chainlesschain 0.166.97 → 0.166.98

package/src/commands/eval.js

@@ -15,8 +15,12 @@ import { fileURLToPath } from "url";
 import { runEvalSuite } from "../lib/eval/runner.js";
 import { getSuite } from "../lib/eval/tasks.js";
 import { verifyAgentTerminal } from "../lib/eval/stream-terminal.js";
-import { persistVerify01Receipts } from "../lib/eval/verify01-execution.js";
+import {
+  captureVerify01AgentBinding,
+  persistVerify01Receipts,
+} from "../lib/eval/verify01-execution.js";
 import executionBroker from "../lib/process-execution-broker/index.js";
+import { BUILT_IN_PROVIDERS } from "../lib/llm-providers.js";
 import {
   TelemetryRecorder,
   formatTelemetry,
@@ -93,7 +97,68 @@ function killAgentTree(child) {
  * workspace. acceptEdits lets it write files without an interactive prompt.
  */
 function makeHeadlessRunAgent(opts = {}) {
-  return function runAgent({ prompt, cwd, timeoutMs, costBudgetUsd }) {
+  return function runAgent({
+    prompt,
+    cwd,
+    timeoutMs,
+    costBudgetUsd,
+    verify01Binding,
+  }) {
+    const binding =
+      verify01Binding === undefined
+        ? null
+        : captureVerify01AgentBinding(verify01Binding, cwd);
+    if (opts.requireVerify01Binding && !binding)
+      throw new Error("frozen suite requires a task-specific agent binding");
+    if (
+      binding &&
+      (binding.provider !== opts.provider || binding.model !== opts.model)
+    )
+      throw new Error(
+        "VERIFY01 provider/model binding differs from the launcher",
+      );
+    const inherited = { ...process.env, ...(opts.env || {}) };
+    const environmentValue = (name) => {
+      if (process.platform !== "win32") return inherited[name];
+      // Windows environment keys are case-insensitive, but spreading env into
+      // a plain object loses that lookup behavior (PATH is usually Path).
+      const key = Object.keys(inherited)
+        .reverse()
+        .find((candidate) => candidate.toLowerCase() === name.toLowerCase());
+      return key === undefined ? undefined : inherited[key];
+    };
+    const providerKey = BUILT_IN_PROVIDERS[binding?.provider]?.apiKeyEnv;
+    // Formal children retain platform plumbing and only the selected provider's
+    // credential (or the explicitly selected generic CC_API_KEY). Hooks,
+    // fallback configuration, NODE_OPTIONS and unrelated account tokens are
+    // excluded. Normal, non-formal Eval retains its existing environment.
+    const childEnvironment = binding
+      ? {
+          ...Object.fromEntries(
+            [
+              "PATH",
+              "SystemRoot",
+              "WINDIR",
+              "ComSpec",
+              "PATHEXT",
+              "TEMP",
+              "TMP",
+              "TMPDIR",
+              "LANG",
+              "LC_ALL",
+              "LC_CTYPE",
+              "CC_API_KEY",
+              ...(providerKey ? [providerKey] : []),
+            ]
+              .map((key) => [key, environmentValue(key)])
+              .filter(([, value]) => value !== undefined),
+          ),
+          ...binding.environment,
+          CC_MAX_RETRIES: "0",
+          CLAUDE_CODE_MAX_RETRIES: "0",
+          CLAUDECODE: "1",
+        }
+      : { ...inherited, CLAUDECODE: "1" };
     return new Promise((resolve) => {
       let args;
       if (opts._argv) {
@@ -115,12 +180,22 @@ function makeHeadlessRunAgent(opts = {}) {
         if (opts.provider) args.push("--provider", opts.provider);
         if (opts.ephemeral === true) args.push("--ephemeral");
         if (opts.sandboxMode) args.push("--sandbox-mode", opts.sandboxMode);
+        if (binding)
+          args.push(
+            "--no-project-memory",
+            "--no-file-refs",
+            "--no-slash-macros",
+            "--no-mcp",
+            "--no-ide",
+            "--no-pdh",
+            "--no-jetbrains",
+          );
         if (Number.isFinite(costBudgetUsd) && costBudgetUsd >= 0)
           args.push("--max-budget-usd", String(costBudgetUsd));
       }
       const child = _deps.spawn(process.execPath, args, {
         cwd,
-        env: { ...process.env, ...(opts.env || {}), CLAUDECODE: "1" },
+        env: childEnvironment,
         windowsHide: true,
         // Own process group on POSIX so a timeout can reap the whole tree.
         detached: _deps.platform !== "win32",
@@ -417,6 +492,7 @@ export function registerEvalCommand(program, { logger } = {}) {
               ? {
                   ephemeral: true,
                   sandboxMode: tasks.verification.requiredSandboxMode,
+                  requireVerify01Binding: true,
                 }
               : {}),
           });

package/src/commands/llm.js

@@ -47,7 +47,10 @@ import {
   readLlmConnectionInput,
   saveLlmConnection,
 } from "../lib/llm-connection-config.js";
-import { probeLlmConnection } from "../lib/llm-connection-probe.js";
+import {
+  probeLlmConnection,
+  llmProbeReceipt,
+} from "../lib/llm-connection-probe.js";
 import { resolveModelCapabilityProfile } from "../lib/model-capabilities.js";
 
 /**
@@ -313,6 +316,10 @@ export function registerLlmCommand(program) {
     .option("--model <model>", "Model to test (default: configured)")
     .option("--base-url <url>", "API base URL (default: configured/provider)")
     .option("--api-key <key>", "API key (default: configured)")
+    .option(
+      "--json",
+      "Output connection result and token cost estimate as JSON",
+    )
     .action(async (options) => {
       const config = loadConfig();
       const target = resolveLlmTestTarget(
@@ -321,18 +328,46 @@ export function registerLlmCommand(program) {
         BUILT_IN_PROVIDERS,
         process.env,
       );
-      const spinner = ora(`Testing ${target.provider}...`).start();
+      const spinner = options.json
+        ? null
+        : ora(`Testing ${target.provider}...`).start();
+      const safe = (text) =>
+        target.apiKey
+          ? String(text).replaceAll(target.apiKey, "[REDACTED]")
+          : String(text);
       try {
         const start = Date.now();
 
-        const reply = await probeLlmConnection(target);
+        const reply = await probeLlmConnection(target, {
+          includeUsage: !!options.json,
+        });
+        if (options.json) {
+          console.log(
+            JSON.stringify({
+              ...reply,
+              reply: safe(reply.reply),
+              elapsedMs: Date.now() - start,
+            }),
+          );
+          return;
+        }
         spinner.succeed(
           `${chalk.green("Connected")} to ${target.label} (${target.model}) in ${Date.now() - start}ms`,
         );
         logger.log(`  Response: ${chalk.gray(reply)}`);
       } catch (err) {
-        spinner.fail(`Test failed: ${err.message}`);
-        process.exit(1);
+        if (options.json) {
+          console.log(
+            JSON.stringify({
+              ...(err.probe || llmProbeReceipt(target)),
+              error: safe(err.message),
+            }),
+          );
+          process.exitCode = 1;
+        } else {
+          spinner.fail(`Test failed: ${err.message}`);
+          process.exit(1);
+        }
       }
     });
 

package/src/data/changelog.json

@@ -1,6 +1,19 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.98",
+      "cliVersions": ["0.166.98"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.98: apply real-task findings and preserve task delivery",
+          "body": "- Bind formal task file scope and tool allowlists to isolated per-task configuration;\n  preserve rejected call identities and strict trace acceptance.\n- Keep authentication usage on failed answers, redact credentials before truncation,\n  and separate tool estimates from unknown authentication or whole-journey costs.\n- Bootstrap first-run diagnostics without development dependencies and retain the\n  actual failed journey, empty candidate, and unexecuted semantic outcomes.\n- Give finite-budget runs fresh delivery guidance without placing the changing\n  counter before the stable OpenAI-compatible conversation prefix. Preserve the\n  current user task across host and goal/hook suffixes in the canonical planner.\n- Publish changed Session Core 0.3.19 before CLI 0.166.98; retain unchanged child\n  versions only after exact-source, registry-byte and provenance verification.\n- Pair VS Code 0.37.142 and JetBrains 0.4.160 after the final source gates pass\n  and CLI 0.166.98 is publicly available. Formal 36+9 evaluation and native\n  durable authority acceptance remain open."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.97",

package/src/lib/context-memory-kernel/message-adapter.js

@@ -68,8 +68,7 @@ function trustForBundle(messages) {
   if (
     messages.every(
       (message) =>
-        message.role === "system" &&
-        getDurableSystemMessageProvenance(message),
+        message.role === "system" && getDurableSystemMessageProvenance(message),
     )
   ) {
     return "verified";
@@ -135,12 +134,16 @@ function createItem({
       observedAt: new Date(sequence).toISOString(),
     },
     trust:
-      trustedSystemPolicy && messages.every((message) => message.role === "system")
+      trustedSystemPolicy &&
+      messages.every((message) => message.role === "system")
         ? "host"
         : trustForBundle(messages),
     sensitivity: "personal",
     allowedSinks: allowedSinks || DEFAULT_ALLOWED_SINKS,
-    tokenEstimate: Math.max(1, Math.ceil(Buffer.byteLength(content, "utf8") / 4)),
+    tokenEstimate: Math.max(
+      1,
+      Math.ceil(Buffer.byteLength(content, "utf8") / 4),
+    ),
     priority: priorityForBundle(messages, sequence, pendingTool),
     pinned: false,
     createdAt: new Date(sequence).toISOString(),
@@ -195,7 +198,8 @@ export function messagesToContextItems(messagesInput, options = {}) {
         seen.add(resultId);
         cursor += 1;
       }
-      const pending = ids.length !== calls.length || seen.size !== expected.size;
+      const pending =
+        ids.length !== calls.length || seen.size !== expected.size;
       const groupDigest = canonicalDigest(
         { sessionId, index, ids: [...expected].sort() },
         "chainlesschain.cli-tool-group/v1",
@@ -245,7 +249,14 @@ export function messagesToContextItems(messagesInput, options = {}) {
     );
   }
 
-  const last = items.at(-1);
+  // Ephemeral host guidance and hook suffixes can follow the current user
+  // request. They must not turn that request into optional conversation.
+  // Stop at the last conversational/tool bundle, so completed historical
+  // user turns are not promoted over a newer assistant or tool result.
+  const lastIndex = items.findLastIndex(
+    (item) => item.kind !== "system-policy",
+  );
+  const last = items[lastIndex];
   if (last) {
     const payload = JSON.parse(last.content);
     if (payload.messages.at(-1)?.role === "user") {
@@ -257,7 +268,7 @@ export function messagesToContextItems(messagesInput, options = {}) {
         taskState: "waiting",
         requiredForRecovery: true,
       };
-      items[items.length - 1] = normalizeContextItem(protectedItem);
+      items[lastIndex] = normalizeContextItem(protectedItem);
     }
   }
   return items;
@@ -317,7 +328,9 @@ export function memoryRecordsToContextItems(recordsInput, options = {}) {
 
 function decodeBundle(item) {
   if (typeof item?.content !== "string") {
-    throw new TypeError(`ContextItem ${item?.itemId || "unknown"} has no inline content`);
+    throw new TypeError(
+      `ContextItem ${item?.itemId || "unknown"} has no inline content`,
+    );
   }
   const payload = JSON.parse(item.content);
   if (
@@ -327,17 +340,19 @@ function decodeBundle(item) {
     !Array.isArray(payload.durableSystemKinds) ||
     payload.durableSystemKinds.length !== payload.messages.length
   ) {
-    throw new TypeError(`ContextItem ${item.itemId} is not a CLI message bundle`);
+    throw new TypeError(
+      `ContextItem ${item.itemId} is not a CLI message bundle`,
+    );
   }
   return payload.messages.map((message, index) => {
     if (!message || typeof message !== "object" || Array.isArray(message)) {
-      throw new TypeError(`ContextItem ${item.itemId} contains an invalid message`);
+      throw new TypeError(
+        `ContextItem ${item.itemId} contains an invalid message`,
+      );
     }
     const copy = structuredClone(message);
     const durableKind = payload.durableSystemKinds[index];
-    return durableKind
-      ? markDurableSystemMessage(copy, durableKind)
-      : copy;
+    return durableKind ? markDurableSystemMessage(copy, durableKind) : copy;
   });
 }
 
@@ -376,7 +391,9 @@ export function createSummaryContextItem({
   if (parents.length === 0) throw new TypeError("summary parents are required");
   const scope = parents[0].scope;
   const scopeId = parents[0].scopeId;
-  if (parents.some((item) => item.scope !== scope || item.scopeId !== scopeId)) {
+  if (
+    parents.some((item) => item.scope !== scope || item.scopeId !== scopeId)
+  ) {
     throw new TypeError("summary parents must share one scope");
   }
   const summaryMessages = safeMessages(messages).map((message) =>
@@ -398,16 +415,16 @@ export function createSummaryContextItem({
     { operationId, parentDigests, content },
     "chainlesschain.cli-context-summary/v1",
   );
-  const trust = TRUST_ORDER[
-    Math.max(...parents.map((item) => TRUST_ORDER.indexOf(item.trust)))
-  ];
-  const sensitivity = SENSITIVITY_ORDER[
-    Math.max(
-      ...parents.map((item) =>
-        SENSITIVITY_ORDER.indexOf(item.sensitivity),
-      ),
-    )
-  ];
+  const trust =
+    TRUST_ORDER[
+      Math.max(...parents.map((item) => TRUST_ORDER.indexOf(item.trust)))
+    ];
+  const sensitivity =
+    SENSITIVITY_ORDER[
+      Math.max(
+        ...parents.map((item) => SENSITIVITY_ORDER.indexOf(item.sensitivity)),
+      )
+    ];
   const allowedSinks = [...intersectAllowedSinks(parents)].sort();
   if (allowedSinks.length === 0) {
     throw new TypeError("summary parents have no common allowed sink");

package/src/lib/context-memory-kernel/segmented-memory-port.js

@@ -115,6 +115,24 @@ function directories(directory) {
       realpathSync(current) === `/private${current}`;
     if (!systemAlias && (!stat.isDirectory() || stat.isSymbolicLink()))
       throw corruptStore(current, "authority directory is unsafe");
+    if (process.platform === "win32") {
+      // Some Windows runtime adapters report an ordinary directory for a
+      // junction whose target cannot be decoded in their DOS namespace. Keep
+      // the lstat guard and independently reject a different native canonical
+      // coordinate before mkdir or lock acquisition. This is an additional
+      // consistency check, not a proof against every reparse tag or a race.
+      let canonical;
+      try {
+        canonical = realpathSync.native(current);
+      } catch {
+        throw corruptStore(current, "authority directory cannot be resolved");
+      }
+      if (
+        typeof canonical !== "string" ||
+        resolve(canonical).toLowerCase() !== current.toLowerCase()
+      )
+        throw corruptStore(current, "authority directory resolves elsewhere");
+    }
     const parent = dirname(current);
     if (parent === current) break;
     current = parent;

package/src/lib/eval/runner.js

@@ -152,7 +152,13 @@ export async function runEvalSuite(tasks, opts = {}) {
       if (typeof task.check !== "function") {
         throw new Error(`task "${rec.id}": check() is required`);
       }
-      dir = _deps.mkdtempSync(path.join(base, `cc-eval-${task.id}-`));
+      // Resolve the OS temporary directory first (macOS commonly aliases
+      // /var to /private/var), then create formal workspaces at canonical paths.
+      const taskBase =
+        typeof task.agentLaunchBinding === "function"
+          ? (fs.realpathSync.native || fs.realpathSync)(base)
+          : base;
+      dir = _deps.mkdtempSync(path.join(taskBase, `cc-eval-${task.id}-`));
       if (typeof task.setup === "function") {
         await task.setup(dir, budget);
       }
@@ -169,6 +175,9 @@ export async function runEvalSuite(tasks, opts = {}) {
           prompt: task.prompt,
           cwd: dir,
           timeoutMs: budget.remainingMs(),
+          ...(typeof task.agentLaunchBinding === "function"
+            ? { verify01Binding: task.agentLaunchBinding(dir) }
+            : {}),
           ...(task.costBudgetUsd === undefined
             ? {}
             : { costBudgetUsd: task.costBudgetUsd }),
@@ -234,6 +243,18 @@ export async function runEvalSuite(tasks, opts = {}) {
       });
       rec.pass = false;
     } finally {
+      try {
+        await task?.cleanup?.();
+      } catch (error) {
+        rec.pass = false;
+        rec.error ||= `task cleanup failed: ${error.message}`;
+        rec.failurePhase = "cleanup";
+        task.recordFailure?.({
+          phase: "cleanup",
+          code: error.code || null,
+          error: error.message,
+        });
+      }
       rec.ms = _deps.now() - started;
       if (span) {
         span.setAttribute("pass", rec.pass);

package/src/lib/eval/verify01-contracts.js

@@ -1,4 +1,9 @@
-import fs from "node:fs";
+import { requireValue, relativeFile, readBytes } from "./verify01-workspace.js";
+import {
+  LLM_PROBE_SCHEMA,
+  llmProbeReceipt,
+  priceLlmProbeUsage,
+} from "../llm-connection-probe.js";
 import {
   createEvalComparison,
   EVAL_EXECUTION_PROTOCOL,
@@ -11,9 +16,92 @@ import {
   validateOutcomePlan,
 } from "./outcomes.js";
 const DIGEST = /^sha256:[a-f0-9]{64}$/u;
-const MAX_BYTES = 16 * 1024 * 1024;
-function requireValue(condition, message) {
-  if (!condition) throw new Error(message);
+/** Task terminals only cover the tool stage; authentication is a separate call. */
+export function createVerify01FirstRunCost({
+  authentication,
+  authenticationReceipt,
+  authenticated,
+  comparison,
+  toolCostUsd,
+}) {
+  requireValue(
+    DIGEST.test(authenticationReceipt || ""),
+    "first-run authentication receipt digest required",
+  );
+  requireValue(
+    toolCostUsd === null || (Number.isFinite(toolCostUsd) && toolCostUsd >= 0),
+    "invalid first-run tool cost",
+  );
+  let probe = null;
+  if (authentication !== null) {
+    requireValue(
+      authentication?.schema === LLM_PROBE_SCHEMA &&
+        authentication.provider === comparison.provider &&
+        authentication.model === comparison.model &&
+        authentication.ok === authenticated &&
+        authentication.currency === "USD" &&
+        authentication.costBasis === "token-estimate" &&
+        authentication.billingVerified === false,
+      "first-run authentication identity or estimate basis differs",
+    );
+    const usage = authentication.usage;
+    requireValue(
+      usage === null ||
+        (usage &&
+          [
+            usage.input_tokens,
+            usage.output_tokens,
+            usage.cache_read_input_tokens,
+            usage.cache_creation_input_tokens,
+          ].every((value) => Number.isSafeInteger(value) && value >= 0)),
+      "invalid first-run authentication usage",
+    );
+    const cost = priceLlmProbeUsage(comparison, usage);
+    requireValue(
+      authentication.totalCostUsd === cost,
+      "first-run authentication cost differs from its token estimate",
+    );
+    probe = llmProbeReceipt(comparison, { ok: authenticated, usage });
+  }
+  const authCostUsd = probe?.totalCostUsd ?? null;
+  const totalCostUsd =
+    authCostUsd !== null && toolCostUsd !== null
+      ? authCostUsd + toolCostUsd
+      : null;
+  requireValue(
+    totalCostUsd === null || Number.isFinite(totalCostUsd),
+    "first-run total cost overflow",
+  );
+  return {
+    schema: "chainlesschain.verify01-first-run-cost/v1",
+    authenticationReceipt,
+    authentication: probe,
+    toolCostUsd,
+    totalCostUsd,
+  };
+}
+
+function validateFirstRunCost(observation, comparison, toolCostUsd) {
+  const accounting = observation.firstRun?.costAccounting;
+  if (!accounting) {
+    requireValue(
+      observation.cost === null,
+      "first-run cost without authentication accounting must remain unknown",
+    );
+    return;
+  }
+  const expected = createVerify01FirstRunCost({
+    authentication: accounting.authentication,
+    authenticationReceipt: observation.firstRun.stages.authenticate.receipt,
+    authenticated: observation.firstRun.stages.authenticate.passed,
+    comparison,
+    toolCostUsd,
+  });
+  requireValue(
+    outcomeDigest(accounting) === outcomeDigest(expected) &&
+      observation.cost === expected.totalCostUsd,
+    "first-run journey cost differs from authentication plus tool cost",
+  );
 }
 function index(rows, key, label) {
   requireValue(Array.isArray(rows), `${label} must be an array`);
@@ -29,51 +117,6 @@ function index(rows, key, label) {
   }
   return result;
 }
-function relativeFile(value) {
-  requireValue(
-    typeof value === "string" &&
-      value.length > 0 &&
-      !/[\\:*?<>|"\u0000]/u.test(value) &&
-      !value.startsWith("/") &&
-      value.split("/").every((part) => part && !/[. ]$/u.test(part)),
-    "review paths must be exact relative files",
-  );
-  return value;
-}
-function readBytes(file) {
-  const descriptor = fs.openSync(file, "r");
-  try {
-    const before = fs.fstatSync(descriptor, { bigint: true });
-    requireValue(
-      before.isFile() && before.size <= BigInt(MAX_BYTES),
-      "input must be a regular file within 16 MiB",
-    );
-    const bytes = Buffer.alloc(Number(before.size) + 1);
-    let count = 0;
-    while (count < bytes.length) {
-      const size = fs.readSync(
-        descriptor,
-        bytes,
-        count,
-        bytes.length - count,
-        null,
-      );
-      if (!size) break;
-      count += size;
-    }
-    const after = fs.fstatSync(descriptor, { bigint: true });
-    requireValue(
-      count === Number(before.size) &&
-        ["dev", "ino", "size", "mtimeNs", "ctimeNs"].every(
-          (key) => before[key] === after[key],
-        ),
-      "input changed during read",
-    );
-    return bytes.subarray(0, count);
-  } finally {
-    fs.closeSync(descriptor);
-  }
-}
 const readJson = (file) => JSON.parse(readBytes(file).toString("utf8"));
 
 export function validateVerify01Bundle({
@@ -278,6 +321,12 @@ export function validateVerify01Collection(
           row.reasons.every((reason) => failureReasons.has(reason)),
         "invalid first-run early-stop evidence",
       );
+      // A failed tool stage does not prove no billable request was attempted.
+      validateFirstRunCost(
+        observation,
+        bundle.bindings.comparisons[sample.stratum],
+        null,
+      );
       continue;
     }
     const run = runs.get(observation.runId);
@@ -309,10 +358,16 @@ export function validateVerify01Collection(
     used.add(key);
     const cost = result.totalCostUsd;
     requireValue(
-      (cost === null || (Number.isFinite(cost) && cost >= 0)) &&
-        observation.cost === cost,
+      cost === null || (Number.isFinite(cost) && cost >= 0),
       "unknown or mismatched cost must not become zero",
     );
+    if (sample.kind === "first-run")
+      validateFirstRunCost(observation, run.comparison, cost);
+    else
+      requireValue(
+        observation.cost === cost,
+        "unknown or mismatched cost must not become zero",
+      );
     requireValue(
       Array.isArray(result.changedFiles) &&
         new Set(result.changedFiles).size === result.changedFiles.length,