chainlesschain 0.166.86 → 0.166.88

package/src/lib/llm-pricing.js

@@ -40,6 +40,7 @@ export const PRICE_TABLE = Object.freeze({
       match,
       ...model.pricing,
       exact: true,
+      ...(model.pricingTerms ? { terms: model.pricingTerms } : {}),
     })),
     // Current Anthropic list prices (USD per 1M tokens), verified 2026-06-21
     // against the claude-api reference. The Opus tier dropped to $5/$25 with
@@ -64,7 +65,12 @@ export const PRICE_TABLE = Object.freeze({
         match,
         ...model.pricing,
         exact: true,
-        terms: GPT6_PRICING_TERMS,
+        terms: Object.freeze({
+          ...GPT6_PRICING_TERMS,
+          ...(model.cacheReadMultiplier == null
+            ? {}
+            : { cacheReadMultiplier: model.cacheReadMultiplier }),
+        }),
       })),
     // GPT-5 family (2026). Matching is longest-pattern-first, so dated/variant
     // ids (gpt-5.5, gpt-5.5-pro, gpt-5.5-instant, …) resolve to the most
@@ -120,14 +126,16 @@ export const PRICE_TABLE = Object.freeze({
 /**
  * Merge user-supplied price overrides (typically `config.llm.pricing`) onto the
  * built-in table. Override shape mirrors PRICE_TABLE:
- *   { "<provider>": [ { match: "<substr>", in: <num>, out: <num> }, ... ] }
+ *   { "<provider>": [ { match: "<model>", in: <num>, out: <num>, exact?, terms? }, ... ] }
  *
  * Per provider, a user entry whose `match` equals a built-in pattern REPLACES
  * it; brand-new patterns are prepended so they win ties; unknown providers are
  * added. Malformed entries (missing match / non-numeric / negative / Infinity
  * rate) are skipped so a bad config line can't crash cost reporting or produce a
  * negative cost that undercounts spend. Returns a new table; never mutates
- * PRICE_TABLE or the input.
+ * PRICE_TABLE or the input. Explicit terms replace (rather than partly inherit)
+ * the matched terms. Invalid terms throw: silently ignoring a requested tier
+ * or cache policy can materially misstate a hard budget.
  *
  * @param {object} [overrides]
  * @param {object} [base=PRICE_TABLE]
@@ -168,6 +176,12 @@ export function mergePricing(overrides, base = PRICE_TABLE) {
         match: e.match.toLowerCase(),
         in: Number(e.in),
         out: Number(e.out),
+        ...(Object.hasOwn(e, "exact")
+          ? { exact: validateExactMatch(e.exact) }
+          : {}),
+        ...(Object.hasOwn(e, "terms")
+          ? { terms: normalizePricingTerms(e.terms) }
+          : {}),
         explicitOverride: true,
       }));
     if (valid.length === 0) continue;
@@ -180,6 +194,79 @@ export function mergePricing(overrides, base = PRICE_TABLE) {
   return merged;
 }
 
+function validateExactMatch(value) {
+  if (typeof value !== "boolean")
+    throw new TypeError("pricing exact must be a boolean");
+  return value;
+}
+
+/** Validate and copy the documented request-level override schema. */
+export function normalizePricingTerms(value) {
+  const object = (v) =>
+    v !== null &&
+    typeof v === "object" &&
+    (Object.getPrototypeOf(v) === Object.prototype ||
+      Object.getPrototypeOf(v) === null);
+  const finite = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+  const fail = () => {
+    throw new TypeError(
+      "Invalid pricing terms: expected finite non-negative multipliers and a positive long-context threshold",
+    );
+  };
+  const allowed = new Set([
+    "cacheReadMultiplier",
+    "cacheWriteMultiplier",
+    "longContext",
+    "serviceMultipliers",
+  ]);
+  if (!object(value) || Reflect.ownKeys(value).some((key) => !allowed.has(key)))
+    fail();
+  const result = {};
+  for (const key of ["cacheReadMultiplier", "cacheWriteMultiplier"]) {
+    if (!Object.hasOwn(value, key)) continue;
+    if (!finite(value[key])) fail();
+    result[key] = value[key];
+  }
+  if (Object.hasOwn(value, "longContext")) {
+    const tier = value.longContext;
+    if (
+      !object(tier) ||
+      Reflect.ownKeys(tier).some(
+        (key) =>
+          !["threshold", "inputMultiplier", "outputMultiplier"].includes(key),
+      ) ||
+      !Number.isSafeInteger(tier.threshold) ||
+      tier.threshold <= 0 ||
+      !finite(tier.inputMultiplier) ||
+      !finite(tier.outputMultiplier)
+    )
+      fail();
+    result.longContext = Object.freeze({
+      threshold: tier.threshold,
+      inputMultiplier: tier.inputMultiplier,
+      outputMultiplier: tier.outputMultiplier,
+    });
+  }
+  if (Object.hasOwn(value, "serviceMultipliers")) {
+    const tiers = value.serviceMultipliers;
+    if (
+      !object(tiers) ||
+      Reflect.ownKeys(tiers).length === 0 ||
+      Reflect.ownKeys(tiers).some(
+        (key) =>
+          !["standard", "default", "auto", "batch", "flex", "fast"].includes(
+            key,
+          ) || !finite(tiers[key]),
+      )
+    )
+      fail();
+    result.serviceMultipliers = Object.freeze(
+      Object.fromEntries(Object.entries(tiers)),
+    );
+  }
+  return Object.freeze(result);
+}
+
 /**
  * Look up the rate for a provider/model, or null if unpriced.
  * @param {string} provider
@@ -199,14 +286,12 @@ export function lookupRate(provider, model, table = PRICE_TABLE) {
   const sorted = [...entries].sort((a, b) => b.match.length - a.match.length);
   for (const e of sorted) {
     if (e.exact ? m === e.match : m.includes(e.match)) {
-      // An unrecognized new version must not inherit an older Opus price.
+      // An unrecognized new generation must not inherit an older family price.
       // Explicit operator overrides remain authoritative.
       if (
-        e.match === "opus" &&
-        Number(/^claude-opus-(\d+)(?:[.-]|$)/u.exec(m)?.[1]) >= 5 &&
-        !e.explicitOverride &&
-        e.in === 5 &&
-        e.out === 25
+        ["opus", "sonnet"].includes(e.match) &&
+        Number(/^claude-(?:opus|sonnet)-(\d+)(?:[.-]|$)/u.exec(m)?.[1]) >= 5 &&
+        !e.explicitOverride
       )
         continue;
       return {
@@ -258,7 +343,7 @@ export function estimateCost({
   table,
 } = {}) {
   const rate = lookupRate(provider, model, table);
-  const tierMultiplier = rate?.terms
+  const tierMultiplier = rate?.terms?.serviceMultipliers
     ? Object.hasOwn(rate.terms.serviceMultipliers, serviceTier)
       ? rate.terms.serviceMultipliers[serviceTier]
       : null
@@ -359,7 +444,9 @@ export function priceRollup(aggregate, { table } = {}) {
         est[field] = estimates.reduce((sum, entry) => sum + entry[field], 0);
       }
     } else if (
-      lookupRate(row.provider, row.model, table)?.terms &&
+      (lookupRate(row.provider, row.model, table)?.terms?.longContext ||
+        lookupRate(row.provider, row.model, table)?.terms
+          ?.serviceMultipliers) &&
       row.calls > 1
     ) {
       // A legacy aggregate cannot establish which individual requests crossed

package/src/lib/model-catalog-review.js

@@ -0,0 +1,116 @@
+import { resolveModelCapabilityProfile } from "./model-capabilities.js";
+import { lookupRate } from "./llm-pricing.js";
+import { isDeepStrictEqual } from "node:util";
+
+/** Compare reviewed release facts with local behavior; never change a catalog. */
+export function reviewModelCatalog(review, snapshots = {}) {
+  if (
+    review?.schema !== "chainlesschain.model-catalog-review/v1" ||
+    !Array.isArray(review.models) ||
+    !review.models.length
+  ) {
+    throw new TypeError("Invalid reviewed model catalog");
+  }
+  const mismatches = [];
+  for (const expected of review.models) {
+    const actual = resolveModelCapabilityProfile(expected);
+    const rate = lookupRate(expected.provider, expected.model);
+    for (const field of [
+      "runtimeProtocol",
+      "contextWindowTokens",
+      "advertisedMaxOutputTokens",
+    ]) {
+      if (Object.hasOwn(expected, field) && actual[field] !== expected[field])
+        mismatches.push({
+          model: expected.model,
+          field,
+          expected: expected[field],
+          actual: actual[field],
+        });
+    }
+    if (!actual.sources.length)
+      mismatches.push({
+        model: expected.model,
+        field: "official-source",
+        actual: null,
+      });
+    for (const field of ["in", "out"]) {
+      if (rate?.[field] !== expected.pricing[field])
+        mismatches.push({
+          model: expected.model,
+          field,
+          expected: expected.pricing[field],
+          actual: rate?.[field] ?? null,
+        });
+    }
+    for (const field of [
+      "cacheReadMultiplier",
+      "cacheWriteMultiplier",
+      "longContext",
+      "serviceMultipliers",
+    ]) {
+      if (
+        Object.hasOwn(expected.pricing, field) &&
+        !isDeepStrictEqual(
+          rate?.terms?.[field] ?? null,
+          expected.pricing[field],
+        )
+      ) {
+        mismatches.push({
+          model: expected.model,
+          field,
+          expected: expected.pricing[field],
+          actual: rate?.terms?.[field] ?? null,
+        });
+      }
+    }
+    if (
+      expected.reasoningEfforts &&
+      JSON.stringify(actual.reasoningEfforts) !==
+        JSON.stringify(expected.reasoningEfforts)
+    )
+      mismatches.push({
+        model: expected.model,
+        field: "reasoningEfforts",
+        expected: expected.reasoningEfforts,
+        actual: actual.reasoningEfforts ?? null,
+      });
+  }
+  const upstream = [];
+  for (const [name, source] of Object.entries(snapshots)) {
+    if (
+      !["codex", "claude"].includes(name) ||
+      typeof source !== "string" ||
+      source.length > 16 * 1024 * 1024
+    )
+      throw new TypeError("Invalid upstream release snapshot");
+    const text = source
+      .replace(/<(script|style)\b[^>]*>[\s\S]*?<\/\1>/gi, "")
+      .replace(/<[^>]+>/g, " ");
+    const version =
+      name === "codex"
+        ? /Codex CLI\s+(\d+\.\d+\.\d+)/.exec(text)?.[1]
+        : /<Update\s+label="(\d+\.\d+\.\d+)"/u.exec(source)?.[1] ||
+          /^##\s+(\d+\.\d+\.\d+)/m.exec(text)?.[1];
+    if (!version)
+      throw new Error(
+        `Cannot identify the ${name} release in the official snapshot`,
+      );
+    upstream.push({
+      name,
+      reviewedVersion: review.upstream[name],
+      observedVersion: version,
+      reviewRequired: version !== review.upstream[name],
+    });
+  }
+  return {
+    schema: "chainlesschain.model-catalog-review-result/v1",
+    reviewedAt: review.reviewedAt,
+    localContractPassed: mismatches.length === 0,
+    mismatches,
+    upstream,
+    reviewRequired:
+      mismatches.length > 0 || upstream.some((row) => row.reviewRequired),
+    automaticEnablement: false,
+  };
+}

package/src/lib/model-context-catalog.js

@@ -45,7 +45,7 @@ export const CONTEXT_WINDOWS = Object.freeze({
   }),
 });
 
-export const MODEL_CAPABILITY_CATALOG_VERSION = "2026-09-27";
+export const MODEL_CAPABILITY_CATALOG_VERSION = "2026-10-05";
 
 // Explicit ownership prevents a model name served by an unrelated provider
 // from silently inheriting another provider's catalog window.
@@ -85,6 +85,18 @@ export const LEGACY_MODEL_PROVIDERS = Object.freeze({
 // Official pages reviewed on the catalog version date. These describe the
 // named models, not endpoint access, account entitlement, or a live CLI run.
 export const DOCUMENTED_OPENAI_MODELS = Object.freeze({
+  "gpt-6.1-sol": Object.freeze({
+    contextWindowTokens: 1050000,
+    advertisedMaxOutputTokens: 128000,
+    requiresResponsesForTools: true,
+    reasoningEfforts: Object.freeze(["low", "medium", "high", "xhigh", "max"]),
+    pricing: Object.freeze({ in: 2, out: 10 }),
+    // This generation has a 5% cache-read rate, unlike GPT-6 Sol's 10%.
+    cacheReadMultiplier: 0.05,
+    sources: Object.freeze([
+      "https://developers.openai.com/api/docs/models/gpt-6.1-sol",
+    ]),
+  }),
   "gpt-4o": Object.freeze({
     contextWindowTokens: 128000,
     advertisedMaxOutputTokens: 16384,
@@ -132,11 +144,21 @@ export const DOCUMENTED_OPENAI_MODELS = Object.freeze({
 });
 
 export const DOCUMENTED_ANTHROPIC_MODELS = Object.freeze({
+  "claude-sonnet-5-5": Object.freeze({
+    contextWindowTokens: 1000000,
+    advertisedMaxOutputTokens: null,
+    pricing: Object.freeze({ in: 2, out: 10 }),
+    pricingTerms: Object.freeze({ cacheReadMultiplier: 0.1 }),
+    sources: Object.freeze([
+      "https://code.claude.com/docs/en/changelog#2-1-284",
+    ]),
+  }),
   "claude-opus-5-5": Object.freeze({
     contextWindowTokens: 1000000,
     // The release notes establish the window and pricing, not an output cap.
     advertisedMaxOutputTokens: null,
     pricing: Object.freeze({ in: 4, out: 20 }),
+    pricingTerms: Object.freeze({ cacheReadMultiplier: 0.05 }),
     sources: Object.freeze([
       "https://code.claude.com/docs/en/changelog#2-1-280",
     ]),

package/src/lib/openai-responses.js

@@ -176,7 +176,16 @@ export function createOpenAIResponsesBody({
   maxOutputTokens = null,
   reasoning = null,
   stream = false,
+  modelProfile = null,
 }) {
+  if (
+    modelProfile?.advertisedMaxOutputTokens != null &&
+    maxOutputTokens > modelProfile.advertisedMaxOutputTokens
+  ) {
+    throw new RangeError(
+      `maxOutputTokens exceeds the documented limit (${modelProfile.advertisedMaxOutputTokens}) for ${model}`,
+    );
+  }
   return {
     model,
     input: toOpenAIResponsesInput(messages),
@@ -189,6 +198,36 @@ export function createOpenAIResponsesBody({
   };
 }
 
+/** Translate UI intensity without sending an effort rejected by the model. */
+export function createOpenAIResponsesReasoning(
+  options = {},
+  modelProfile = null,
+) {
+  const want = options.thinking;
+  if (!want || want === "off" || want === "none") return null;
+  const requested =
+    typeof options.thinkingEffort === "string"
+      ? options.thinkingEffort.toLowerCase()
+      : null;
+  const fallback = ["ultra", "ultrathink"].includes(String(want))
+    ? "xhigh"
+    : want === "think"
+      ? "medium"
+      : "high";
+  const generic = ["none", "minimal", "low", "medium", "high", "xhigh", "max"];
+  const effort =
+    requested && generic.includes(requested) ? requested : fallback;
+  if (
+    modelProfile?.reasoningEfforts &&
+    !modelProfile.reasoningEfforts.includes(requested || effort)
+  ) {
+    throw new RangeError(
+      `Unsupported reasoning effort for ${modelProfile.model}; allowed: ${modelProfile.reasoningEfforts.join(", ")}`,
+    );
+  }
+  return { effort, summary: "auto" };
+}
+
 export function normalizeOpenAIResponsesUsage(usage) {
   if (!usage || typeof usage !== "object" || Array.isArray(usage)) return null;
   const input = nonNegativeInteger(usage.input_tokens);

package/src/lib/process-execution-broker/index.js

@@ -53,6 +53,7 @@ import {
   getProcessOwnershipStatus,
   observeProcessOwnership,
   prepareProcessOwnership,
+  recoverProcessOwnership,
 } from "./process-ownership-quarantine.js";
 import {
   MACOS_MCP_LAUNCHER_INPUTS,
@@ -4525,6 +4526,10 @@ class ProcessExecutionBroker extends EventEmitter {
     return getProcessOwnershipStatus();
   }
 
+  recoverProcessOwnership(executionId, options) {
+    return recoverProcessOwnership(executionId, options);
+  }
+
   listWorkspaceTransactions(options = {}) {
     return this._workspaceTransactionManager(
       options.stateDir,
@@ -4873,6 +4878,9 @@ class ProcessExecutionBroker extends EventEmitter {
               cwd: path.resolve(optsForSpawn.cwd || cwd),
               env: optsForSpawn.env || process.env,
               graceMs: request.graceMs,
+              ...(ownershipLease?.beforeLaunch
+                ? { beforeLaunch: ownershipLease.beforeLaunch }
+                : {}),
               helper,
             },
             {

package/src/lib/process-execution-broker/linux-subreaper-process.js

@@ -96,10 +96,22 @@ export function spawnLinuxSubreaper(command, args, options, native) {
     if (
       Object.keys(options).some(
         (key) =>
-          !["cwd", "env", "graceMs", "helperPath", "helper"].includes(key),
+          ![
+            "cwd",
+            "env",
+            "graceMs",
+            "helperPath",
+            "helper",
+            "beforeLaunch",
+          ].includes(key),
       )
     )
       throw new TypeError("Unsupported Linux subreaper option");
+    if (
+      options.beforeLaunch !== undefined &&
+      typeof options.beforeLaunch !== "function"
+    )
+      throw new TypeError("Invalid trusted before-launch hook");
     launch = encodeLinuxSubreaperLaunch(command, args, options);
     child = native.spawn(helper ? "/proc/self/fd/4" : options.helperPath, [], {
       cwd: options.cwd,
@@ -249,7 +261,17 @@ export function spawnLinuxSubreaper(command, args, options, native) {
       });
     });
   });
-  control.write(launch);
+  try {
+    const result = options.beforeLaunch?.(child);
+    if (result && typeof result.then === "function")
+      throw new TypeError("Before-launch hook must be synchronous");
+    control.write(launch);
+  } catch (error) {
+    // No launch frame was sent. Closing the private control channel releases
+    // the blocked supervisor without executing the target.
+    control.destroy();
+    throw error;
+  }
   return Object.freeze({ child, terminate, completion });
 }