result?.stdout ??
       result?.content ??
       result?.matches ??
       result?.body ??
       "";
+    const content =
+      result?.stdout_diagnostics || result?.stderr_diagnostics
+        ? [result.stdout_diagnostics, result.stderr_diagnostics, primaryContent]
+            .filter(Boolean)
+            .join("\n")
+        : primaryContent;
     const digest = createHash("sha256")
       .update(typeof content === "string" ? content : JSON.stringify(content))
       .digest("hex");
@@ -453,6 +449,8 @@ export class RemoteReadLoopGuard {
         "An aggregate or incomplete-matrix gate can be a downstream symptom; inspect the dependency jobs' conclusions before assuming that the gate itself is wrong. " +
         "When a job is cancelled or logs are unavailable, record that fact and the command error; do not cycle through the same web page and log downloads. " +
         "Use one focused run/job metadata query to resolve the missing status or cancellation reason, then inspect the relevant workflow and make the justified, authorized fix with validation. " +
+        DIAGNOSTIC_WORKFLOW_GUIDANCE +
+        " " +
         "If available evidence cannot establish a fix, report the specific missing evidence and what was verified. Do not disable a release or safety gate just to make CI pass. " +
         "For a research/review request, synthesize the findings without unsolicited edits; for monitoring, use status queries instead of repeated logs."
       );

package/src/lib/runtime-usage-ledger.js

@@ -162,6 +162,11 @@ export function projectRuntimeTokenUsage(event = {}) {
     ...(projectedOperationId ? { operationId: projectedOperationId } : {}),
     ...(event.source ? { source: source(event.source) } : {}),
     ...(attribution ? { attribution } : {}),
+    ...(Number.isSafeInteger(event.contextWindow) &&
+    event.contextWindow >= 1024 &&
+    event.contextWindow <= 16777216
+      ? { contextWindow: event.contextWindow }
+      : {}),
   };
 }
 

package/src/lib/session-message-fabric.js

@@ -31,6 +31,31 @@ export const SESSION_MESSAGE_POLICIES = Object.freeze([
   "refuse",
 ]);
 
+// Windows can briefly retain a handle on a just-written state file while an
+// antivirus scanner, indexer, or another process observes it. Retrying the
+// atomic write is safe while this process still owns the state lock: no
+// business mutation is re-run, and no error after the final rename is retried.
+// Keep this deliberately short so genuine filesystem failures remain
+// fail-closed.
+const TRANSIENT_ATOMIC_WRITE_ERROR_CODES = new Set([
+  "EACCES",
+  "EBUSY",
+  "EPERM",
+]);
+const MAX_ATOMIC_WRITE_ATTEMPTS = 5;
+
+function waitForAtomicWriteRetry(attempt) {
+  const delayMs = Math.min(100, 5 * 2 ** attempt);
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, delayMs);
+  } catch {
+    const deadline = Date.now() + delayMs;
+    while (Date.now() < deadline) {
+      // SharedArrayBuffer is unavailable only in constrained runtimes.
+    }
+  }
+}
+
 export const SESSION_MESSAGE_RECEIPT_STATUSES = Object.freeze([
   "delivered",
   "held",
@@ -756,50 +781,62 @@ export class SessionMessageFabric {
 
   _writeState(state) {
     const directory = path.dirname(this.statePath);
-    const temporary = path.join(
-      directory,
-      `.${path.basename(this.statePath)}.${process.pid}.${this._createId()}.tmp`,
-    );
-    let descriptor = null;
-    try {
-      descriptor = fs.openSync(temporary, "wx", 0o600);
-      fs.writeFileSync(
-        descriptor,
-        `${JSON.stringify(state, null, 2)}\n`,
-        "utf8",
+    const serialized = `${JSON.stringify(state, null, 2)}\n`;
+    let lastCause;
+    for (let attempt = 0; attempt < MAX_ATOMIC_WRITE_ATTEMPTS; attempt += 1) {
+      const temporary = path.join(
+        directory,
+        `.${path.basename(this.statePath)}.${process.pid}.${this._createId()}.tmp`,
       );
-      fs.fsyncSync(descriptor);
-      fs.closeSync(descriptor);
-      descriptor = null;
-      fs.renameSync(temporary, this.statePath);
-      if (process.platform !== "win32") {
-        const directoryDescriptor = fs.openSync(directory, "r");
-        try {
-          fs.fsyncSync(directoryDescriptor);
-        } finally {
-          fs.closeSync(directoryDescriptor);
+      let descriptor = null;
+      let renamed = false;
+      try {
+        descriptor = fs.openSync(temporary, "wx", 0o600);
+        fs.writeFileSync(descriptor, serialized, "utf8");
+        fs.fsyncSync(descriptor);
+        fs.closeSync(descriptor);
+        descriptor = null;
+        fs.renameSync(temporary, this.statePath);
+        renamed = true;
+        if (process.platform !== "win32") {
+          const directoryDescriptor = fs.openSync(directory, "r");
+          try {
+            fs.fsyncSync(directoryDescriptor);
+          } finally {
+            fs.closeSync(directoryDescriptor);
+          }
+        }
+        return;
+      } catch (cause) {
+        lastCause = cause;
+        if (descriptor != null) {
+          try {
+            fs.closeSync(descriptor);
+          } catch {
+            // Preserve the original write failure.
+          }
         }
-      }
-    } catch (cause) {
-      if (descriptor != null) {
         try {
-          fs.closeSync(descriptor);
+          fs.unlinkSync(temporary);
         } catch {
-          // Preserve the original write failure.
+          // The rename may already have committed, or no temporary was created.
         }
+        if (
+          renamed ||
+          !TRANSIENT_ATOMIC_WRITE_ERROR_CODES.has(cause?.code) ||
+          attempt + 1 >= MAX_ATOMIC_WRITE_ATTEMPTS
+        ) {
+          break;
+        }
+        waitForAtomicWriteRetry(attempt);
       }
-      try {
-        fs.unlinkSync(temporary);
-      } catch {
-        // The rename may already have committed, or no temporary was created.
-      }
-      throw fabricError(
-        SESSION_MESSAGE_FABRIC_ERROR_CODES.STATE_UNAVAILABLE,
-        "Could not atomically persist session message state",
-        {},
-        cause,
-      );
     }
+    throw fabricError(
+      SESSION_MESSAGE_FABRIC_ERROR_CODES.STATE_UNAVAILABLE,
+      "Could not atomically persist session message state",
+      {},
+      lastCause,
+    );
   }
 
   _transaction(mutator, { expectedRevision = null } = {}) {

package/src/lib/shell-output.js

@@ -0,0 +1,30 @@
+import { diagnosticExcerpt } from "./diagnostic-excerpt.js";
+
+/** Page size includes JSON escaping so later serialization does not lose data. */
+export function shellOutputPage(value, budget) {
+  const text = String(value ?? "");
+  let low = 0;
+  let high = Math.min(text.length, budget);
+  while (low < high) {
+    const mid = Math.ceil((low + high) / 2);
+    if (JSON.stringify(text.slice(0, mid)).length <= budget) low = mid;
+    else high = mid - 1;
+  }
+  if (low > 0 && /[\uD800-\uDBFF]/.test(text[low - 1])) low--;
+  return { text: text.slice(0, low), remaining: text.length - low };
+}
+
+/** Foreground commands cannot be repolled; expose omitted diagnostic context. */
+export function shellOutputPreview(value, field, budget) {
+  const text = String(value ?? "");
+  const page = shellOutputPage(text, budget);
+  if (!page.remaining) return { [field]: page.text };
+  return {
+    [`${field}_truncated`]: true,
+    [`${field}_total_chars`]: text.length,
+    [`${field}_diagnostics`]: diagnosticExcerpt(text),
+    [field]: page.text,
+    output_hint:
+      "Output is incomplete. Diagnostic excerpts are source evidence, not a root-cause verdict. For long reproductions use run_in_background and drain check_shell with task_id; preserve a full CI log once before filtering it.",
+  };
+}

package/src/lib/task-progress-tracker.js

@@ -1,5 +1,7 @@
 import { createHash } from "node:crypto";
 import { remoteReadTarget } from "./remote-read-loop-guard.js";
+import { diagnosticExcerpt } from "./diagnostic-excerpt.js";
+import { DIAGNOSTIC_WORKFLOW_GUIDANCE } from "./diagnostic-workflow.js";
 
 // Discovery and bookkeeping are useful, but are not evidence that the task
 // advanced. In particular, dispatching a child must not buy a fresh budget.
@@ -82,6 +84,7 @@ export class TaskProgressTracker {
     this.lastActions = [];
     this.remoteInspections = [];
     this.localFindings = [];
+    this.diagnostics = [];
   }
 
   retainChildResult(id, result, owner = "root") {
@@ -121,6 +124,82 @@ export class TaskProgressTracker {
         typeof args.old_string === "string" &&
         args.old_string === args.new_string);
 
+    // Preserve observed reproduction results through compaction, including
+    // failed runs and completed background tasks. They do not establish that
+    // the original CI failure was reproduced or fixed.
+    if (
+      ["run_shell", "run_code", "check_shell"].includes(tool) &&
+      result?.code !== "CC_TOOL_RECOVERY_PAUSED" &&
+      !(tool === "check_shell" && !args.task_id)
+    ) {
+      const taskId = result?.task_id || args.task_id || null;
+      const previous =
+        taskId &&
+        this.diagnostics.find(
+          (entry) => entry.owner === owner && entry.taskId === taskId,
+        );
+      const output = [
+        result?.stdout_diagnostics,
+        result?.stderr_diagnostics,
+        result?.error,
+        result?.output,
+        result?.stdout,
+        result?.stderr,
+      ]
+        .filter(Boolean)
+        .join("\n");
+      if (output || taskId || Number.isInteger(result?.exitCode)) {
+        const command = args.command || result?.command || args.code || "";
+        const remoteTarget = remoteReadTarget(tool, args);
+        const entry = {
+          owner,
+          tool,
+          taskId,
+          observedAt: this.now(),
+          remoteTarget: remoteTarget?.key || previous?.remoteTarget || null,
+          source:
+            previous?.source ||
+            (remoteTarget?.github || isRemoteInspectionCommand(command)
+              ? "remote-inspection"
+              : "local-execution"),
+          invocation: boundedText(command || previous?.invocation, 1000),
+          invocationTruncated: command
+            ? command.length > 1000
+            : previous?.invocationTruncated || false,
+          exitCode: result?.exitCode ?? result?.exit_code ?? null,
+          status:
+            result?.status ||
+            (result?.background ? "running" : failed ? "failed" : "completed"),
+          outputLost:
+            previous?.outputLost === true ||
+            !!result?.stdout_dropped_bytes ||
+            !!result?.stderr_dropped_bytes,
+          outputIncomplete:
+            previous?.outputLost === true ||
+            result?.has_more_output === true ||
+            result?.stdout_truncated === true ||
+            result?.stderr_truncated === true ||
+            result?.truncated === true ||
+            !!result?.stdout_dropped_bytes ||
+            !!result?.stderr_dropped_bytes,
+          output: diagnosticExcerpt(
+            [previous?.output, output].filter(Boolean).join("\n"),
+            1200,
+          ),
+        };
+        const owned = [
+          ...this.diagnostics.filter(
+            (item) => item.owner === owner && item !== previous,
+          ),
+          entry,
+        ].slice(-4);
+        this.diagnostics = [
+          ...this.diagnostics.filter((item) => item.owner !== owner),
+          ...owned,
+        ].slice(-MAX_CHECKPOINT_OWNERS * 4);
+      }
+    }
+
     if (!failed && (tool === "search_files" || tool === "read_file")) {
       const evidence = result.content ?? result.matches ?? result.output;
       const excerpt = boundedText(
@@ -252,6 +331,8 @@ export class TaskProgressTracker {
         message +
         " For an implementation task, make the smallest justified, authorized change and validate it. " +
         "For a bug fix, state the observed failure, your leading root-cause hypothesis and the smallest test that can disprove it. Run that focused reproduction or diagnostic next; use its actual output to choose the next step. Do not keep reading adjacent files without naming the specific missing fact. A timeout alone does not establish that increasing the timeout is the fix. " +
+        DIAGNOSTIC_WORKFLOW_GUIDANCE +
+        " " +
         "For research/review, synthesize evidence-backed findings; do not write files merely to clear this warning. " +
         "If evidence is insufficient, name the exact missing fact and use a focused search or bounded computation. " +
         "Do not restart general investigation, rewrite the plan, or delegate the same research. " +
@@ -268,11 +349,15 @@ export class TaskProgressTracker {
       !this.childFindings.size &&
       !this.lastActions.length &&
       !this.remoteInspections.length &&
+      !this.diagnostics.length &&
       !this.localFindings.length
     )
       return null;
     const checkpoint = {
       bounded: true,
+      recentDiagnostics: this.diagnostics
+        .filter((entry) => entry.owner === owner)
+        .map(({ owner: _owner, ...entry }) => entry),
       recentLocalFindings: this.localFindings
         .filter((entry) => entry.owner === owner)
         .map(({ owner: _owner, ...entry }) => entry),
@@ -300,6 +385,7 @@ export class TaskProgressTracker {
       !checkpoint.recentLocalFindings.length &&
       !checkpoint.recentToolOutcomes.length &&
       !checkpoint.recentRemoteInspections.length &&
+      !checkpoint.recentDiagnostics.length &&
       !checkpoint.reportedPlans.length &&
       !checkpoint.childFindings.length
     )
@@ -312,6 +398,8 @@ export class TaskProgressTracker {
         checkpoint.recentLocalFindings.shift();
       else if (checkpoint.recentRemoteInspections.length)
         checkpoint.recentRemoteInspections.shift();
+      else if (checkpoint.recentDiagnostics.length)
+        checkpoint.recentDiagnostics.shift();
       else if (checkpoint.recentToolOutcomes.length)
         checkpoint.recentToolOutcomes.shift();
       else checkpoint.reportedPlans.pop();

package/src/repl/agent-repl.js

@@ -5579,6 +5579,7 @@ async function startAgentReplInWorkspaceOwned(
   let _customStatus = false; // true when a settings.json command is configured
   let _curModel = model; // tracks the per-turn active model for the readout
   let _ctxUsedTokens = 0;
+  let _ctxRequestWindow = null;
   let _turnCount = 0;
   const _costStore = newCostStore(); // running token spend for `/cost`
   let _renderStatus = null;
@@ -5598,7 +5599,8 @@ async function startAgentReplInWorkspaceOwned(
           provider,
           cwd: process.cwd(),
           usedTokens: _ctxUsedTokens,
-          contextWindow: getContextWindow(_curModel, provider),
+          contextWindow:
+            _ctxRequestWindow ?? getContextWindow(_curModel, provider, options),
           turn: _turnCount,
         });
         // Custom command wins; otherwise the built-in context-usage render.
@@ -7190,7 +7192,9 @@ async function startAgentReplInWorkspaceOwned(
           messages,
           estimateTokens,
         );
-        const window = getContextWindow(model, provider) || 0;
+        const window =
+          _ctxRequestWindow ??
+          (getContextWindow(model, provider, options) || 0);
         logger.log(chalk.bold("\nContext usage (live session):"));
         const rows = [
           ["system", buckets.system, counts.system],
@@ -9756,8 +9760,19 @@ async function startAgentReplInWorkspaceOwned(
       _curModel = activeModel;
       _turnCount += 1;
       if (usageEvents?.length) {
-        const last = usageEvents[usageEvents.length - 1]?.usage || {};
-        const used = (last.input_tokens || 0) + (last.output_tokens || 0);
+        const lastCall = [...usageEvents]
+          .reverse()
+          .find(
+            (event) =>
+              !event.attribution && (!event.source || event.source === "model"),
+          );
+        _ctxRequestWindow = lastCall?.contextWindow ?? null;
+        const last = lastCall?.usage || {};
+        const used =
+          (last.input_tokens || 0) +
+          (last.output_tokens || 0) +
+          (last.cache_read_input_tokens || 0) +
+          (last.cache_creation_input_tokens || 0);
         if (used > 0) _ctxUsedTokens = used;
       }