@alisio/core 0.1.0-alpha.5 → 0.1.0-alpha.7

package/dist/application.d.ts

@@ -1,4 +1,4 @@
-import type { AvailableProviderModel, ModelInfo, ModelProvider, Plugin, PluginCategory, ResolvedProviderModel, RunEvent } from "@alisio/sdk";
+import type { AvailableProviderModel, ModelInfo, ModelProvider, Plugin, PluginCategory, ProviderConfigurationValue, ResolvedProviderModel, RunEvent } from "@alisio/sdk";
 import type { ApprovalHandler } from "./core/contracts.ts";
 import { ToolRegistry } from "./core/registry.ts";
 import { AgentRunner } from "./core/runner.ts";
@@ -142,11 +142,25 @@ export declare function createApplication(options?: AppOptions): Promise<{
     mcp: McpConnector;
     /** Current-process MCP grant; deliberately independent from persisted server enablement. */
     mcpRuntimePermission(): "granted" | "not-granted" | "read-only";
+    /** Whether global MCP consent (`mcp.allow`) is persisted for this user right now. */
+    mcpAllowPersisted(): boolean;
+    /**
+     * Sanitized per-server failures collected while auto-connecting enabled servers at startup
+     * (only when runtime permission was granted). Never includes credentials or command paths.
+     */
+    mcpStartupFailures(): string[];
     /** Host-owned interactive consent boundary. Headless callers remain blocked unless flagged. */
     grantMcpRuntimePermission(request: {
         source: "interactive-tui";
         confirmed: boolean;
     }): "granted" | "not-granted" | "read-only";
+    /** Persist global consent atomically, then grant runtime permission for this process. */
+    rememberGlobalMcpConsent(): Promise<void>;
+    /**
+     * Clear the persisted global consent atomically and drop the runtime permission (disconnecting
+     * servers as cleanup does). An explicit this-run `--allow-mcp` flag keeps the grant alive.
+     */
+    revokeGlobalMcpConsent(): Promise<void>;
     /** Persist an MCP toggle in its defining layer, then safely update this process. */
     setMcpEnabled(id: string, enabled: boolean, connect?: boolean): Promise<import("./index.ts").McpServerInfo>;
     provider: ActiveProvider;
@@ -155,7 +169,7 @@ export declare function createApplication(options?: AppOptions): Promise<{
     readonly providerError: string | undefined;
     readonly providerInfo: {
         id: string;
-        profile: Record<string, import("@alisio/sdk").ProviderConfigurationValue>;
+        profile: Record<string, ProviderConfigurationValue>;
         persisted: boolean;
         profileName: string;
     } | {
@@ -169,8 +183,8 @@ export declare function createApplication(options?: AppOptions): Promise<{
     contextWindow: (model: string) => number | undefined;
     /** Effective context budget + compaction point shared by the runner and the TUI bar. */
     contextBudget: (model: string) => {
-        total: number;
-        basis: "window" | "chars";
+        total?: number;
+        basis: "window" | "unknown";
         compactionAt: number;
     };
     loadModels: (signal: AbortSignal) => Promise<ModelInfo[]>;

package/dist/application.js

@@ -1,6 +1,6 @@
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { configFile, configHome, loadConfigWithProvenance, overridesSavedProviderProfile, setMcpServerEnabled, setProjectPluginEnabled, setProjectSkillEnabled, stateHome, } from "./config.js";
+import { configFile, configHome, loadConfigWithProvenance, overridesSavedProviderProfile, setGlobalMcpAllow, setMcpServerEnabled, setProjectPluginEnabled, setProjectSkillEnabled, stateHome, } from "./config.js";
 import { completeText } from "./core/compaction.js";
 import { ToolRegistry } from "./core/registry.js";
 import { AgentRunner } from "./core/runner.js";
@@ -28,6 +28,17 @@ const nonBlank = (value) => {
     const normalized = value?.trim();
     return normalized || undefined;
 };
+/**
+ * Per-profile optional context-window override, in tokens (for local OpenAI-compatible servers
+ * like llama.cpp whose `GET /models` omits `context_window`). Numbers are used directly; strings
+ * (for example hand-edited providers.json) are parsed. Absent or unparseable means "no override".
+ */
+const parseProfileContextWindow = (value) => {
+    if (value === undefined)
+        return undefined;
+    const window = typeof value === "number" ? value : Number(String(value).trim());
+    return Number.isFinite(window) && window > 0 ? window : undefined;
+};
 export async function createApplication(options = {}) {
     const cwd = resolve(options.cwd ?? process.cwd()), workspace = await findWorkspace(cwd);
     const { config, provenance: configProvenance } = await loadConfigWithProvenance(workspace, {
@@ -37,16 +48,20 @@ export async function createApplication(options = {}) {
         baseURL: options.baseURL,
         apiMode: options.apiMode,
     });
+    // Global-only consent: `mcp.allow` is read from the user layer; the merged config never carries
+    // a project value (see loadConfigWithProvenance), so a project cannot grant itself MCP consent.
+    const mcpAllow = config.mcp.allow === true;
+    let persistedMcpAllow = mcpAllow;
     const store = new SQLiteStore(options.db ?? join(stateHome(), "sessions.sqlite"));
     const registry = new ToolRegistry(), skills = new Skills({ overrides: config.skillOverrides }), context = new ProjectContext(workspace, {
         globalDir: configHome(),
         cwd,
         claudeMdFallback: config.context.claudeMdFallback,
         maxBytes: config.context.maxBytes,
-    }), providers = new ProviderRegistry(), plugins = new PluginHost(registry, store, config.pluginHooks, providers), mcp = new McpConnector(config.mcp.servers, registry, workspace, options.readOnly ? "read-only" : options.allowMcp ? "allowed" : "disabled", config.mcpSources);
+    }), providers = new ProviderRegistry(), plugins = new PluginHost(registry, store, config.pluginHooks, providers), mcp = new McpConnector(config.mcp.servers, registry, workspace, options.readOnly ? "read-only" : options.allowMcp || mcpAllow ? "allowed" : "disabled", config.mcpSources);
     let mcpRuntimePermission = options.readOnly
         ? "read-only"
-        : options.allowMcp
+        : options.allowMcp || mcpAllow
             ? "granted"
             : "not-granted";
     const herdr = options.noHerdr
@@ -220,7 +235,9 @@ export async function createApplication(options = {}) {
             config: config.websearch,
             resolveExtension: () => plugins.extensions.resolve("websearch"),
         });
-        if (options.allowMcp && !options.readOnly)
+        const { registerPluginInstallTool } = await import("./plugins/install.js");
+        registerPluginInstallTool(registry, { readOnly: !!options.readOnly });
+        if ((options.allowMcp || mcpAllow) && !options.readOnly)
             mcp.register();
         if (options.allowAgents && !options.readOnly)
             herdr.registerTools(registry);
@@ -297,9 +314,39 @@ export async function createApplication(options = {}) {
                 throw new Error('websearch.provider is "native" but the active provider does not support native search');
         }
         const models = new Map();
-        // Priority: explicit configuration for the configured model, then GET /models.
-        const contextWindow = (model) => (model === config.provider.model ? config.provider.contextWindow : undefined) ??
-            models.get(model)?.contextWindow;
+        // Lazily (re)loads the active provider's catalog exactly once, so the ACTIVE model's
+        // contextWindow becomes known for the context bar without waiting for an explicit
+        // /model picker or autocomplete call. Failed or absent discovery stays retryable.
+        let modelsLoading;
+        const ensureModels = () => {
+            if (!provider.listModels || modelsLoading)
+                return modelsLoading;
+            modelsLoading = loadModels(AbortSignal.timeout(10_000));
+            modelsLoading.catch(() => {
+                if (modelsLoading)
+                    modelsLoading = undefined;
+            });
+            return modelsLoading;
+        };
+        // Priority: explicit configuration for the configured model, then the active saved profile's
+        // per-model override (user intent for local servers that omit context_window), then GET /models.
+        const contextWindow = (model) => {
+            const explicit = model === config.provider.model ? config.provider.contextWindow : undefined;
+            if (explicit !== undefined)
+                return explicit;
+            const override = providerInfo?.persisted && model === provider.model
+                ? parseProfileContextWindow(providerInfo.profile.contextWindow)
+                : undefined;
+            if (override !== undefined)
+                return override;
+            const known = models.get(model)?.contextWindow;
+            if (known !== undefined)
+                return known;
+            // Background prime: this call stays synchronous (the runner and the bar are sync), and
+            // once the catalog lands the map is populated for every later lookup.
+            void ensureModels();
+            return undefined;
+        };
         const loadModels = async (signal) => {
             if (!provider.listModels)
                 return [];
@@ -431,6 +478,7 @@ export async function createApplication(options = {}) {
             external: !options.readOnly &&
                 (!!options.allowExternal ||
                     !!options.allowMcp ||
+                    mcpAllow ||
                     !!options.allowAgents ||
                     plugins.externalCount > 0 ||
                     registry.list().some((t) => t.name.startsWith("p_"))),
@@ -508,6 +556,24 @@ export async function createApplication(options = {}) {
             }
             return expanded;
         };
+        // Startup auto-connect: when runtime permission is granted (--allow-mcp or global mcp.allow),
+        // connect every enabled server exactly like pressing Connect for each. Failures are per-server,
+        // sanitized and never fatal to startup.
+        const mcpStartupFailures = [];
+        if (mcpRuntimePermission === "granted") {
+            for (const [name, server] of Object.entries(config.mcp.servers)) {
+                if (!server.enabled)
+                    continue;
+                try {
+                    await mcp.connect(name, AbortSignal.timeout(15_000));
+                }
+                catch {
+                    const diagnostic = mcp.info(name).diagnostic ??
+                        "Connection failed; inspect the server separately for details";
+                    mcpStartupFailures.push(`MCP server "${name}" did not auto-connect: ${diagnostic}`);
+                }
+            }
+        }
         return {
             workspace,
             config,
@@ -595,6 +661,17 @@ export async function createApplication(options = {}) {
             mcpRuntimePermission() {
                 return mcpRuntimePermission;
             },
+            /** Whether global MCP consent (`mcp.allow`) is persisted for this user right now. */
+            mcpAllowPersisted() {
+                return persistedMcpAllow;
+            },
+            /**
+             * Sanitized per-server failures collected while auto-connecting enabled servers at startup
+             * (only when runtime permission was granted). Never includes credentials or command paths.
+             */
+            mcpStartupFailures() {
+                return [...mcpStartupFailures];
+            },
             /** Host-owned interactive consent boundary. Headless callers remain blocked unless flagged. */
             grantMcpRuntimePermission(request) {
                 if (!request.confirmed)
@@ -610,6 +687,35 @@ export async function createApplication(options = {}) {
                 mcpRuntimePermission = "granted";
                 return mcpRuntimePermission;
             },
+            /** Persist global consent atomically, then grant runtime permission for this process. */
+            async rememberGlobalMcpConsent() {
+                if (options.readOnly)
+                    throw new Error("MCP is unavailable under --read-only");
+                await setGlobalMcpAllow({ allow: true });
+                persistedMcpAllow = true;
+                this.grantMcpRuntimePermission({ source: "interactive-tui", confirmed: true });
+            },
+            /**
+             * Clear the persisted global consent atomically and drop the runtime permission (disconnecting
+             * servers as cleanup does). An explicit this-run `--allow-mcp` flag keeps the grant alive.
+             */
+            async revokeGlobalMcpConsent() {
+                if (options.readOnly)
+                    throw new Error("MCP is unavailable under --read-only");
+                await setGlobalMcpAllow({ allow: false });
+                persistedMcpAllow = false;
+                if (options.allowMcp)
+                    return;
+                if (mcpRuntimePermission !== "granted")
+                    return;
+                await mcp.revokeRuntimePermission();
+                mcpRuntimePermission = "not-granted";
+                runtimePolicy.external =
+                    !!options.allowExternal ||
+                        !!options.allowAgents ||
+                        plugins.externalCount > 0 ||
+                        registry.list().some((t) => t.name.startsWith("p_"));
+            },
             /** Persist an MCP toggle in its defining layer, then safely update this process. */
             async setMcpEnabled(id, enabled, connect = false) {
                 if (options.readOnly)
@@ -688,6 +794,7 @@ export async function createApplication(options = {}) {
                     providerError = undefined;
                     providerInfo = { id, profile, persisted: true, profileName };
                     models.clear();
+                    modelsLoading = undefined;
                     catalogCache = undefined;
                 }
                 catch (error) {

package/dist/config.d.ts

@@ -85,6 +85,7 @@ export declare const configSchema: z.ZodPipe<z.ZodObject<{
             enabled: boolean;
             bearerTokenEnv?: string | undefined;
         }>>]>>>;
+        allow: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
     mcpServers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
         transport: z.ZodLiteral<"stdio">;
@@ -223,6 +224,7 @@ export declare const configSchema: z.ZodPipe<z.ZodObject<{
         maxTokens?: number | undefined;
     };
     mcp: {
+        allow?: boolean | undefined;
         servers: {
             [x: string]: {
                 transport: "stdio";
@@ -294,6 +296,7 @@ export declare const configSchema: z.ZodPipe<z.ZodObject<{
             bearerTokenEnv?: string | undefined;
             transport: "http";
         }>;
+        allow?: boolean | undefined;
     };
     mcpServers?: Record<string, {
         transport: "stdio";
@@ -376,7 +379,11 @@ export interface ConfigLoadResult {
     config: LoadedConfig;
     provenance: ConfigProvenance;
 }
-/** Whether legacy provider selection should take priority over a saved plugin profile for this run. */
+/**
+ * Whether legacy provider selection should take priority over a saved plugin profile for this
+ * run: an explicit endpoint override, or a trusted project/explicit layer whose parsed root
+ * `provider.model` is actually usable (non-empty and not the `alisio setup` placeholder).
+ */
 export declare function overridesSavedProviderProfile(provenance: ConfigProvenance, hasEndpointOverride: boolean): boolean;
 export declare const configHome: () => string;
 export declare const stateHome: () => string;
@@ -405,6 +412,10 @@ export declare function setMcpServerEnabled(input: {
     name: string;
     enabled: boolean;
 }): Promise<string>;
+/** Atomically sets or clears the global `mcp.allow` consent preference in the user config file. */
+export declare function setGlobalMcpAllow(input: {
+    allow: boolean;
+}): Promise<string>;
 /** Atomically updates one project plugin override while preserving every unrelated JSON field. */
 export declare function setProjectPluginEnabled(input: {
     workspace: string;

package/dist/config.js

@@ -84,7 +84,14 @@ const configObjectSchema = z
     /** Project-local enable/disable overrides for effective non-plugin skills. */
     skillOverrides: z.record(z.string(), z.object({ enabled: z.boolean() }).strict()).default({}),
     mcp: z
-        .object({ servers: serversSchema(compatibleServerSchema).default({}) })
+        .object({
+        servers: serversSchema(compatibleServerSchema).default({}),
+        /**
+         * Global-only user preference: grants MCP process/network consent across sessions.
+         * Only the user (global) configuration layer is consulted; a project value is ignored.
+         */
+        allow: z.boolean().optional(),
+    })
         .strict()
         .default({ servers: {} }),
     /** Compatibility with the common MCP client configuration shape. */
@@ -172,9 +179,24 @@ const configObjectSchema = z
 });
 export const configSchema = configObjectSchema.transform(({ mcpServers, ...config }) => ({
     ...config,
-    mcp: { servers: { ...config.mcp.servers, ...mcpServers } },
+    mcp: { ...config.mcp, servers: { ...config.mcp.servers, ...mcpServers } },
 }));
-/** Whether legacy provider selection should take priority over a saved plugin profile for this run. */
+/** The `alisio setup` scaffold writes this placeholder; a model matching it is not usable. */
+const LEGACY_PROVIDER_MODEL_PLACEHOLDER = "YOUR_MODEL_ID";
+/**
+ * A legacy root `provider` is usable only when its parsed model is non-empty and not the
+ * `alisio setup` placeholder, so a scaffolded or empty project config never defeats a saved
+ * `/connect` profile.
+ */
+function isUsableLegacyModel(model) {
+    const normalized = model.trim();
+    return normalized !== "" && normalized !== LEGACY_PROVIDER_MODEL_PLACEHOLDER;
+}
+/**
+ * Whether legacy provider selection should take priority over a saved plugin profile for this
+ * run: an explicit endpoint override, or a trusted project/explicit layer whose parsed root
+ * `provider.model` is actually usable (non-empty and not the `alisio setup` placeholder).
+ */
 export function overridesSavedProviderProfile(provenance, hasEndpointOverride) {
     return hasEndpointOverride || !!provenance.selectedLayer?.hasLegacyProvider;
 }
@@ -233,10 +255,12 @@ export async function loadConfigWithProvenance(workspace, options = {}) {
     global.config.skillOverrides = {};
     let config = global.config;
     let mcpSources = global.sources;
-    let selectedKeys;
+    // Parsed `provider.model` of the selected layer itself (before env/CLI overrides), used to
+    // decide whether its legacy root `provider` is usable against a saved `/connect` profile.
+    let selectedLegacyModel = "";
     if (selectedFile && selectedFile !== globalFile) {
         const selected = await parseLayer(selectedFile, options.file ? "explicit" : "project");
-        selectedKeys = selected.keys;
+        selectedLegacyModel = selected.config.provider.model;
         const overlaid = { ...config };
         for (const key of selected.keys) {
             if (key === "mcp" || key === "mcpServers")
@@ -245,14 +269,17 @@ export async function loadConfigWithProvenance(workspace, options = {}) {
                 overlaid[key] = selected.config[key];
         }
         if (selected.keys.has("mcp") || selected.keys.has("mcpServers"))
+            // Only servers merge upward; `mcp.allow` is a global/user preference and is deliberately
+            // dropped from the selected layer so a project can never grant itself network consent.
             overlaid.mcp = {
+                ...config.mcp,
                 servers: { ...config.mcp.servers, ...selected.config.mcp.servers },
             };
         mcpSources = { ...mcpSources, ...selected.sources };
         config = overlaid;
     }
     else if (selectedFile) {
-        selectedKeys = global.keys;
+        selectedLegacyModel = global.config.provider.model;
     }
     config.provider = providerSchema.parse({
         ...config.provider,
@@ -273,7 +300,7 @@ export async function loadConfigWithProvenance(workspace, options = {}) {
                 ? {
                     selectedLayer: {
                         kind: options.file ? "explicit" : "project",
-                        hasLegacyProvider: selectedKeys?.has("provider") ?? false,
+                        hasLegacyProvider: isUsableLegacyModel(selectedLegacyModel),
                     },
                 }
                 : {}),
@@ -326,6 +353,51 @@ export async function setMcpServerEnabled(input) {
     }
     return file;
 }
+/** Atomically sets or clears the global `mcp.allow` consent preference in the user config file. */
+export async function setGlobalMcpAllow(input) {
+    const file = join(configHome(), "config.json");
+    let raw = {};
+    if (await exists(file)) {
+        const parsed = JSON.parse(await readFile(file, "utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error("Global Alisio configuration must be a JSON object");
+        raw = parsed;
+    }
+    if (input.allow) {
+        const current = raw.mcp && typeof raw.mcp === "object" && !Array.isArray(raw.mcp)
+            ? raw.mcp
+            : {};
+        raw.mcp = { ...current, allow: true };
+    }
+    else if (raw.mcp && typeof raw.mcp === "object" && !Array.isArray(raw.mcp)) {
+        const mcp = { ...raw.mcp };
+        delete mcp.allow;
+        if (Object.keys(mcp).length)
+            raw.mcp = mcp;
+        else
+            delete raw.mcp;
+    }
+    raw.schemaVersion ??= 1;
+    await mkdir(dirname(file), { recursive: true, mode: 0o700 });
+    const temporary = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    const handle = await open(temporary, "wx", 0o600);
+    try {
+        await handle.writeFile(`${JSON.stringify(raw, null, 2)}\n`, "utf8");
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        await rename(temporary, file);
+        await chmod(file, 0o600);
+    }
+    catch (error) {
+        await unlink(temporary).catch(() => { });
+        throw error;
+    }
+    return file;
+}
 /** Atomically updates one project plugin override while preserving every unrelated JSON field. */
 export async function setProjectPluginEnabled(input) {
     const file = join(input.workspace, ".alisio", "config.json");

package/dist/core/compaction.d.ts

@@ -44,6 +44,31 @@ export interface CompactionPlan {
     kept: Message[];
 }
 export declare function planCompaction(messages: Message[], options?: CompactionOptions): CompactionPlan | undefined;
+/** Marker appended to message content cut by the context-budget reduction. */
+export declare const TRUNCATION_MARKER = "\u2026 [truncated by context budget]";
+/** Default per-message cap for kept tool result text after a failed compaction. */
+export declare const MAX_TOOL_RESULT_CHARS = 8000;
+/** Default per-message cap for kept user/assistant text after a failed compaction. */
+export declare const MAX_TEXT_CHARS = 16000;
+export interface MessageReductionOptions {
+    /** Keep at most this many characters of text per tool result (default 8_000). */
+    maxToolResultChars?: number;
+    /** Keep at most this many characters per user/assistant text (default 16_000). */
+    maxTextChars?: number;
+}
+export interface MessageReduction {
+    messages: Message[];
+    /** Number of messages whose content was truncated. */
+    truncated: number;
+}
+/**
+ * Cuts oversized retained content so the session fits the context-budget hard limit after a
+ * compaction could not. Only message CONTENT changes (user/assistant `text` and the text parts
+ * of tool results); roles, call IDs, order and message boundaries stay identical, so the
+ * transcript remains valid and replayable and a tool call is never separated from its results.
+ * Checkpoint summaries (`summary: true`) are bounded by design and never truncated.
+ */
+export declare function reduceMessageSizes(messages: Message[], options?: MessageReductionOptions): MessageReduction;
 /**
  * Plain-text transcript used as summarizer input. Provider continuation data (for example
  * encrypted reasoning) is opaque and is intentionally not included.

package/dist/core/compaction.js

@@ -91,6 +91,60 @@ export function planCompaction(messages, options = {}) {
     return { cut, summarized: messages.slice(0, cut), kept: messages.slice(cut) };
 }
 const clip = (text, max) => text.length > max ? `${text.slice(0, max)}… [truncated]` : text;
+/** Marker appended to message content cut by the context-budget reduction. */
+export const TRUNCATION_MARKER = "… [truncated by context budget]";
+/** Default per-message cap for kept tool result text after a failed compaction. */
+export const MAX_TOOL_RESULT_CHARS = 8_000;
+/** Default per-message cap for kept user/assistant text after a failed compaction. */
+export const MAX_TEXT_CHARS = 16_000;
+/**
+ * Cuts oversized retained content so the session fits the context-budget hard limit after a
+ * compaction could not. Only message CONTENT changes (user/assistant `text` and the text parts
+ * of tool results); roles, call IDs, order and message boundaries stay identical, so the
+ * transcript remains valid and replayable and a tool call is never separated from its results.
+ * Checkpoint summaries (`summary: true`) are bounded by design and never truncated.
+ */
+export function reduceMessageSizes(messages, options = {}) {
+    const maxToolResultChars = options.maxToolResultChars ?? MAX_TOOL_RESULT_CHARS;
+    const maxTextChars = options.maxTextChars ?? MAX_TEXT_CHARS;
+    let truncated = 0;
+    const reduced = messages.map((m) => {
+        if (m.role === "user") {
+            if (m.summary || m.text.length <= maxTextChars)
+                return m;
+            truncated++;
+            return { ...m, text: `${m.text.slice(0, maxTextChars)}\n${TRUNCATION_MARKER}` };
+        }
+        if (m.role === "assistant") {
+            if (m.text.length <= maxTextChars)
+                return m;
+            truncated++;
+            return { ...m, text: `${m.text.slice(0, maxTextChars)}\n${TRUNCATION_MARKER}` };
+        }
+        let used = 0;
+        let changed = false;
+        const content = m.result.content.map((part) => {
+            const room = maxToolResultChars - used;
+            const text = room <= 0
+                ? TRUNCATION_MARKER
+                : part.text.length > room
+                    ? `${part.text.slice(0, room)}\n${TRUNCATION_MARKER}`
+                    : part.text;
+            if (text !== part.text) {
+                changed = true;
+                used = maxToolResultChars;
+            }
+            else
+                used += part.text.length;
+            return { type: "text", text };
+        });
+        if (!changed)
+            return m;
+        truncated++;
+        return { ...m, result: { ...m.result, content } };
+    });
+    return truncated ? { messages: reduced, truncated } : { messages, truncated: 0 };
+}
 /**
  * Plain-text transcript used as summarizer input. Provider continuation data (for example
  * encrypted reasoning) is opaque and is intentionally not included.

package/dist/core/contracts.d.ts

@@ -56,6 +56,12 @@ export interface SessionStore {
      * rest verbatim and in order. Callers must never split a tool call from its results.
      */
     compact(id: string, replaced: number, summary: Message): void;
+    /**
+     * Atomically replace the whole active history with `messages` (like `compact` without a
+     * summary): used after a context-budget reduction so the persisted transcript matches what
+     * was actually sent. Callers must never split a tool call from its results.
+     */
+    overwrite(id: string, messages: Message[]): void;
     acquire(id: string): void;
     release(id: string): void;
     beginCall(session: string, call: ToolCall): void;

package/dist/core/runner.d.ts

@@ -108,14 +108,16 @@ export declare class AgentRunner {
     /** Estimated tokens the next request of a session would send. */
     estimateContext(sessionId: string): Promise<number>;
     /**
-     * The effective context budget a session's auto-compaction and the TUI context bar both use:
-     * the model window when known (and not beyond `MAX_TRUSTED_WINDOW`), otherwise the char budget
-     * converted to estimated tokens. `compactionAt` is the percentage of `total` where auto
-     * compaction triggers, so the bar turns red exactly where the engine compacts.
+     * The effective context budget the TUI context bar displays. The model window is the total
+     * when known (and not beyond `MAX_TRUSTED_WINDOW`); otherwise the bar reports an honest
+     * unknown (`basis: "unknown"`, no fabricated total). `compactionAt` is the percentage of
+     * `total` where auto-compaction triggers, so the bar turns red exactly where the engine
+     * compacts. The engine's own auto-compaction guardrail still falls back to the char budget
+     * internally (see `shouldCompactContext`) — that fallback is never shown as a fake total.
      */
     contextBudget(model: string): {
-        total: number;
-        basis: "window" | "chars";
+        total?: number;
+        basis: "window" | "unknown";
         compactionAt: number;
     };
     /** Change the model used by subsequent turns of a session; recorded in the store. */

package/dist/core/runner.js

@@ -1,5 +1,5 @@
 import { textResult, } from "@alisio/sdk";
-import { checkpointInstructions, effectiveContextBudget, estimateTokens, parseCheckpointOutput, planCompaction, shouldCompactContext, summarize, summaryMessage, } from "./compaction.js";
+import { checkpointInstructions, estimateTokens, MAX_TRUSTED_WINDOW, parseCheckpointOutput, planCompaction, reduceMessageSizes, shouldCompactContext, summarize, summaryMessage, } from "./compaction.js";
 /**
  * Default cumulative token budget for one run: several context windows (each turn re-sends the
  * context), clamped; 1M tokens when the window is unknown.
@@ -112,19 +112,22 @@ export class AgentRunner {
             estimateTokens(this.toolsText(this.availableTools())));
     }
     /**
-     * The effective context budget a session's auto-compaction and the TUI context bar both use:
-     * the model window when known (and not beyond `MAX_TRUSTED_WINDOW`), otherwise the char budget
-     * converted to estimated tokens. `compactionAt` is the percentage of `total` where auto
-     * compaction triggers, so the bar turns red exactly where the engine compacts.
+     * The effective context budget the TUI context bar displays. The model window is the total
+     * when known (and not beyond `MAX_TRUSTED_WINDOW`); otherwise the bar reports an honest
+     * unknown (`basis: "unknown"`, no fabricated total). `compactionAt` is the percentage of
+     * `total` where auto-compaction triggers, so the bar turns red exactly where the engine
+     * compacts. The engine's own auto-compaction guardrail still falls back to the char budget
+     * internally (see `shouldCompactContext`) — that fallback is never shown as a fake total.
      */
     contextBudget(model) {
-        const budget = effectiveContextBudget(this.options.contextWindow?.(model), this.options.maxContextChars ?? 160_000);
-        return {
-            ...budget,
-            compactionAt: budget.basis === "window"
-                ? Math.round((this.options.compaction?.threshold ?? 0.85) * 100)
-                : 100,
-        };
+        const window = this.options.contextWindow?.(model);
+        if (window !== undefined && window > 0 && window <= MAX_TRUSTED_WINDOW)
+            return {
+                total: window,
+                basis: "window",
+                compactionAt: Math.round((this.options.compaction?.threshold ?? 0.85) * 100),
+            };
+        return { total: undefined, basis: "unknown", compactionAt: 100 };
     }
     /** Change the model used by subsequent turns of a session; recorded in the store. */
     setModel(sessionId, model) {
@@ -260,6 +263,7 @@ export class AgentRunner {
     async run(sessionId, prompt, signal, options = {}) {
         const controller = this.claim(sessionId);
         const o = this.options, emit = this.emitter(sessionId);
+        const limit = o.maxContextChars ?? 160_000;
         let tokens = 0, lastText = "", acquired = false;
         const usageTotal = { input: 0, output: 0 };
         const timeout = AbortSignal.timeout(options.timeoutMs ?? o.timeoutMs ?? 300_000);
@@ -348,13 +352,27 @@ export class AgentRunner {
                 // estimate (`chars / 4 >= maxContextChars / 4`). `maxContextChars` below stays as the
                 // post-compaction hard limit.
                 if (compaction.auto !== false &&
-                    shouldCompactContext(used(), chars(), o.contextWindow?.(model), o.maxContextChars ?? 160_000, compaction.threshold ?? 0.85)) {
+                    shouldCompactContext(used(), chars(), o.contextWindow?.(model), limit, compaction.threshold ?? 0.85)) {
                     await this.compactLocked(sessionId, emit, model, combined, "auto");
                     instructions = await withPersona();
                     messages = o.store.messages(sessionId);
                 }
-                if (chars() > (o.maxContextChars ?? 160_000))
-                    throw new Error("Context budget exceeded and compaction could not reduce it; start a new session.");
+                // A compaction that still leaves the session over the hard limit (typically a kept tail
+                // holding huge tool outputs) is reduced in place instead of failing outright: oversized
+                // kept content is cut per message (roles/callIds/boundaries untouched, so the transcript
+                // stays valid and replayable). Only if even the reduced tail exceeds the limit the run
+                // fails with an actionable error; the reduction is persisted either way, so the session
+                // stays usable for later prompts.
+                if (chars() > limit) {
+                    const reduction = reduceMessageSizes(messages);
+                    if (reduction.truncated > 0) {
+                        o.store.overwrite(sessionId, reduction.messages);
+                        messages = reduction.messages;
+                        emit("context_reduced", { messages: reduction.truncated });
+                    }
+                    if (chars() > limit)
+                        throw new Error(`Context budget exceeded and compaction could not reduce it (approximately ${chars()} characters; limit ${limit}). Run /compact, trim large tool outputs, or start a new session.`);
+                }
                 let completion;
                 let truncated = false;
                 let usage;