crosscheck-mcp 0.2.20 → 0.2.22

package/dist/node-stdio.cjs

@@ -1200,7 +1200,27 @@ var PROVIDER_CAPS = {
     // temperature, so the prefix is the fix.
     reasoning_prefixes: ["gpt-5", "gpt-6", "o1", "o3", "o4"]
   },
-  xai: { family: "openai_chat", system_role: "inline", supports_temperature: true },
+  xai: {
+    family: "openai_chat",
+    system_role: "inline",
+    // Kept `true`, unlike other reasoning models: grok-4 accepts temperature
+    // (verified 200 at 0.4 and 1.0) and a panel wants the variance. Dropping
+    // it would buy nothing and cost diversity.
+    supports_temperature: true,
+    // grok-4 IS reasoning-class — it emitted 1,432 reasoning tokens against 64
+    // visible on one call. Saying so strips the "think step by step" preambles
+    // it does not need, and lifts it off the non-reasoning ceiling (1500) onto
+    // the reasoning-safe one (2048).
+    //
+    // NOT the reason grok answers short, which was the initial guess and was
+    // wrong: at caps of 1500, 2048 and 6144 it returned 445, 404 and 461
+    // visible tokens, finish_reason=stop every time. The cap was never
+    // binding; grok is simply terse. The ceiling change removes a latent
+    // constraint, it does not make grok say more.
+    reasoning_prefixes: ["grok-4"],
+    // Measured: xAI's cap bounds visible output only. See the field docs.
+    reasoning_shares_output_budget: false
+  },
   mistral: { family: "openai_chat", system_role: "inline", supports_temperature: true },
   groq: { family: "openai_chat", system_role: "inline", supports_temperature: true },
   deepseek: { family: "openai_chat", system_role: "inline", supports_temperature: true },
@@ -1239,6 +1259,10 @@ function supportsTemperature(provider, model) {
   if (caps.supports_temperature === "model") return !isReasoningModel(provider, model);
   return Boolean(caps.supports_temperature);
 }
+function reasoningSharesOutputBudget(provider) {
+  const caps = PROVIDER_CAPS[provider.toLowerCase()];
+  return caps?.reasoning_shares_output_budget ?? true;
+}
 
 // src/providers/types.ts
 init_cjs_shims();
@@ -1254,12 +1278,20 @@ var ProviderError = class extends Error {
    *  actually fix. Distinct from `transient`: this is never worth
    *  retrying the SAME model, but IS worth trying a different one. */
   modelAccessFailure;
+  /** True for "the key works, the account is out of credit / over a spend
+   *  limit." Rides alongside kind "auth" rather than replacing it, because
+   *  every retry and fallback decision downstream is already tuned to that
+   *  kind — but the two are completely different things to a human, and
+   *  reporting "API key rejected" for an unpaid invoice sends people to
+   *  regenerate a key that was never the problem. */
+  billing;
   constructor(kind, message, opts) {
     super(message);
     this.kind = kind;
     this.status = opts?.status;
     this.transient = opts?.transient ?? defaultTransient(kind);
     this.modelAccessFailure = opts?.modelAccessFailure ?? false;
+    this.billing = opts?.billing ?? false;
     if (opts?.retryAfterS !== void 0) {
       this.retryAfterS = opts.retryAfterS;
     }
@@ -1298,7 +1330,7 @@ function httpFailureToProviderError(provider, status, bodyText, retryAfterS, mod
     return new ProviderError(
       "auth",
       `${provider}: out of credits or billing isn't set up (HTTP ${status}). Your API key is reaching ${provider}, but the account has no usable balance \u2014 add credits / enable billing in your ${provider} console, then retry. Detail: ${detail}`,
-      { status }
+      { status, billing: true }
     );
   }
   if (status === 401 || status === 403) {
@@ -1483,6 +1515,23 @@ async function acquireRateLimit(provider, deps) {
 var ANTHROPIC_API_URL = "https://api.anthropic.com/v1/messages";
 var ANTHROPIC_VERSION_HEADER = "2023-06-01";
 var ANTHROPIC_STRUCTURED_TOOL_NAME = "structured_output";
+function applyPromptCaching(body, env = process.env) {
+  const flag = (env["CROSSCHECK_ANTHROPIC_PROMPT_CACHE"] ?? "").trim();
+  if (flag === "0" || flag.toLowerCase() === "false") return;
+  if (typeof body.system === "string" && body.system !== "") {
+    body.system = [{ type: "text", text: body.system, cache_control: { type: "ephemeral" } }];
+  }
+  if (body.messages.length >= 2) {
+    const idx = body.messages.length - 2;
+    const m = body.messages[idx];
+    if (typeof m.content === "string" && m.content !== "") {
+      body.messages[idx] = {
+        role: m.role,
+        content: [{ type: "text", text: m.content, cache_control: { type: "ephemeral" } }]
+      };
+    }
+  }
+}
 function buildAnthropicRequest(opts) {
   let system;
   const convo = [];
@@ -1507,6 +1556,7 @@ function buildAnthropicRequest(opts) {
   if (system !== void 0) {
     body.system = system;
   }
+  applyPromptCaching(body);
   if (isReasoningModel("anthropic", opts.model)) {
     if (opts.model.toLowerCase().startsWith("claude-fable-5")) {
       body.thinking = { type: "adaptive" };
@@ -1566,6 +1616,7 @@ function parseAnthropicResponse(opts) {
   const prompt = Math.trunc(Number(u["input_tokens"] ?? 0)) || 0;
   const cached = Math.trunc(Number(u["cache_read_input_tokens"] ?? 0)) || 0;
   const completion = Math.trunc(Number(u["output_tokens"] ?? 0)) || 0;
+  const cacheWrite = Math.trunc(Number(u["cache_creation_input_tokens"] ?? 0)) || 0;
   const usage = {
     provider: "anthropic",
     model: opts.model,
@@ -1573,7 +1624,7 @@ function parseAnthropicResponse(opts) {
     // production helper folds them in so prompt_tokens is the FULL
     // input volume; calculateCost then bills the cached subset at the
     // cached rate (cached <= prompt_tokens, since prompt = input+cached).
-    prompt_tokens: prompt + cached,
+    prompt_tokens: prompt + cached + cacheWrite,
     completion_tokens: completion,
     cached_tokens: cached,
     total_tokens: 0,
@@ -1925,16 +1976,21 @@ function parseOpenAICompatibleResponse(opts) {
   const u = r["usage"] ?? {};
   const details = u["prompt_tokens_details"] ?? {};
   const cached = Math.trunc(Number(details["cached_tokens"] ?? 0)) || 0;
+  const promptTokens = Math.trunc(Number(u["prompt_tokens"] ?? 0)) || 0;
+  const reportedCompletion = Math.trunc(Number(u["completion_tokens"] ?? 0)) || 0;
+  const reportedTotal = Math.trunc(Number(u["total_tokens"] ?? 0)) || 0;
+  const derivedCompletion = reportedTotal > promptTokens ? reportedTotal - promptTokens : reportedCompletion;
+  const completionTokens = Math.max(reportedCompletion, derivedCompletion);
   const usage = {
     provider: opts.provider,
     model: opts.model,
-    prompt_tokens: Math.trunc(Number(u["prompt_tokens"] ?? 0)) || 0,
-    completion_tokens: Math.trunc(Number(u["completion_tokens"] ?? 0)) || 0,
+    prompt_tokens: promptTokens,
+    completion_tokens: completionTokens,
     cached_tokens: cached,
     // Use the response's reported total_tokens directly. Python's
     // `Usage.to_dict()` falls back to prompt+completion only when
     // total_tokens is 0/missing; mirror that.
-    total_tokens: Math.trunc(Number(u["total_tokens"] ?? 0)) || 0,
+    total_tokens: reportedTotal,
     cost_usd: 0,
     estimated: Object.keys(u).length === 0,
     purpose: opts.purpose
@@ -1976,7 +2032,11 @@ async function sendOpenAICompatible(args) {
       body.reasoning_effort = effort;
     }
   }
-  if (isReasoningModel(args.provider, args.model) && typeof body.max_completion_tokens === "number") {
+  if (isReasoningModel(args.provider, args.model) && // Only where the cap is a SHARED budget. On a provider that bounds visible
+  // output only (xAI), headroom cannot protect the answer from being crowded
+  // out — nothing is crowding it — so it would merely authorise a
+  // 25,000-token reply and the bill that comes with it.
+  reasoningSharesOutputBudget(args.provider) && typeof body.max_completion_tokens === "number") {
     const raw = Number(process.env["CROSSCHECK_OPENAI_REASONING_HEADROOM_TOKENS"]);
     const headroom = Number.isFinite(raw) && raw >= 0 ? Math.trunc(raw) : 25e3;
     body.max_completion_tokens += headroom;
@@ -2292,7 +2352,7 @@ var import_zod = require("zod");
 // src/server-meta.ts
 init_cjs_shims();
 var SERVER_NAME = "crosscheck-agent";
-var SERVER_VERSION = true ? "0.2.20" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.2.22" : "0.0.0-dev";
 
 // src/tools/audit.ts
 init_cjs_shims();
@@ -2805,7 +2865,9 @@ async function attachUsageBlock(result, answers, opts) {
       purpose: a.usage?.purpose ?? null,
       wall_ms: a.elapsed_ms ?? 0,
       cpu_ms: a.cpu_ms ?? 0,
-      cache_hit: Boolean(a.cache_hit)
+      cache_hit: Boolean(a.cache_hit),
+      ...a.error_kind ? { error_kind: a.error_kind } : {},
+      ...a.error_billing ? { error_billing: true } : {}
     }))
   };
   result["timing"] = timing;
@@ -3114,11 +3176,13 @@ async function askOne(provider, messages, opts) {
     const cpuMs = Math.trunc((cpu.user + cpu.system) / 1e3);
     const kind = e instanceof ProviderError ? e.kind : "other";
     const msg = e instanceof Error ? e.message : String(e);
+    const billing = e instanceof ProviderError && e.billing;
     return {
       provider: provider.name,
       model: provider.model,
       error: msg,
       error_kind: kind,
+      ...billing ? { error_billing: true } : {},
       attempts: 0,
       usage: emptyUsage(provider.name, provider.model, opts.purpose),
       cache_hit: false,
@@ -12780,7 +12844,7 @@ var CHECK_INTERVAL_SECONDS = 3 * 24 * 60 * 60;
 var DEFAULT_PACKAGE = "crosscheck-cli";
 var FETCH_TIMEOUT_MS = 3e3;
 function engineVersion() {
-  return true ? "0.2.20" : "0.0.0-dev";
+  return true ? "0.2.22" : "0.0.0-dev";
 }
 function defaultUpdateCachePath() {
   const base = process.env["CROSSCHECK_DATA_DIR"] || import_node_path13.default.join(import_node_os2.default.homedir() || import_node_os2.default.tmpdir(), ".crosscheck");
@@ -14795,6 +14859,23 @@ function getConfig2() {
   config = { url, seatId, orgId, seatKey };
   return config;
 }
+function errorClassFor(kind) {
+  switch (kind) {
+    case "auth":
+      return "auth";
+    case "rate_limit":
+      return "rate_limit";
+    case "timeout":
+      return "timeout";
+    case "server":
+      return "server";
+    // network/parse/client/other all mean "we don't know that the key is
+    // bad", and guessing wrong here is what produces a dashboard that cries
+    // wolf. Say unknown.
+    default:
+      return "unknown";
+  }
+}
 function intNonNeg(v) {
   const n = Math.trunc(Number(v));
   return Number.isFinite(n) && n > 0 ? n : 0;
@@ -14802,12 +14883,12 @@ function intNonNeg(v) {
 function usageEventsFromEnvelope(out, toolName) {
   if (!out || typeof out !== "object" || Array.isArray(out)) return [];
   const usage = out["usage"];
-  if (!usage || typeof usage !== "object") return [];
-  const byCall = usage["by_call"];
-  if (!Array.isArray(byCall) || byCall.length === 0) return [];
+  const rawByCall = usage && typeof usage === "object" ? usage["by_call"] : void 0;
+  const byCall = Array.isArray(rawByCall) ? rawByCall : [];
   const timing = out["timing"];
   const timingByCall = timing && typeof timing === "object" ? timing["by_call"] : void 0;
-  const latencies = Array.isArray(timingByCall) ? timingByCall : [];
+  const allTiming = Array.isArray(timingByCall) ? timingByCall : [];
+  const latencies = allTiming;
   const aligned = latencies.length === byCall.length;
   const pattern = toolToPattern(toolName);
   const events = [];
@@ -14817,13 +14898,18 @@ function usageEventsFromEnvelope(out, toolName) {
     if (!provider) continue;
     const model = String(u.model ?? "").slice(0, 128) || "unknown";
     const cost = Math.max(0, Number(u.cost_usd) || 0);
-    const latencyMs = aligned ? intNonNeg(latencies[i]?.["wall_ms"]) : 0;
+    const timingRow = aligned ? latencies[i] : void 0;
+    if (timingRow?.["error_kind"]) continue;
+    const promptTokens = intNonNeg(u.prompt_tokens);
+    const completionTokens = intNonNeg(u.completion_tokens);
+    if (promptTokens === 0 && completionTokens === 0) continue;
+    const latencyMs = intNonNeg(timingRow?.["wall_ms"]);
     events.push({
       provider,
       model,
       pattern,
-      promptTokens: intNonNeg(u.prompt_tokens),
-      completionTokens: intNonNeg(u.completion_tokens),
+      promptTokens,
+      completionTokens,
       costUsdEstimate: cost,
       latencyMs,
       status: "ok",
@@ -14832,6 +14918,28 @@ function usageEventsFromEnvelope(out, toolName) {
       purpose: normalizePurpose(u.purpose)
     });
   }
+  for (const t of allTiming) {
+    const row = t;
+    const kind = row["error_kind"];
+    if (!kind) continue;
+    const provider = providerToSchema(String(row["provider"] ?? ""));
+    if (!provider) continue;
+    events.push({
+      provider,
+      model: String(row["model"] ?? "").slice(0, 128) || "unknown",
+      pattern,
+      // A failure consumed no tokens and cost nothing. Recording it with a
+      // nonzero cost would corrupt the per-feature ledger with money nobody
+      // spent.
+      promptTokens: 0,
+      completionTokens: 0,
+      costUsdEstimate: 0,
+      latencyMs: intNonNeg(row["wall_ms"]),
+      status: "error",
+      errorClass: row["error_billing"] ? "auth" : errorClassFor(String(kind)),
+      purpose: normalizePurpose(row["purpose"])
+    });
+  }
   return events;
 }
 var queue = [];
@@ -14858,6 +14966,10 @@ function enqueue(cfg2, input, runId, fingerprint) {
     costUsdEstimate: input.costUsdEstimate,
     latencyMs: input.latencyMs,
     status: input.status,
+    // Only present on failures. The canonical body renders an absent
+    // errorClass as "", so omitting and sending "" sign identically — but
+    // omitting keeps the JSON honest about what we actually know.
+    ...input.errorClass === void 0 ? {} : { errorClass: input.errorClass },
     runId,
     // Omit entirely (not "") when unknown, so the canonical body stays
     // consistent with what the server reconstructs from the JSON.