chainlesschain 0.166.76 → 0.166.78

package/src/lib/codex-app-server-adapter.js

@@ -39,21 +39,62 @@ function projectNotification(notification) {
   if (method === "turn/started") {
     return { method: "turn/started", params: { turn: params.turn } };
   }
+  const deltaKinds = {
+    "item/agentMessage/delta": "assistant_message",
+    "item/commandExecution/outputDelta": "tool",
+    "item/fileChange/outputDelta": "tool",
+    "item/reasoning/textDelta": "reasoning",
+    "item/reasoning/summaryTextDelta": "reasoning",
+  };
+  if (Object.hasOwn(deltaKinds, method)) {
+    return {
+      method: "item/delta",
+      params: {
+        item: {
+          id: params.itemId,
+          kind: deltaKinds[method],
+          status: "streaming",
+          delta: params.delta || "",
+        },
+      },
+      ...(method === "item/agentMessage/delta"
+        ? {
+            outputDelta: String(params.delta || ""),
+            outputItemId: params.itemId,
+          }
+        : {}),
+    };
+  }
+  if (method === "thread/tokenUsage/updated") {
+    return {
+      method: "thread/usage",
+      params: { tokenUsage: params.tokenUsage },
+      usage: params.tokenUsage?.last || null,
+    };
+  }
   if (["item/started", "item/updated", "item/completed"].includes(method)) {
     const item = params.item || {};
-    const status = method === "item/completed" ? "completed" : "streaming";
+    const tool = item.type === "commandExecution" || item.type === "fileChange";
+    let status = method === "item/completed" ? "completed" : "streaming";
+    // item/completed means lifecycle closure, not successful execution. A
+    // declined approval still closes the tool item before interrupting the
+    // turn. Preserve that outcome and never infer success for unknown states.
+    if (method === "item/completed" && tool) {
+      status = ["completed", "failed", "declined"].includes(item.status)
+        ? item.status
+        : "unknown";
+    }
     return {
       method: method === "item/updated" ? "item/delta" : method,
       params: {
         item: {
           id: item.id,
           kind:
-            item.type === "agent_message"
+            item.type === "agentMessage"
               ? "assistant_message"
               : item.type === "reasoning"
                 ? "reasoning"
-                : item.type === "command_execution" ||
-                    item.type === "file_change"
+                : tool
                   ? "tool"
                   : "artifact",
           status,
@@ -61,9 +102,10 @@ function projectNotification(notification) {
         },
       },
       output:
-        method === "item/completed" && item.type === "agent_message"
+        method === "item/completed" && item.type === "agentMessage"
           ? String(item.text || "")
-          : "",
+          : undefined,
+      outputItemId: item.id,
     };
   }
   if (method === "turn/completed" || method === "turn/failed") {
@@ -160,44 +202,97 @@ export class CodexAppServerAdapter extends EventEmitter {
     }
     const notifications = [];
     const unknownMethods = new Set();
-    let output = "";
+    const outputItems = new Map();
+    let usage = null;
     let activeThreadId = threadId;
+    let activeTurnId = null;
     let submissionStarted = false;
     let admissionObserved = false;
     let observedTerminal = null;
     let terminalResolve;
-    let terminalReject;
-    const terminal = new Promise((resolve, reject) => {
+    const terminal = new Promise((resolve) => {
       terminalResolve = resolve;
-      terminalReject = reject;
     });
+    let deadlineReject;
+    const deadline = new Promise((_, reject) => {
+      deadlineReject = reject;
+    });
+    // Attach immediately: startup/RPC may hang or reject before terminal await.
+    deadline.catch(() => {});
     const timer = setTimeout(
       () =>
-        terminalReject(
+        deadlineReject(
           adapterError(
             "CC_CODEX_APP_SERVER_TIMEOUT",
-            "Codex App Server turn timed out after admission",
+            "Codex App Server request timed out",
           ),
         ),
       this.timeoutMs,
     );
     timer.unref?.();
+    const withinDeadline = (pending) => Promise.race([pending, deadline]);
+    let buffered = [];
+    let retainedBytes = 0;
+    let eventFailure = null;
+    const retain = (notification) => {
+      retainedBytes += Buffer.byteLength(JSON.stringify(notification));
+      if (
+        retainedBytes > 4 * 1024 * 1024 ||
+        notifications.length + buffered.length >= 4096
+      ) {
+        eventFailure = adapterError(
+          "CC_CODEX_APP_SERVER_EVENT_LIMIT",
+          "Codex App Server event retention limit exceeded",
+        );
+        deadlineReject(eventFailure);
+        return false;
+      }
+      return true;
+    };
     const onNotification = (notification) => {
+      if (observedTerminal || eventFailure || !submissionStarted) return;
+      const params = notification?.params || {};
+      const eventThread =
+        params.threadId ||
+        (notification.method === "thread/started" ? params.thread?.id : null);
+      if (!eventThread || eventThread !== activeThreadId) return;
+      if (!activeTurnId) {
+        if (retain(notification)) buffered.push(notification);
+        return;
+      }
+      const eventTurn = params.turnId || params.turn?.id;
+      // Thread-wide events carry no turn. Only thread/started is safe to
+      // project here; usage and terminal events require the exact turn ID.
+      if (
+        notification.method !== "thread/started" &&
+        eventTurn !== activeTurnId
+      )
+        return;
+      if (!retain(notification)) return;
       const projected = projectNotification(notification);
-      if (projected.unknownMethod) unknownMethods.add(projected.unknownMethod);
-      else {
+      if (projected.unknownMethod) {
+        if (unknownMethods.size < 64)
+          unknownMethods.add(projected.unknownMethod);
+      } else {
+        projected.params = {
+          ...projected.params,
+          threadId: activeThreadId,
+          turnId: activeTurnId,
+        };
         notifications.push(projected);
         this.emit("notification", projected);
       }
-      if (
-        submissionStarted &&
-        (projected.method === "turn/started" ||
-          projected.method?.startsWith("item/") ||
-          Boolean(projected.terminal))
-      ) {
-        admissionObserved = true;
+      if (projected.outputItemId) {
+        if (projected.output !== undefined)
+          outputItems.set(projected.outputItemId, projected.output);
+        else if (projected.outputDelta)
+          outputItems.set(
+            projected.outputItemId,
+            (outputItems.get(projected.outputItemId) || "") +
+              projected.outputDelta,
+          );
       }
-      if (projected.output) output = projected.output;
+      if (projected.usage) usage = projected.usage;
       if (projected.terminal) {
         observedTerminal = projected;
         terminalResolve(projected);
@@ -208,10 +303,11 @@ export class CodexAppServerAdapter extends EventEmitter {
       Object.freeze({
         protocol: CODEX_APP_SERVER_PROTOCOL,
         threadId: activeThreadId,
+        turnId: activeTurnId,
         terminal: terminalEvent.terminal,
-        output,
+        output: [...outputItems.values()].join("\n"),
         error: terminalEvent.error || null,
-        usage: terminalEvent.usage || null,
+        usage: terminalEvent.usage || usage,
         notifications: Object.freeze(notifications),
         unknownMethods: Object.freeze([...unknownMethods].sort()),
         fallback: false,
@@ -219,13 +315,14 @@ export class CodexAppServerAdapter extends EventEmitter {
       });
     try {
       if (!this.client.running && typeof this.client.start === "function") {
-        await this.client.start();
+        await withinDeadline(this.client.start());
       }
       if (!activeThreadId) {
-        const started = await this.client.request("thread/start", {
-          ephemeral: false,
-          provider: "codex",
-        });
+        const started = await withinDeadline(
+          this.client.request("thread/start", {
+            ephemeral: false,
+          }),
+        );
         activeThreadId = started?.thread?.id;
       }
       if (!activeThreadId) {
@@ -238,20 +335,49 @@ export class CodexAppServerAdapter extends EventEmitter {
       // the server did not accept the input. Never launch a second execution
       // path from that ambiguous state.
       submissionStarted = true;
-      const started = await this.client.request("turn/start", {
-        threadId: activeThreadId,
-        input: [{ type: "text", text: String(prompt || "") }],
-      });
+      const started = await withinDeadline(
+        this.client.request("turn/start", {
+          threadId: activeThreadId,
+          input: [{ type: "text", text: String(prompt || "") }],
+        }),
+      );
+      activeTurnId = started?.turn?.id;
+      if (typeof activeTurnId !== "string" || !activeTurnId) {
+        throw adapterError(
+          "CC_CODEX_APP_SERVER_PROTOCOL_FAILED",
+          "Codex App Server did not return a turn identity",
+        );
+      }
       admissionObserved = true;
+      if (eventFailure) throw eventFailure;
+      const early = buffered;
+      buffered = [];
+      retainedBytes = 0;
+      for (const notification of early) onNotification(notification);
+      if (eventFailure) throw eventFailure;
+      // Some servers finish before writing the RPC response, including items
+      // in the response without separate item notifications.
+      if (!observedTerminal)
+        for (const item of started.turn.items || []) {
+          onNotification({
+            method: "item/completed",
+            params: { threadId: activeThreadId, turnId: activeTurnId, item },
+          });
+        }
+      if (eventFailure) throw eventFailure;
       const initialStatus = String(started?.turn?.status || "");
       const terminalEvent = ["completed", "failed", "interrupted"].includes(
         initialStatus,
       )
         ? projectNotification({
             method: "turn/completed",
-            params: { turn: started.turn, usage: started.turn.usage || null },
+            params: {
+              threadId: activeThreadId,
+              turn: started.turn,
+              usage: started.turn.usage || null,
+            },
           })
-        : await terminal;
+        : await withinDeadline(terminal);
       return buildResult(terminalEvent);
     } catch (error) {
       if (!submissionStarted) {

package/src/lib/cost-budget.js

@@ -18,6 +18,7 @@
  */
 
 import { estimateCost } from "./llm-pricing.js";
+import { projectUsagePricingContext } from "./usage-pricing-context.js";
 
 /** Parse a `--max-budget-usd` value into a positive number, or null when unset. */
 export function parseBudgetUsd(value) {
@@ -64,6 +65,7 @@ export class CostBudget {
     // or it undercounts real spend on a cached Anthropic run and stops too late.
     const cacheReadTokens = usage?.cache_read_input_tokens || 0;
     const cacheCreationTokens = usage?.cache_creation_input_tokens || 0;
+    const pricingContext = projectUsagePricingContext(usage || {});
     const est = estimateCost({
       provider,
       model,
@@ -71,6 +73,8 @@ export class CostBudget {
       outputTokens: usage?.output_tokens || 0,
       cacheReadTokens,
       cacheCreationTokens,
+      serviceTier: pricingContext.service_tier ?? "standard",
+      regionalProcessing: pricingContext.regional_processing === true,
       table: this.table,
     });
     const tokens =

package/src/lib/decision-layer/providers.js

@@ -14,6 +14,9 @@ const PROVIDERS = Object.freeze({
   "system-one": { label: "System One" },
 });
 
+export const MAX_DECISION_REQUEST_BYTES = 256 * 1024;
+export const MAX_DECISION_RESPONSE_BYTES = 256 * 1024;
+
 function boundedText(value, label, limit = 160) {
   if (
     typeof value !== "string" ||
@@ -98,6 +101,71 @@ function providerError(status, provider) {
   return error;
 }
 
+function bodyTooLarge(kind, maximum) {
+  const error = new Error(`decision ${kind} exceeds ${maximum} bytes`);
+  error.code = `CC_DECISION_${kind.toUpperCase()}_TOO_LARGE`;
+  return error;
+}
+
+async function readBoundedJsonResponse(response) {
+  const declared = response.headers?.get?.("content-length");
+  if (
+    declared != null &&
+    /^\d+$/u.test(declared) &&
+    BigInt(declared) > BigInt(MAX_DECISION_RESPONSE_BYTES)
+  ) {
+    try {
+      await response.body?.cancel?.();
+    } catch {
+      // The declared size remains authoritative even if cancellation fails.
+    }
+    throw bodyTooLarge("response", MAX_DECISION_RESPONSE_BYTES);
+  }
+
+  // A real Fetch Response has a stream; injected test transports may only
+  // expose json(). The latter is checked after parsing because it is trusted.
+  if (!response.body?.getReader) {
+    const value = await response.json();
+    if (
+      Buffer.byteLength(JSON.stringify(value), "utf8") >
+      MAX_DECISION_RESPONSE_BYTES
+    ) {
+      throw bodyTooLarge("response", MAX_DECISION_RESPONSE_BYTES);
+    }
+    return value;
+  }
+
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      const chunkBytes = value?.byteLength;
+      if (
+        !Number.isSafeInteger(chunkBytes) ||
+        total + chunkBytes > MAX_DECISION_RESPONSE_BYTES
+      ) {
+        throw bodyTooLarge("response", MAX_DECISION_RESPONSE_BYTES);
+      }
+      const chunk = Buffer.from(value);
+      total += chunk.length;
+      chunks.push(chunk);
+    }
+    return JSON.parse(new TextDecoder().decode(Buffer.concat(chunks, total)));
+  } catch (error) {
+    try {
+      await reader.cancel();
+    } catch {
+      // The original read, size, or JSON error remains authoritative.
+    }
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+}
+
 export function createDecisionProvider({
   provider,
   model,
@@ -119,6 +187,14 @@ export function createDecisionProvider({
     provider: options.provider,
     model: options.model,
     decide: async (request, { signal } = {}) => {
+      const body = JSON.stringify({
+        model: options.model,
+        state: request.payload.state,
+        questions: request.payload.questions,
+      });
+      if (Buffer.byteLength(body, "utf8") > MAX_DECISION_REQUEST_BYTES) {
+        throw bodyTooLarge("request", MAX_DECISION_REQUEST_BYTES);
+      }
       const response = await fetchImpl(endpoint, {
         method: "POST",
         headers: {
@@ -127,23 +203,22 @@ export function createDecisionProvider({
             : { authorization: `Bearer ${secret}` }),
           "content-type": "application/json",
         },
-        body: JSON.stringify({
-          model: options.model,
-          state: request.payload.state,
-          questions: request.payload.questions,
-        }),
+        body,
         signal,
         redirect: "error",
       });
       if (!response?.ok) {
         throw providerError(response?.status ?? 0, options.provider);
       }
-      const body = await response.json();
+      const responseBody = await readBoundedJsonResponse(response);
       return {
         provider: options.provider,
-        model: typeof body?.model === "string" ? body.model : options.model,
-        answers: body?.answers,
-        usage: body?.usage,
+        model:
+          typeof responseBody?.model === "string"
+            ? responseBody.model
+            : options.model,
+        answers: responseBody?.answers,
+        usage: responseBody?.usage,
       };
     },
   });

package/src/lib/decision-layer/runtime.js

@@ -38,12 +38,28 @@ function timeoutSignal(signal, timeoutMs) {
 
 function projectUnavailable(error) {
   if (error?.name === "TimeoutError") return "provider-timeout";
+  if (error?.code === "CC_DECISION_USAGE_UNKNOWN_BLOCKED") {
+    return "provider-usage-unknown-blocked";
+  }
   if (error?.code === "CC_DECISION_PROVIDER_HTTP_ERROR") {
     return "provider-http-error";
   }
   return "provider-unavailable";
 }
 
+function unavailableOutcome(reasonCode) {
+  return {
+    status: "unavailable",
+    reasonCode,
+    selectedCandidateId: null,
+    selectedDigest: null,
+    selectedSkillId: null,
+    needsSkillProbability: null,
+    choiceConfidence: null,
+    resultDigest: null,
+  };
+}
+
 function asPersistenceError(error) {
   if (error?.runtimeLedgerPersistence === true) return error;
   try {
@@ -63,6 +79,7 @@ export function createSkillDecisionRuntime({
   persist = null,
   observe = null,
   sessionBudget = null,
+  initialUsageUnknown = false,
   thresholds = {},
   timeoutMs = DEFAULT_TIMEOUT_MS,
   idGenerator = () => randomUUID(),
@@ -84,6 +101,7 @@ export function createSkillDecisionRuntime({
   let providerAuthority = null;
   let boundTenantId = null;
   let boundSessionId = null;
+  let unknownUsageSeen = initialUsageUnknown === true;
   if (normalizedMode !== "off") {
     providerAuthority = captureDecisionProviderAuthority(provider);
     boundTenantId = requiredText(tenantId, "tenantId");
@@ -104,6 +122,11 @@ export function createSkillDecisionRuntime({
     }
   };
 
+  const persistDecisionUsage = async (type, event) => {
+    await persist(type, event);
+    if (type === "model_usage_unknown") unknownUsageSeen = true;
+  };
+
   const runtime = Object.freeze({
     schema: SKILL_DECISION_RUNTIME_SCHEMA,
     mode: normalizedMode,
@@ -144,56 +167,70 @@ export function createSkillDecisionRuntime({
       }
       let outcome;
       let requestSignal = null;
-      try {
-        const raw = await runMeteredDirectModelCall({
-          sessionId: boundSessionId,
-          persist,
-          provider: providerAuthority.provider,
-          model: providerAuthority.model,
-          source: "model",
-          operationId: `decision:${decisionId}`,
-          sessionBudget,
-          call: () => {
-            requestSignal = timeoutSignal(signal, timeoutMs);
-            return providerAuthority.decide(request, {
-              signal: requestSignal,
-            });
-          },
-        });
-        const normalized = normalizeSkillDecisionProviderResult(request, raw);
-        const resolved = resolveSkillDecision(request, normalized, thresholds);
-        outcome = {
-          status: resolved.status,
-          reasonCode: resolved.reasonCode,
-          selectedCandidateId: resolved.selectedCandidateId,
-          selectedDigest: resolved.selectedDigest,
-          selectedSkillId: resolved.selectedSkillId,
-          needsSkillProbability: resolved.needsSkillProbability,
-          choiceConfidence: resolved.choiceConfidence,
-          resultDigest: resolved.resultDigest,
-        };
-      } catch (error) {
-        const localTimeout =
-          !signal?.aborted &&
-          requestSignal?.aborted &&
-          requestSignal.reason === error &&
-          error?.name === "TimeoutError";
-        if (
-          signal?.aborted ||
-          (isTerminalModelFailure(error) && !localTimeout)
-        ) {
-          throw error;
+      if (unknownUsageSeen) {
+        outcome = unavailableOutcome("provider-usage-unknown-blocked");
+      } else {
+        try {
+          const { result: raw, settlement } = await runMeteredDirectModelCall({
+            sessionId: boundSessionId,
+            persist: persistDecisionUsage,
+            provider: providerAuthority.provider,
+            model: providerAuthority.model,
+            source: "model",
+            operationId: `decision:${decisionId}`,
+            sessionBudget,
+            includeSettlement: true,
+            call: () => {
+              if (unknownUsageSeen) {
+                const error = new Error("decision usage recovery is required");
+                error.code = "CC_DECISION_USAGE_UNKNOWN_BLOCKED";
+                throw error;
+              }
+              requestSignal = timeoutSignal(signal, timeoutMs);
+              return providerAuthority.decide(request, {
+                signal: requestSignal,
+              });
+            },
+          });
+          if (settlement !== "known") {
+            // The metered call already persisted model_usage_unknown. Without a
+            // budget root it may return the answer; never expose that answer.
+            outcome = unavailableOutcome("provider-usage-unknown");
+          } else {
+            const normalized = normalizeSkillDecisionProviderResult(
+              request,
+              raw,
+            );
+            const resolved = resolveSkillDecision(
+              request,
+              normalized,
+              thresholds,
+            );
+            outcome = {
+              status: resolved.status,
+              reasonCode: resolved.reasonCode,
+              selectedCandidateId: resolved.selectedCandidateId,
+              selectedDigest: resolved.selectedDigest,
+              selectedSkillId: resolved.selectedSkillId,
+              needsSkillProbability: resolved.needsSkillProbability,
+              choiceConfidence: resolved.choiceConfidence,
+              resultDigest: resolved.resultDigest,
+            };
+          }
+        } catch (error) {
+          const localTimeout =
+            !signal?.aborted &&
+            requestSignal?.aborted &&
+            requestSignal.reason === error &&
+            error?.name === "TimeoutError";
+          if (
+            signal?.aborted ||
+            (isTerminalModelFailure(error) && !localTimeout)
+          ) {
+            throw error;
+          }
+          outcome = unavailableOutcome(projectUnavailable(error));
         }
-        outcome = {
-          status: "unavailable",
-          reasonCode: projectUnavailable(error),
-          selectedCandidateId: null,
-          selectedDigest: null,
-          selectedSkillId: null,
-          needsSkillProbability: null,
-          choiceConfidence: null,
-          resultDigest: null,
-        };
       }
       const finishedAt = now();
       if (

package/src/lib/direct-model-usage.js

@@ -54,6 +54,7 @@ function unknownUsageEvent({
  * Meter one direct provider call that runs outside agentLoop. The started row is
  * durable before the callback resumes into provider work; every outcome then
  * settles known or unknown without persisting prompts, responses, or errors.
+ * Opt-in includeSettlement returns that persisted status with the raw result.
  */
 export async function runMeteredDirectModelCall({
   sessionId,
@@ -63,6 +64,7 @@ export async function runMeteredDirectModelCall({
   source = "model",
   operationId = undefined,
   sessionBudget = null,
+  includeSettlement = false,
   call,
 }) {
   if (typeof call !== "function") {
@@ -78,7 +80,12 @@ export async function runMeteredDirectModelCall({
       );
     }
   }
-  if (!sessionId) return call();
+  if (!sessionId) {
+    if (includeSettlement) {
+      throw new TypeError("direct model settlement requires a session");
+    }
+    return call();
+  }
   if (typeof persist !== "function") {
     throw new TypeError("metered direct model call requires persistence");
   }
@@ -96,6 +103,9 @@ export async function runMeteredDirectModelCall({
     `direct model call ${source}`,
   );
   let result;
+  let settlement = "unknown";
+  const returnSettled = (status) =>
+    includeSettlement ? Object.freeze({ result, settlement: status }) : result;
   try {
     result = await call();
   } catch (error) {
@@ -139,7 +149,7 @@ export async function runMeteredDirectModelCall({
       if (markSessionBudgetUsageUnknown(sessionBudget, unknown)) {
         rejectSessionBudgetUsageUnknown(unknown, `direct model call ${source}`);
       }
-      return result;
+      return returnSettled("unknown");
     }
     await persistUsageEvent(persist, "token_usage", event);
     recordSessionBudgetUsage(
@@ -147,6 +157,7 @@ export async function runMeteredDirectModelCall({
       event,
       `direct model call ${source} usage settlement`,
     );
+    settlement = "known";
   } else {
     const unknown = unknownUsageEvent({
       callId,
@@ -161,5 +172,5 @@ export async function runMeteredDirectModelCall({
       rejectSessionBudgetUsageUnknown(unknown, `direct model call ${source}`);
     }
   }
-  return result;
+  return returnSettled(settlement);
 }