@alisio/core 0.1.0-alpha.3 → 0.1.0-alpha.6

package/dist/application.d.ts

@@ -1,4 +1,4 @@
-import type { AvailableProviderModel, ModelInfo, ModelProvider, Plugin, PluginCategory, ResolvedProviderModel, RunEvent } from "@alisio/sdk";
+import type { AvailableProviderModel, ModelInfo, ModelProvider, Plugin, PluginCategory, ProviderConfigurationValue, ResolvedProviderModel, RunEvent } from "@alisio/sdk";
 import type { ApprovalHandler } from "./core/contracts.ts";
 import { ToolRegistry } from "./core/registry.ts";
 import { AgentRunner } from "./core/runner.ts";
@@ -142,11 +142,25 @@ export declare function createApplication(options?: AppOptions): Promise<{
     mcp: McpConnector;
     /** Current-process MCP grant; deliberately independent from persisted server enablement. */
     mcpRuntimePermission(): "granted" | "not-granted" | "read-only";
+    /** Whether global MCP consent (`mcp.allow`) is persisted for this user right now. */
+    mcpAllowPersisted(): boolean;
+    /**
+     * Sanitized per-server failures collected while auto-connecting enabled servers at startup
+     * (only when runtime permission was granted). Never includes credentials or command paths.
+     */
+    mcpStartupFailures(): string[];
     /** Host-owned interactive consent boundary. Headless callers remain blocked unless flagged. */
     grantMcpRuntimePermission(request: {
         source: "interactive-tui";
         confirmed: boolean;
     }): "granted" | "not-granted" | "read-only";
+    /** Persist global consent atomically, then grant runtime permission for this process. */
+    rememberGlobalMcpConsent(): Promise<void>;
+    /**
+     * Clear the persisted global consent atomically and drop the runtime permission (disconnecting
+     * servers as cleanup does). An explicit this-run `--allow-mcp` flag keeps the grant alive.
+     */
+    revokeGlobalMcpConsent(): Promise<void>;
     /** Persist an MCP toggle in its defining layer, then safely update this process. */
     setMcpEnabled(id: string, enabled: boolean, connect?: boolean): Promise<import("./index.ts").McpServerInfo>;
     provider: ActiveProvider;
@@ -155,7 +169,7 @@ export declare function createApplication(options?: AppOptions): Promise<{
     readonly providerError: string | undefined;
     readonly providerInfo: {
         id: string;
-        profile: Record<string, import("@alisio/sdk").ProviderConfigurationValue>;
+        profile: Record<string, ProviderConfigurationValue>;
         persisted: boolean;
         profileName: string;
     } | {
@@ -167,6 +181,12 @@ export declare function createApplication(options?: AppOptions): Promise<{
     runner: AgentRunner;
     herdr: HerdrBridge;
     contextWindow: (model: string) => number | undefined;
+    /** Effective context budget + compaction point shared by the runner and the TUI bar. */
+    contextBudget: (model: string) => {
+        total?: number;
+        basis: "window" | "unknown";
+        compactionAt: number;
+    };
     loadModels: (signal: AbortSignal) => Promise<ModelInfo[]>;
     /** Creates a provider for validation/model discovery without changing the active provider. */
     probeProvider(id: string, profile: Record<string, import("@alisio/sdk").ProviderConfigurationValue>, credentials: Record<string, string>, signal: AbortSignal): Promise<ModelInfo[]>;

package/dist/application.js

@@ -1,6 +1,6 @@
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { configFile, configHome, loadConfigWithProvenance, overridesSavedProviderProfile, setMcpServerEnabled, setProjectPluginEnabled, setProjectSkillEnabled, stateHome, } from "./config.js";
+import { configFile, configHome, loadConfigWithProvenance, overridesSavedProviderProfile, setGlobalMcpAllow, setMcpServerEnabled, setProjectPluginEnabled, setProjectSkillEnabled, stateHome, } from "./config.js";
 import { completeText } from "./core/compaction.js";
 import { ToolRegistry } from "./core/registry.js";
 import { AgentRunner } from "./core/runner.js";
@@ -28,6 +28,17 @@ const nonBlank = (value) => {
     const normalized = value?.trim();
     return normalized || undefined;
 };
+/**
+ * Per-profile optional context-window override, in tokens (for local OpenAI-compatible servers
+ * like llama.cpp whose `GET /models` omits `context_window`). Numbers are used directly; strings
+ * (for example hand-edited providers.json) are parsed. Absent or unparseable means "no override".
+ */
+const parseProfileContextWindow = (value) => {
+    if (value === undefined)
+        return undefined;
+    const window = typeof value === "number" ? value : Number(String(value).trim());
+    return Number.isFinite(window) && window > 0 ? window : undefined;
+};
 export async function createApplication(options = {}) {
     const cwd = resolve(options.cwd ?? process.cwd()), workspace = await findWorkspace(cwd);
     const { config, provenance: configProvenance } = await loadConfigWithProvenance(workspace, {
@@ -37,16 +48,20 @@ export async function createApplication(options = {}) {
         baseURL: options.baseURL,
         apiMode: options.apiMode,
     });
+    // Global-only consent: `mcp.allow` is read from the user layer; the merged config never carries
+    // a project value (see loadConfigWithProvenance), so a project cannot grant itself MCP consent.
+    const mcpAllow = config.mcp.allow === true;
+    let persistedMcpAllow = mcpAllow;
     const store = new SQLiteStore(options.db ?? join(stateHome(), "sessions.sqlite"));
     const registry = new ToolRegistry(), skills = new Skills({ overrides: config.skillOverrides }), context = new ProjectContext(workspace, {
         globalDir: configHome(),
         cwd,
         claudeMdFallback: config.context.claudeMdFallback,
         maxBytes: config.context.maxBytes,
-    }), providers = new ProviderRegistry(), plugins = new PluginHost(registry, store, config.pluginHooks, providers), mcp = new McpConnector(config.mcp.servers, registry, workspace, options.readOnly ? "read-only" : options.allowMcp ? "allowed" : "disabled", config.mcpSources);
+    }), providers = new ProviderRegistry(), plugins = new PluginHost(registry, store, config.pluginHooks, providers), mcp = new McpConnector(config.mcp.servers, registry, workspace, options.readOnly ? "read-only" : options.allowMcp || mcpAllow ? "allowed" : "disabled", config.mcpSources);
     let mcpRuntimePermission = options.readOnly
         ? "read-only"
-        : options.allowMcp
+        : options.allowMcp || mcpAllow
             ? "granted"
             : "not-granted";
     const herdr = options.noHerdr
@@ -220,7 +235,9 @@ export async function createApplication(options = {}) {
             config: config.websearch,
             resolveExtension: () => plugins.extensions.resolve("websearch"),
         });
-        if (options.allowMcp && !options.readOnly)
+        const { registerPluginInstallTool } = await import("./plugins/install.js");
+        registerPluginInstallTool(registry, { readOnly: !!options.readOnly });
+        if ((options.allowMcp || mcpAllow) && !options.readOnly)
             mcp.register();
         if (options.allowAgents && !options.readOnly)
             herdr.registerTools(registry);
@@ -297,9 +314,39 @@ export async function createApplication(options = {}) {
                 throw new Error('websearch.provider is "native" but the active provider does not support native search');
         }
         const models = new Map();
-        // Priority: explicit configuration for the configured model, then GET /models.
-        const contextWindow = (model) => (model === config.provider.model ? config.provider.contextWindow : undefined) ??
-            models.get(model)?.contextWindow;
+        // Lazily (re)loads the active provider's catalog exactly once, so the ACTIVE model's
+        // contextWindow becomes known for the context bar without waiting for an explicit
+        // /model picker or autocomplete call. Failed or absent discovery stays retryable.
+        let modelsLoading;
+        const ensureModels = () => {
+            if (!provider.listModels || modelsLoading)
+                return modelsLoading;
+            modelsLoading = loadModels(AbortSignal.timeout(10_000));
+            modelsLoading.catch(() => {
+                if (modelsLoading)
+                    modelsLoading = undefined;
+            });
+            return modelsLoading;
+        };
+        // Priority: explicit configuration for the configured model, then the active saved profile's
+        // per-model override (user intent for local servers that omit context_window), then GET /models.
+        const contextWindow = (model) => {
+            const explicit = model === config.provider.model ? config.provider.contextWindow : undefined;
+            if (explicit !== undefined)
+                return explicit;
+            const override = providerInfo?.persisted && model === provider.model
+                ? parseProfileContextWindow(providerInfo.profile.contextWindow)
+                : undefined;
+            if (override !== undefined)
+                return override;
+            const known = models.get(model)?.contextWindow;
+            if (known !== undefined)
+                return known;
+            // Background prime: this call stays synchronous (the runner and the bar are sync), and
+            // once the catalog lands the map is populated for every later lookup.
+            void ensureModels();
+            return undefined;
+        };
         const loadModels = async (signal) => {
             if (!provider.listModels)
                 return [];
@@ -431,6 +478,7 @@ export async function createApplication(options = {}) {
             external: !options.readOnly &&
                 (!!options.allowExternal ||
                     !!options.allowMcp ||
+                    mcpAllow ||
                     !!options.allowAgents ||
                     plugins.externalCount > 0 ||
                     registry.list().some((t) => t.name.startsWith("p_"))),
@@ -508,6 +556,24 @@ export async function createApplication(options = {}) {
             }
             return expanded;
         };
+        // Startup auto-connect: when runtime permission is granted (--allow-mcp or global mcp.allow),
+        // connect every enabled server exactly like pressing Connect for each. Failures are per-server,
+        // sanitized and never fatal to startup.
+        const mcpStartupFailures = [];
+        if (mcpRuntimePermission === "granted") {
+            for (const [name, server] of Object.entries(config.mcp.servers)) {
+                if (!server.enabled)
+                    continue;
+                try {
+                    await mcp.connect(name, AbortSignal.timeout(15_000));
+                }
+                catch {
+                    const diagnostic = mcp.info(name).diagnostic ??
+                        "Connection failed; inspect the server separately for details";
+                    mcpStartupFailures.push(`MCP server "${name}" did not auto-connect: ${diagnostic}`);
+                }
+            }
+        }
         return {
             workspace,
             config,
@@ -595,6 +661,17 @@ export async function createApplication(options = {}) {
             mcpRuntimePermission() {
                 return mcpRuntimePermission;
             },
+            /** Whether global MCP consent (`mcp.allow`) is persisted for this user right now. */
+            mcpAllowPersisted() {
+                return persistedMcpAllow;
+            },
+            /**
+             * Sanitized per-server failures collected while auto-connecting enabled servers at startup
+             * (only when runtime permission was granted). Never includes credentials or command paths.
+             */
+            mcpStartupFailures() {
+                return [...mcpStartupFailures];
+            },
             /** Host-owned interactive consent boundary. Headless callers remain blocked unless flagged. */
             grantMcpRuntimePermission(request) {
                 if (!request.confirmed)
@@ -610,6 +687,35 @@ export async function createApplication(options = {}) {
                 mcpRuntimePermission = "granted";
                 return mcpRuntimePermission;
             },
+            /** Persist global consent atomically, then grant runtime permission for this process. */
+            async rememberGlobalMcpConsent() {
+                if (options.readOnly)
+                    throw new Error("MCP is unavailable under --read-only");
+                await setGlobalMcpAllow({ allow: true });
+                persistedMcpAllow = true;
+                this.grantMcpRuntimePermission({ source: "interactive-tui", confirmed: true });
+            },
+            /**
+             * Clear the persisted global consent atomically and drop the runtime permission (disconnecting
+             * servers as cleanup does). An explicit this-run `--allow-mcp` flag keeps the grant alive.
+             */
+            async revokeGlobalMcpConsent() {
+                if (options.readOnly)
+                    throw new Error("MCP is unavailable under --read-only");
+                await setGlobalMcpAllow({ allow: false });
+                persistedMcpAllow = false;
+                if (options.allowMcp)
+                    return;
+                if (mcpRuntimePermission !== "granted")
+                    return;
+                await mcp.revokeRuntimePermission();
+                mcpRuntimePermission = "not-granted";
+                runtimePolicy.external =
+                    !!options.allowExternal ||
+                        !!options.allowAgents ||
+                        plugins.externalCount > 0 ||
+                        registry.list().some((t) => t.name.startsWith("p_"));
+            },
             /** Persist an MCP toggle in its defining layer, then safely update this process. */
             async setMcpEnabled(id, enabled, connect = false) {
                 if (options.readOnly)
@@ -635,6 +741,8 @@ export async function createApplication(options = {}) {
             runner,
             herdr,
             contextWindow,
+            /** Effective context budget + compaction point shared by the runner and the TUI bar. */
+            contextBudget: (model) => runner.contextBudget(model),
             loadModels,
             /** Creates a provider for validation/model discovery without changing the active provider. */
             async probeProvider(id, profile, credentials, signal) {
@@ -686,6 +794,7 @@ export async function createApplication(options = {}) {
                     providerError = undefined;
                     providerInfo = { id, profile, persisted: true, profileName };
                     models.clear();
+                    modelsLoading = undefined;
                     catalogCache = undefined;
                 }
                 catch (error) {

package/dist/config.d.ts

@@ -85,6 +85,7 @@ export declare const configSchema: z.ZodPipe<z.ZodObject<{
             enabled: boolean;
             bearerTokenEnv?: string | undefined;
         }>>]>>>;
+        allow: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
     mcpServers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
         transport: z.ZodLiteral<"stdio">;
@@ -149,6 +150,7 @@ export declare const configSchema: z.ZodPipe<z.ZodObject<{
         auto: z.ZodDefault<z.ZodBoolean>;
         threshold: z.ZodDefault<z.ZodNumber>;
         keepTurns: z.ZodDefault<z.ZodNumber>;
+        maxOutputTokens: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strict>>;
     websearch: z.ZodDefault<z.ZodObject<{
         provider: z.ZodOptional<z.ZodEnum<{
@@ -206,6 +208,7 @@ export declare const configSchema: z.ZodPipe<z.ZodObject<{
         auto: boolean;
         threshold: number;
         keepTurns: number;
+        maxOutputTokens: number;
     };
     websearch: {
         provider?: "brave" | "duckduckgo-instant" | "native" | "searxng" | "serpapi" | "tavily" | undefined;
@@ -221,6 +224,7 @@ export declare const configSchema: z.ZodPipe<z.ZodObject<{
         maxTokens?: number | undefined;
     };
     mcp: {
+        allow?: boolean | undefined;
         servers: {
             [x: string]: {
                 transport: "stdio";
@@ -292,6 +296,7 @@ export declare const configSchema: z.ZodPipe<z.ZodObject<{
             bearerTokenEnv?: string | undefined;
             transport: "http";
         }>;
+        allow?: boolean | undefined;
     };
     mcpServers?: Record<string, {
         transport: "stdio";
@@ -337,6 +342,7 @@ export declare const configSchema: z.ZodPipe<z.ZodObject<{
         auto: boolean;
         threshold: number;
         keepTurns: number;
+        maxOutputTokens: number;
     };
     websearch: {
         provider?: "brave" | "duckduckgo-instant" | "native" | "searxng" | "serpapi" | "tavily" | undefined;
@@ -373,7 +379,11 @@ export interface ConfigLoadResult {
     config: LoadedConfig;
     provenance: ConfigProvenance;
 }
-/** Whether legacy provider selection should take priority over a saved plugin profile for this run. */
+/**
+ * Whether legacy provider selection should take priority over a saved plugin profile for this
+ * run: an explicit endpoint override, or a trusted project/explicit layer whose parsed root
+ * `provider.model` is actually usable (non-empty and not the `alisio setup` placeholder).
+ */
 export declare function overridesSavedProviderProfile(provenance: ConfigProvenance, hasEndpointOverride: boolean): boolean;
 export declare const configHome: () => string;
 export declare const stateHome: () => string;
@@ -402,6 +412,10 @@ export declare function setMcpServerEnabled(input: {
     name: string;
     enabled: boolean;
 }): Promise<string>;
+/** Atomically sets or clears the global `mcp.allow` consent preference in the user config file. */
+export declare function setGlobalMcpAllow(input: {
+    allow: boolean;
+}): Promise<string>;
 /** Atomically updates one project plugin override while preserving every unrelated JSON field. */
 export declare function setProjectPluginEnabled(input: {
     workspace: string;

package/dist/config.js

@@ -84,7 +84,14 @@ const configObjectSchema = z
     /** Project-local enable/disable overrides for effective non-plugin skills. */
     skillOverrides: z.record(z.string(), z.object({ enabled: z.boolean() }).strict()).default({}),
     mcp: z
-        .object({ servers: serversSchema(compatibleServerSchema).default({}) })
+        .object({
+        servers: serversSchema(compatibleServerSchema).default({}),
+        /**
+         * Global-only user preference: grants MCP process/network consent across sessions.
+         * Only the user (global) configuration layer is consulted; a project value is ignored.
+         */
+        allow: z.boolean().optional(),
+    })
         .strict()
         .default({ servers: {} }),
     /** Compatibility with the common MCP client configuration shape. */
@@ -122,9 +129,14 @@ const configObjectSchema = z
         auto: z.boolean().default(true),
         threshold: z.number().min(0.1).max(0.99).default(0.85),
         keepTurns: z.number().int().min(0).max(20).default(2),
+        /**
+         * Output token budget for the summarizer call. Larger than the agent-loop budget on
+         * purpose: a truncated summary is kept as partial, never re-run.
+         */
+        maxOutputTokens: z.number().int().positive().default(16_000),
     })
         .strict()
-        .default(() => ({ auto: true, threshold: 0.85, keepTurns: 2 })),
+        .default(() => ({ auto: true, threshold: 0.85, keepTurns: 2, maxOutputTokens: 16_000 })),
     websearch: z
         .object({
         provider: z
@@ -167,9 +179,24 @@ const configObjectSchema = z
 });
 export const configSchema = configObjectSchema.transform(({ mcpServers, ...config }) => ({
     ...config,
-    mcp: { servers: { ...config.mcp.servers, ...mcpServers } },
+    mcp: { ...config.mcp, servers: { ...config.mcp.servers, ...mcpServers } },
 }));
-/** Whether legacy provider selection should take priority over a saved plugin profile for this run. */
+/** The `alisio setup` scaffold writes this placeholder; a model matching it is not usable. */
+const LEGACY_PROVIDER_MODEL_PLACEHOLDER = "YOUR_MODEL_ID";
+/**
+ * A legacy root `provider` is usable only when its parsed model is non-empty and not the
+ * `alisio setup` placeholder, so a scaffolded or empty project config never defeats a saved
+ * `/connect` profile.
+ */
+function isUsableLegacyModel(model) {
+    const normalized = model.trim();
+    return normalized !== "" && normalized !== LEGACY_PROVIDER_MODEL_PLACEHOLDER;
+}
+/**
+ * Whether legacy provider selection should take priority over a saved plugin profile for this
+ * run: an explicit endpoint override, or a trusted project/explicit layer whose parsed root
+ * `provider.model` is actually usable (non-empty and not the `alisio setup` placeholder).
+ */
 export function overridesSavedProviderProfile(provenance, hasEndpointOverride) {
     return hasEndpointOverride || !!provenance.selectedLayer?.hasLegacyProvider;
 }
@@ -228,10 +255,12 @@ export async function loadConfigWithProvenance(workspace, options = {}) {
     global.config.skillOverrides = {};
     let config = global.config;
     let mcpSources = global.sources;
-    let selectedKeys;
+    // Parsed `provider.model` of the selected layer itself (before env/CLI overrides), used to
+    // decide whether its legacy root `provider` is usable against a saved `/connect` profile.
+    let selectedLegacyModel = "";
     if (selectedFile && selectedFile !== globalFile) {
         const selected = await parseLayer(selectedFile, options.file ? "explicit" : "project");
-        selectedKeys = selected.keys;
+        selectedLegacyModel = selected.config.provider.model;
         const overlaid = { ...config };
         for (const key of selected.keys) {
             if (key === "mcp" || key === "mcpServers")
@@ -240,14 +269,17 @@ export async function loadConfigWithProvenance(workspace, options = {}) {
                 overlaid[key] = selected.config[key];
         }
         if (selected.keys.has("mcp") || selected.keys.has("mcpServers"))
+            // Only servers merge upward; `mcp.allow` is a global/user preference and is deliberately
+            // dropped from the selected layer so a project can never grant itself network consent.
             overlaid.mcp = {
+                ...config.mcp,
                 servers: { ...config.mcp.servers, ...selected.config.mcp.servers },
             };
         mcpSources = { ...mcpSources, ...selected.sources };
         config = overlaid;
     }
     else if (selectedFile) {
-        selectedKeys = global.keys;
+        selectedLegacyModel = global.config.provider.model;
     }
     config.provider = providerSchema.parse({
         ...config.provider,
@@ -268,7 +300,7 @@ export async function loadConfigWithProvenance(workspace, options = {}) {
                 ? {
                     selectedLayer: {
                         kind: options.file ? "explicit" : "project",
-                        hasLegacyProvider: selectedKeys?.has("provider") ?? false,
+                        hasLegacyProvider: isUsableLegacyModel(selectedLegacyModel),
                     },
                 }
                 : {}),
@@ -321,6 +353,51 @@ export async function setMcpServerEnabled(input) {
     }
     return file;
 }
+/** Atomically sets or clears the global `mcp.allow` consent preference in the user config file. */
+export async function setGlobalMcpAllow(input) {
+    const file = join(configHome(), "config.json");
+    let raw = {};
+    if (await exists(file)) {
+        const parsed = JSON.parse(await readFile(file, "utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error("Global Alisio configuration must be a JSON object");
+        raw = parsed;
+    }
+    if (input.allow) {
+        const current = raw.mcp && typeof raw.mcp === "object" && !Array.isArray(raw.mcp)
+            ? raw.mcp
+            : {};
+        raw.mcp = { ...current, allow: true };
+    }
+    else if (raw.mcp && typeof raw.mcp === "object" && !Array.isArray(raw.mcp)) {
+        const mcp = { ...raw.mcp };
+        delete mcp.allow;
+        if (Object.keys(mcp).length)
+            raw.mcp = mcp;
+        else
+            delete raw.mcp;
+    }
+    raw.schemaVersion ??= 1;
+    await mkdir(dirname(file), { recursive: true, mode: 0o700 });
+    const temporary = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    const handle = await open(temporary, "wx", 0o600);
+    try {
+        await handle.writeFile(`${JSON.stringify(raw, null, 2)}\n`, "utf8");
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        await rename(temporary, file);
+        await chmod(file, 0o600);
+    }
+    catch (error) {
+        await unlink(temporary).catch(() => { });
+        throw error;
+    }
+    return file;
+}
 /** Atomically updates one project plugin override while preserving every unrelated JSON field. */
 export async function setProjectPluginEnabled(input) {
     const file = join(input.workspace, ".alisio", "config.json");

package/dist/core/compaction.d.ts

@@ -2,6 +2,36 @@ import type { CompactionCheckpoint, CompletionRequest, Message, ModelProvider }
 /** Rough provider-agnostic estimate: ~4 characters per token. */
 export declare function estimateTokens(value: string | Message[]): number;
 export declare function shouldCompact(used: number, window: number | undefined, threshold: number): boolean;
+/**
+ * Declared context windows above this many tokens are treated as unknown for auto-compaction and
+ * for the context bar: a `window * threshold` trigger would dwarf the char-budget fallback and
+ * hide real pressure (e.g. an 8M-token window with a default 160k-char budget would never even
+ * reach 2% before running out of space). Documented in docs/compaction.md.
+ */
+export declare const MAX_TRUSTED_WINDOW = 2000000;
+export interface ContextBudget {
+    /** Effective total in tokens the context bar and auto-compaction measure against. */
+    total: number;
+    /** What the total is derived from: the model window, or the char-budget fallback. */
+    basis: "window" | "chars";
+}
+/**
+ * The single effective budget shared by the runner's auto-compaction and the TUI context bar.
+ * A known window (>= 1 token and <= MAX_TRUSTED_WINDOW) is used directly; otherwise the char
+ * budget is converted to estimated tokens (about 4 characters per token) so the bar fills where
+ * the char fallback actually compacts instead of showing an almost-empty bar next to an early
+ * compaction (the DeepSeek ~1M-window vs 160k-char budget mismatch).
+ */
+export declare function effectiveContextBudget(window: number | undefined, maxContextChars: number): ContextBudget;
+/**
+ * Whether to auto-compact before the next model call. Uses ONE effective budget: a known window
+ * triggers at `used >= window * threshold`; an unknown or guard-bounded window falls back to the
+ * char budget (`estimatedChars / 4 >= maxContextChars / 4`, keeping the old ~4-characters-per-token
+ * protection). `used` (provider-reported when available) feeds the window branch and the context
+ * bar; `estimatedChars` is the raw character count of the next request and feeds the fallback, so
+ * a provider's token report can never push an unknown-window session into needless compaction.
+ */
+export declare function shouldCompactContext(used: number, estimatedChars: number, window: number | undefined, maxContextChars: number, threshold: number): boolean;
 export interface CompactionOptions {
     /** Recent user turns kept verbatim. */
     keepTurns?: number;
@@ -31,6 +61,11 @@ export interface CheckpointOutput {
     text: string;
 }
 export declare function parseCheckpointOutput(raw: string, fields?: string[]): CheckpointOutput;
+export interface TextCompletion {
+    text: string;
+    /** Provider reported an output-token cut (finish "length"): text may be partial. */
+    truncated: boolean;
+}
 export declare function summarize(provider: ModelProvider, request: {
     instructions: string;
     messages: Message[];
@@ -39,7 +74,7 @@ export declare function summarize(provider: ModelProvider, request: {
     maxOutputTokens: number;
     signal: AbortSignal;
     sessionId?: string;
-}): Promise<string>;
+}): Promise<TextCompletion>;
 /** Narrow provider-agnostic completion used by compaction and the plugin model service. */
 export declare function completeText(provider: ModelProvider, request: CompletionRequest & {
     signal: AbortSignal;

package/dist/core/compaction.js

@@ -7,6 +7,39 @@ export function estimateTokens(value) {
 export function shouldCompact(used, window, threshold) {
     return !!window && window > 0 && used >= window * threshold;
 }
+/**
+ * Declared context windows above this many tokens are treated as unknown for auto-compaction and
+ * for the context bar: a `window * threshold` trigger would dwarf the char-budget fallback and
+ * hide real pressure (e.g. an 8M-token window with a default 160k-char budget would never even
+ * reach 2% before running out of space). Documented in docs/compaction.md.
+ */
+export const MAX_TRUSTED_WINDOW = 2_000_000;
+/**
+ * The single effective budget shared by the runner's auto-compaction and the TUI context bar.
+ * A known window (>= 1 token and <= MAX_TRUSTED_WINDOW) is used directly; otherwise the char
+ * budget is converted to estimated tokens (about 4 characters per token) so the bar fills where
+ * the char fallback actually compacts instead of showing an almost-empty bar next to an early
+ * compaction (the DeepSeek ~1M-window vs 160k-char budget mismatch).
+ */
+export function effectiveContextBudget(window, maxContextChars) {
+    if (window !== undefined && window > 0 && window <= MAX_TRUSTED_WINDOW)
+        return { total: window, basis: "window" };
+    return { total: Math.max(1, Math.round(maxContextChars / 4)), basis: "chars" };
+}
+/**
+ * Whether to auto-compact before the next model call. Uses ONE effective budget: a known window
+ * triggers at `used >= window * threshold`; an unknown or guard-bounded window falls back to the
+ * char budget (`estimatedChars / 4 >= maxContextChars / 4`, keeping the old ~4-characters-per-token
+ * protection). `used` (provider-reported when available) feeds the window branch and the context
+ * bar; `estimatedChars` is the raw character count of the next request and feeds the fallback, so
+ * a provider's token report can never push an unknown-window session into needless compaction.
+ */
+export function shouldCompactContext(used, estimatedChars, window, maxContextChars, threshold) {
+    const budget = effectiveContextBudget(window, maxContextChars);
+    if (budget.basis === "window")
+        return used >= budget.total * threshold;
+    return estimatedChars / 4 >= budget.total;
+}
 /**
  * Indexes where history can be split without separating an assistant tool call from its
  * results: every call before the index is answered before the index, and the kept part
@@ -154,26 +187,41 @@ export async function summarize(provider, request) {
     const focus = request.focus?.trim()
         ? `\n\nAdditional focus requested by the user: ${request.focus.trim()}`
         : "";
-    const text = await completeText(provider, {
-        system: request.instructions,
-        messages: [
-            {
-                role: "user",
-                text: `Checkpoint this session transcript.${focus}\n\n<transcript>\n${serializeForSummary(request.messages)}\n</transcript>`,
-            },
-        ],
-        maxTokens: request.maxOutputTokens,
-        signal: request.signal,
-        ...(request.model ? { model: request.model } : {}),
-        ...(request.sessionId ? { sessionId: request.sessionId } : {}),
-    });
-    if (!text)
+    let completion;
+    try {
+        completion = await completeTextWithMeta(provider, {
+            system: request.instructions,
+            messages: [
+                {
+                    role: "user",
+                    text: `Checkpoint this session transcript.${focus}\n\n<transcript>\n${serializeForSummary(request.messages)}\n</transcript>`,
+                },
+            ],
+            maxTokens: request.maxOutputTokens,
+            signal: request.signal,
+            ...(request.model ? { model: request.model } : {}),
+            ...(request.sessionId ? { sessionId: request.sessionId } : {}),
+        });
+    }
+    catch (error) {
+        // The adapters report an empty "length" cut with a message about max output tokens.
+        if (!request.signal.aborted && String(error).includes("max output tokens"))
+            throw new Error("Compaction summary was cut off before any usable text was produced; raise compaction.maxOutputTokens");
+        throw error;
+    }
+    if (completion.truncated && !completion.text)
+        throw new Error("Compaction summary was cut off before any usable text was produced; raise compaction.maxOutputTokens");
+    if (!completion.text)
         throw new Error("Summarizer returned an empty summary");
-    return text;
+    return completion;
 }
 /** Narrow provider-agnostic completion used by compaction and the plugin model service. */
 export async function completeText(provider, request) {
-    let text = "", completed = false;
+    return (await completeTextWithMeta(provider, request)).text;
+}
+/** Like `completeText`, but also reports whether the provider cut the response by tokens. */
+async function completeTextWithMeta(provider, request) {
+    let text = "", completed = false, truncated = false;
     for await (const event of provider.stream({
         instructions: request.system,
         messages: request.messages.map((m) => m.role === "user"
@@ -188,6 +236,7 @@ export async function completeText(provider, request) {
         request.signal.throwIfAborted();
         if (event.type === "completed") {
             completed = true;
+            truncated = event.message.truncated === true;
             text = event.message.text || text;
         }
         else if (event.type === "text_delta")
@@ -195,7 +244,7 @@ export async function completeText(provider, request) {
     }
     if (!completed)
         throw new Error("Completion ended without a completed response");
-    return text.trim();
+    return { text: text.trim(), truncated };
 }
 export function summaryMessage(body, replaced) {
     return {