chad-code 1.11.0__tar.gz → 1.13.0__tar.gz

{chad_code-1.11.0 → chad_code-1.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chad-code
-Version: 1.11.0
+Version: 1.13.0
 Summary: Local MLX-backed, Claude-Code-style coding agent (Apple Silicon, Ornith 35B/9B)
 License-Expression: MIT
 Project-URL: Repository, https://github.com/nathansutton/chad

{chad_code-1.11.0 → chad_code-1.13.0}/pyproject.toml

@@ -4,7 +4,7 @@
 # import name, and command name are independent. `uvx chad-code` runs the alias
 # script added under [project.scripts].
 name = "chad-code"
-version = "1.11.0"
+version = "1.13.0"
 description = "Local MLX-backed, Claude-Code-style coding agent (Apple Silicon, Ornith 35B/9B)"
 readme = "README.md"
 license = "MIT"

{chad_code-1.11.0 → chad_code-1.13.0}/src/chad/__init__.py

@@ -4,7 +4,7 @@ A flat collection of cooperating modules behind one console script (``chad``):
 the inference engine, the tool layer, the agent loop, and the terminal UI.
 """
 
-__version__ = "1.11.0"
+__version__ = "1.13.0"
 
 # chad sets no MLX_* runtime vars. MLX_METAL_FAST_SYNCH, MLX_MAX_OPS_PER_BUFFER
 # and MLX_MAX_MB_PER_BUFFER were each measured end-to-end on the 35B and every

{chad_code-1.11.0 → chad_code-1.13.0}/src/chad/agent.py

@@ -14,7 +14,18 @@ import re
 import sys
 import time
 
-from . import ambient, atif, compaction, config, guardrails, levers, session, syntaxgate
+from . import (
+    ambient,
+    atif,
+    checkpoint,
+    compaction,
+    config,
+    guardrails,
+    levers,
+    seatbelt,
+    session,
+    syntaxgate,
+)
 from .base_engine import BackendError, BaseEngine
 from .diag import args_preview, log, redact, result_preview
 from .prompt import build_subagent_prompt, build_system_prompt, classify_intent
@@ -326,7 +337,7 @@ class Agent:
                  ctx_limit: int = 24000, mode: str = None, emit=None,
                  confirm=None, should_stop=None, drain_steering=None,
                  thinking: bool = True,
-                 max_gen_tokens: int = 8192, resume: list = None, persist: bool = False,
+                 max_gen_tokens: int = None, resume: list = None, persist: bool = False,
                  think_budget: int = None, think_ceiling: int = None,
                  turn_budget_tokens: int = None,
                  turn_budget_s: float = None, subagent: bool = False,
@@ -366,8 +377,21 @@ class Agent:
         # Per-step generation cap. The old 2048 default truncated legitimate work —
         # a reasoning turn that thinks, then emits a `write` of a whole test file can
         # exceed 2048 tokens, and the cut-off was being misread as a final answer
-        # (the "answers on paper then stops" bug). 8192 leaves room for think + a
-        # full-file write; truncation past it is now detected and nudged, not accepted.
+        # (the "answers on paper then stops" bug). 8192 fixed that but had its own
+        # loss class: on hard problems a long chain of thought can pin the cap while
+        # still inside <think>, so the step ends as discarded reasoning with no
+        # action and the next step re-derives from scratch — trace measurement shows
+        # these mid-think pins cluster on exactly the tasks that fail, and that an
+        # uncapped run of the same model almost never exceeds 8192 on its own
+        # (p99 ~4.7k) yet the rare 15-20k thought that does run long completes real
+        # work when allowed to finish. So the cap buys little in the common case and
+        # converts the long-thought tail into zero-progress dead steps. 32768 keeps
+        # a backstop against non-repetitive runaway garble (literal decode loops are
+        # the repeat guard's job, default ON) while fitting the longest observed
+        # legitimate thought with room for the action. Env knob for A/B without a
+        # code change (CHAD_* family).
+        if max_gen_tokens is None:
+            max_gen_tokens = config.env_int("CHAD_MAX_GEN_TOKENS", 32768)
         self.max_gen_tokens = max_gen_tokens
         # Soft think-cap base. None => the mechanism is OFF and generation is
         # byte-identical to before. Falls back to the CHAD_THINK_BUDGET env knob so the
@@ -838,6 +862,10 @@ class Agent:
         break_nudges = 0      # times we escalated a stuck edit this turn
         readonly_streak = 0   # consecutive steps with substantive tools but no landed edit
         gate_nudges = 0       # times the investigation->edit gate fired this turn
+        explore_streak = 0    # consecutive bash steps since the last landed edit (counts
+                              # AFTER an edit too — investigation_gate can't; see
+                              # guardrails.verification_matrix)
+        explore_gate_fires = 0  # times the verification-matrix gate fired this turn
         subagent_sigs = set() # (description, prompt) of sub-agents already spawned this turn
         truncation_nudges = 0  # times we pushed past a token-cap truncation this turn
         garble_nudges = 0  # malformed-tool-call re-nudges (own counter, so a step-0
@@ -1094,7 +1122,7 @@ class Agent:
                     return n >= _cap and "</think>" not in text_so_far
 
             # Degenerate-repetition stop (default ON): greedy decode can lock into
-            # repeating one short string until the 8192-token cap — ~4 minutes of dead
+            # repeating one short string until the max_gen_tokens cap — minutes of dead
             # generation per occurrence at 9B decode speed. Checked every 16 tokens on
             # the generation's tail; a hit stops the step (rep_fired tells this stopper
             # apart from the think-cap, which shares stats.stop_condition_fired) and the
@@ -1357,7 +1385,7 @@ class Agent:
                     # inside <think> — a distinct sub-bucket from a THINK-CAP/ceiling stop
                     # (those are agent-side stop_conditions; this is max_gen_tokens itself),
                     # so future autopsies can size it directly instead of inferring from
-                    # max_gen==8192. A salvaged step already injected the closing tag, so
+                    # the max_gen value. A salvaged step already injected the closing tag, so
                     # this is naturally False for it.
                     "reasoning_length_stop": hit_cap and "</think>" not in text,
                     "deadline_abort": deadline_fired[0],  # 103: wall-clock hard wrap-up cut
@@ -1971,12 +1999,27 @@ class Agent:
                 else:
                     _t0 = time.perf_counter()
                     self.tool_dispatches += 1
+                    # A snapshot happens AFTER approval, immediately before the tool
+                    # runs — a denied edit must not leave a checkpoint claiming it ran.
+                    if (name in AUTO_EDIT_TOOLS
+                            and levers.enabled("edit_checkpoint")):
+                        _ref = checkpoint.snapshot(
+                            os.getcwd(), f"before {name} {args.get('path', '')}".strip())
+                        if _ref:
+                            levers.fired("edit_checkpoint", step=step, ref=_ref)
+                    # Seatbelt context is scoped to exactly this dispatch: `active`
+                    # reflects the mode of the agent actually executing, so a
+                    # sub-agent's yolo loop is confined inside a normal-mode parent
+                    # turn, and the context can't leak to the `!cmd` passthrough.
+                    seatbelt.set_context(self.mode == "yolo", os.getcwd())
                     try:
                         result = fn(args, self._should_stop)
                         if plan_write and result.startswith("[wrote"):
                             self.last_plan_path = os.path.abspath(args["path"])
                     except Exception as e:  # noqa: BLE001 - surface tool errors to model
                         result = f"[tool error: {type(e).__name__}: {e}]"
+                    finally:
+                        seatbelt.set_context(False, None)
                     _tool_s = time.perf_counter() - _t0
                     # Backstop: bound the prefill from any tool, AND from the step as a
                     # whole — several calls in one step stack into one prefill, so later
@@ -2144,6 +2187,29 @@ class Agent:
                              step, gate_nudges)
                     self.messages.append({"role": "tool", "name": "edit", "content": gate})
 
+            # Convergence gate (verification-matrix design): count exploratory-
+            # bash steps since the last landed edit — unlike readonly_streak/
+            # investigation_gate this keeps counting AFTER an edit lands, which is where
+            # the demonstrated thrash lives (write early, then probe 60 more times
+            # without calling done). A NEW edit this step resets it; a bash-only step
+            # advances it. When it bites, the model gets the task's real requirements as
+            # a matrix to close by evidence-or-unverified, not an open-ended "keep going".
+            if made_edit and not _gov_prev_made:
+                explore_streak = 0
+            elif any(n == "bash" for n, _ in calls):
+                explore_streak += 1
+            if not read_only_intent:
+                matrix = guardrails.verification_matrix(
+                    guardrails.audit_task_text(user_text),
+                    explore_streak, made_edit, explore_gate_fires)
+                if matrix:
+                    explore_gate_fires += 1
+                    explore_streak = 0
+                    log.info("VERIFICATION-MATRIX gate at step %d (bash-streak, no "
+                             "change) -> nudge #%d", step, explore_gate_fires)
+                    self.messages.append(
+                        {"role": "tool", "name": "bash", "content": matrix})
+
             # Break a flailing-probe run (e.g. guessing the test runner, repeated
             # `python -c import` checks) that the exact-call loop guard can't see because
             # each failing command differs by a few characters.

chad_code-1.13.0/src/chad/checkpoint.py

@@ -0,0 +1,150 @@
+"""Shadow-git checkpoints for file edits (lever: edit_checkpoint).
+
+Auto-approved edits are justified as "a diff you can read and revert" — this
+module supplies the revert. Before each file-mutating tool lands, the workspace
+is committed to a *shadow* git repository under ~/.chad/checkpoints/<hash>. The
+user's own .git is never opened, never written, never required to exist: the
+shadow repo has its own GIT_DIR and treats the workspace purely as a work tree.
+/undo and /restore in the TUI check files back out of it.
+
+Failure policy: never raise. An edit must not die because the checkpoint
+machinery hiccuped — snapshot() returns None on any failure and the tool call
+proceeds unprotected (logged, and visible in `chad levers` firing counts as the
+absence of a fire).
+
+Restore policy (deliberately conservative): `git restore --source=<ref>` puts
+every snapshotted file back to its snapshotted content. Files *created after*
+the snapshot are left in place — deleting files is exactly the blast radius this
+lever exists to contain, so the restore path never does it.
+"""
+
+import hashlib
+import logging
+import os
+import subprocess
+from typing import Optional
+
+log = logging.getLogger("chad")
+
+_GIT_TIMEOUT_S = 120  # first snapshot of a big tree is seconds; never hang a turn
+
+# Junk that snapshots must not swallow when the workspace has no .gitignore of its
+# own (a non-git project): written to the shadow repo's info/exclude, which
+# composes with any workspace .gitignore rather than replacing it.
+_DEFAULT_EXCLUDES = (".venv/\nvenv/\nnode_modules/\n__pycache__/\n*.pyc\n"
+                     ".mypy_cache/\n.ruff_cache/\n.pytest_cache/\n.DS_Store\n")
+
+
+def _history_root() -> str:
+    # CHAD_CHECKPOINT_DIR: test/e2e override so suites never write real home state.
+    # NOT ~/.chad/history — that name is taken by the TUI's prompt-history FILE.
+    env = os.environ.get("CHAD_CHECKPOINT_DIR")
+    if env:
+        return env
+    return os.path.join(os.path.expanduser("~"), ".chad", "checkpoints")
+
+
+def shadow_dir(workspace: str) -> str:
+    ws = os.path.realpath(workspace)
+    tag = hashlib.sha1(ws.encode()).hexdigest()[:16]
+    return os.path.join(_history_root(), tag, "shadow.git")
+
+
+def _git(workspace: str, *args: str) -> subprocess.CompletedProcess:
+    """Run git against the shadow repo with the workspace as work tree. Identity
+    and signing come from -c flags so the user's global config is never consulted
+    for authorship and never mutated."""
+    cmd = ["git", "--git-dir", shadow_dir(workspace), "--work-tree",
+           os.path.realpath(workspace),
+           "-c", "user.email=chad@localhost", "-c", "user.name=chad",
+           "-c", "commit.gpgsign=false", "-c", "core.hooksPath=/dev/null",
+           *args]
+    return subprocess.run(cmd, capture_output=True, text=True,
+                          timeout=_GIT_TIMEOUT_S, check=False)
+
+
+def _ensure_shadow(workspace: str) -> bool:
+    sd = shadow_dir(workspace)
+    if os.path.isdir(sd):
+        return True
+    try:
+        os.makedirs(os.path.dirname(sd), exist_ok=True)
+        r = subprocess.run(["git", "init", "-q", "--bare", sd],
+                           capture_output=True, text=True,
+                           timeout=_GIT_TIMEOUT_S, check=False)
+        if r.returncode != 0:
+            log.warning("CHECKPOINT shadow init failed: %s", r.stderr.strip())
+            return False
+        info = os.path.join(sd, "info")
+        os.makedirs(info, exist_ok=True)
+        with open(os.path.join(info, "exclude"), "w", encoding="utf-8") as fh:
+            fh.write(_DEFAULT_EXCLUDES)
+        return True
+    except (OSError, subprocess.SubprocessError) as e:
+        log.warning("CHECKPOINT shadow init failed: %s", e)
+        return False
+
+
+def snapshot(workspace: str, label: str) -> Optional[str]:
+    """Commit the workspace state to the shadow repo; return the short hash, or
+    None if no checkpoint exists after the attempt. An unchanged tree is not a
+    failure — the previous snapshot already covers it, so its hash is returned."""
+    try:
+        if not _ensure_shadow(workspace):
+            return None
+        add = _git(workspace, "add", "-A")
+        if add.returncode != 0:
+            log.warning("CHECKPOINT add failed: %s", add.stderr.strip())
+            return None
+        commit = _git(workspace, "commit", "-q", "-m", label)
+        head = _git(workspace, "rev-parse", "--short", "HEAD")
+        if head.returncode != 0:
+            # Nothing staged AND no prior snapshot — an empty workspace's first
+            # checkpoint. Record the empty state anyway so the timeline exists.
+            commit = _git(workspace, "commit", "-q", "--allow-empty", "-m", label)
+            head = _git(workspace, "rev-parse", "--short", "HEAD")
+            if head.returncode != 0:
+                log.warning("CHECKPOINT commit failed: %s", commit.stderr.strip())
+                return None
+        return head.stdout.strip()
+    except (OSError, subprocess.SubprocessError) as e:
+        log.warning("CHECKPOINT snapshot failed: %s", e)
+        return None
+
+
+def snapshots(workspace: str, limit: int = 10) -> list:
+    """Newest-first [(short_hash, iso_time, label)] — empty on any failure."""
+    try:
+        r = _git(workspace, "log", f"-{limit}", "--format=%h%x09%cI%x09%s")
+        if r.returncode != 0:
+            return []
+        rows = []
+        for line in r.stdout.splitlines():
+            parts = line.split("\t", 2)
+            if len(parts) == 3:
+                rows.append((parts[0], parts[1], parts[2]))
+        return rows
+    except (OSError, subprocess.SubprocessError):
+        return []
+
+
+def restore(workspace: str, ref: str = "HEAD") -> str:
+    """Check snapshotted files back out at `ref`. Returns a human-readable
+    one-liner (also used verbatim by the TUI)."""
+    try:
+        ok = _git(workspace, "rev-parse", "--verify", "--quiet", f"{ref}^{{commit}}")
+        if ok.returncode != 0:
+            have = snapshots(workspace, limit=1)
+            return (f"no checkpoint named {ref!r}" if have else
+                    "no checkpoints exist for this workspace yet — snapshots are "
+                    "taken before file edits when the edit_checkpoint lever is on")
+        changed = _git(workspace, "diff", "--name-only", ref)
+        n = len([ln for ln in changed.stdout.splitlines() if ln.strip()])
+        r = _git(workspace, "restore", "--worktree", f"--source={ref}", "--", ".")
+        if r.returncode != 0:
+            return f"restore failed: {r.stderr.strip() or 'unknown git error'}"
+        label = _git(workspace, "log", "-1", "--format=%s", ref).stdout.strip()
+        return (f"restored {n} file(s) to checkpoint {ref} ({label}). Files created "
+                f"since that snapshot were left in place.")
+    except (OSError, subprocess.SubprocessError) as e:
+        return f"restore failed: {e}"

{chad_code-1.11.0 → chad_code-1.13.0}/src/chad/guardrails.py

@@ -782,6 +782,67 @@ def investigation_gate(readonly_streak, made_edit, gate_nudges, threshold=6):
             "verify it. If you already know the fix, apply it this step.]")
 
 
+def verification_matrix(task_text, explore_streak, made_edit, gate_fires,
+                        threshold=8, cap=6):
+    """Pull a thrashing turn into a bounded verification phase.
+
+    The demonstrated failure (measured on the bare full-89 run against a reference
+    harness on the same model/box): chad's #1 loss class is not wrong answers, it is
+    non-convergence. 69% of failing trials never called `done` — they ran a long tail
+    of successful, exploratory bash (median 39 commands vs 12 on passes) with the SAME
+    two edits a passing trial makes, and the step cap killed them mid-poke. On
+    break-filter the failing trial ran 72 bash probes / 2 writes across 75 steps while
+    chad's OWN passing trial found the identical exploit in 13; the model knows the
+    answer and researches past the budget. A reference harness on the same weights
+    sits at chad's PASSING step count.
+
+    The design ported here reframes completion as a VERIFICATION MATRIX: every
+    requirement the task states must be closed by ONE of (a) causal evidence from a
+    real run through the public path, or (b) an explicit "unverified" note. That
+    single rule both BOUNDS the loop (a finite checklist has a terminal state, so the
+    turn knows when to stop) and blocks false-done (a row is not filled by a
+    self-authored PASS label, a snapshot, "no error", or an oracle built from the same
+    assumption as the code). The honest-unverified escape is load-bearing: it lets a
+    turn finish a genuinely-unverifiable requirement instead of thrashing on it
+    forever.
+
+    Reuses chad's own requirement extractor (`audit_requirement_lines`, the same engine
+    `done_audit` runs) so the matrix rows are the task's real predicates, not a
+    paraphrase. Fires from the THRASH entry point — the exploratory-bash streak — which
+    `done_audit` cannot reach (a ran-out turn never calls `done`) and `investigation_
+    gate` cannot reach (it freezes the moment any edit lands; this thrash is all
+    post-edit). Re-arms up to `cap`, never bare-"call done" (so it will not inflate the
+    done-but-wrong bucket that `done_audit` still guards at the actual `done`). Returns
+    nudge text or None; caller resets the streak after a firing."""
+    if not levers.enabled("verification_matrix"):
+        return None
+    if explore_streak < threshold or gate_fires >= cap:
+        return None
+    req_lines = audit_requirement_lines(task_text, audit_extract_paths(task_text))
+    levers.fired("verification_matrix", streak=explore_streak,
+                 reqs=len(req_lines), made_edit=made_edit, fires=gate_fires)
+    parts = [
+        f"[you've run ~{explore_streak} commands since your last change without "
+        "finishing. Stop exploring and close this out as a verification matrix. The "
+        "hidden grader checks the task's OWN requirements — for EACH one below, you "
+        "need exactly ONE of two things:",
+        "  (a) EVIDENCE: a real run through the actual public path that shows the "
+        "required outcome. A snapshot, your own \"PASS\"/\"OK\" text, \"no error\", or "
+        "a check you built from the same assumption as the code do NOT count.",
+        "  (b) UNVERIFIED: a plain note that you could not verify it. An honest "
+        "\"unverified\" is allowed and lets you finish; a false \"it works\" is not.",
+    ]
+    if req_lines:
+        parts.append("Requirements from the task statement:")
+        parts += [f"  > {ln}" for ln in req_lines]
+    else:
+        parts.append("Re-read the task statement and list exactly what it requires, "
+                     "then close each item as (a) or (b).")
+    parts.append("When every requirement is (a) or (b), apply any fix still needed, "
+                 "then call `done`. Do not run more exploratory probes.]")
+    return "\n".join(parts)
+
+
 def edit_failed_to_land(result: str) -> bool:
     """True when an edit/symbolic-edit tool result means the change did NOT apply — a
     no-op (old==new / replacement leaves file unchanged), an unmatched `old` string, or

{chad_code-1.11.0 → chad_code-1.13.0}/src/chad/levers.py

@@ -91,6 +91,14 @@ LEVERS: dict[str, Lever] = {
         "After ~6 read-only steps with no landed edit, steer the model to act before the "
         "step cap kills the turn with an empty patch.",
         "iter2"),
+    "verification_matrix": Lever(
+        "After ~8 exploratory-bash steps since the last change (even AFTER an edit has "
+        "landed — the case investigation_gate can't see), pull the turn into a bounded "
+        "verification phase: for each task requirement, close it with a real causal run "
+        "OR an explicit 'unverified', then `done`. Reuses done_audit's requirement "
+        "extractor; targets the 69%-of-fails non-convergence (ran-out) bucket while the "
+        "honest-unverified escape keeps it from thrashing on the genuinely-unverifiable.",
+        "iter16"),
     "edit_loop_break": Lever(
         "After 2 consecutive edits that failed to land, stop the model re-trying "
         "variations and tell it to read the real lines / replace the whole symbol.",
@@ -514,6 +522,50 @@ LEVERS: dict[str, Lever] = {
         "only a server already warmed by find_refs/hover/disambiguation is "
         "consulted; absent one, silence.",
         "ctxengine"),
+
+    # --- group "safety": blast-radius containment for unattended mutation. ---------
+    "yolo_seatbelt": Lever(
+        "In yolo mode on macOS, each bash command's shell child runs under a "
+        "Seatbelt profile (sandbox-exec) that denies file writes outside the "
+        "workspace, temp dirs, tool caches, and ~/.chad — reads, network, and exec "
+        "stay open, and ~/.chad/checkpoints (the undo history) is carved back out "
+        "so a sandboxed command cannot delete it. The model process is never "
+        "sandboxed, only the spawned shell. The startup probe proves the profile "
+        "ENFORCES (an allowed write must land, a denied write must not) before any "
+        "confinement is claimed; either failure runs unconfined with a loud log. "
+        "Fires when a denial is detected in command output: each fire is a write "
+        "the command-pattern denylist did not catch.",
+        "safety"),
+    "edit_checkpoint": Lever(
+        "Before a file-mutating tool lands, commit a workspace snapshot to a "
+        "shadow git repo under ~/.chad/checkpoints (the project's own .git is "
+        "never touched or required); /undo and /restore in the TUI revert from "
+        "it. Fires once per snapshot taken and once per restore performed.",
+        "safety"),
+    "seatbelt_protect_git": Lever(
+        "Opt-in tier on top of yolo_seatbelt: the workspace's git metadata "
+        "(.git, and a worktree's external gitdir + common dir) is write-DENIED "
+        "inside the otherwise-writable workspace, so an unreviewed command "
+        "cannot destroy project history (`rm -rf .git`) — and with "
+        "edit_checkpoint on, the undo snapshots stay tamper-proof from inside "
+        "the sandbox too. The cost is real: every .git-writing git command "
+        "(commit, add, checkout) EPERMs — sized at <=2.65% of 91,910 real "
+        "session commands, concentrated in 14% of sessions — which is why this "
+        "is its own lever, not part of the base profile. Inert unless "
+        "yolo_seatbelt is also enabled; a denial it causes surfaces through "
+        "yolo_seatbelt's own firing (the profile cannot say which rule bit).",
+        "safety", fires=PASSIVE),
+    "bash_env_guard": Lever(
+        "Spawned bash children get a FILTERED copy of the environment: variable "
+        "names shaped like credentials (…_TOKEN, …_SECRET, …_PASSWORD, "
+        "…_API_KEY, …_ACCESS_KEY(_ID), …_PRIVATE_KEY, …_CREDENTIALS) are "
+        "dropped, closing the gap where a filesystem sandbox still hands every "
+        "command the operator's cloud keys. Name-pattern only — values are "
+        "never read or logged. OFF (the default) inherits the parent env "
+        "untouched, today's behavior; commands that legitimately need a "
+        "credential need the lever off. Fires per spawn that actually dropped "
+        "something, with the count.",
+        "safety"),
 }