@buoy-gg/agent-core 7.0.35 → 7.0.38

package/lib/commonjs/providers/xhrStream.js

@@ -0,0 +1,212 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.xhrAvailable = xhrAvailable;
+exports.xhrStream = xhrStream;
+var _sse = require("./sse");
+/**
+ * Streaming over `XMLHttpRequest`, for the runtimes where `fetch` cannot.
+ *
+ * React Native core still has no `response.body`: its `fetch` is the whatwg
+ * polyfill over XHR and resolves inside `xhr.onload`, i.e. after the ENTIRE
+ * body. Under Expo the global is `expo/fetch`, which does stream — but
+ * `EXPO_PUBLIC_USE_RN_FETCH=1` reverts that, and the bare-RN CLI, TV CLI and
+ * NativeScript lanes never had it at all. On those, every Ask Buoy answer
+ * appeared in one lump, however long the model took.
+ *
+ * XHR itself has streamed the whole time. `responseText` grows as bytes arrive
+ * and `onprogress` fires as it does, so slicing from the last offset gives the
+ * same incremental text a reader would. Two conditions, both easy to miss:
+ * the progress handler must be installed BEFORE `send()`, and `responseType`
+ * must stay text — anything else stops RN emitting progress at all.
+ *
+ * WHAT THIS IS NOT. It is not a second SSE parser: framing, the truncation
+ * rule and the terminal-marker contract all live in `sse.ts` and are shared
+ * verbatim. This file only produces text chunks.
+ */
+
+/** Beyond this the answer is not an answer any more; stop reading. */
+const MAX_RESPONSE_CHARS = 8_000_000;
+function xhrAvailable() {
+  return typeof XMLHttpRequest === "function";
+}
+
+/**
+ * Send the request and resolve once the HEADERS are in, so the caller can
+ * check the status and content type before deciding to read a stream — the
+ * same shape `fetch` offers, and the reason this can slot in beside it.
+ */
+function xhrStream(req) {
+  return new Promise((resolveHeaders, rejectHeaders) => {
+    const xhr = new XMLHttpRequest();
+
+    /** Text seen but not yet handed to a consumer. */
+    const queue = [];
+    /** Resolvers for a consumer parked on an empty queue. */
+    const waiters = [];
+    let offset = 0;
+    let done = false;
+    let failure;
+    let headersSeen = false;
+    let capped = false;
+    const wake = () => {
+      while (waiters.length) waiters.shift()();
+    };
+    const pull = () => {
+      // `responseText` is the WHOLE body so far, so the delta is everything
+      // past what was already taken. RN keeps the full string either way;
+      // the offset bounds the work, not the memory.
+      let text;
+      try {
+        text = xhr.responseText ?? "";
+      } catch {
+        return; // Not readable yet on some runtimes; the next event will do.
+      }
+      if (text.length <= offset) return;
+      if (text.length > MAX_RESPONSE_CHARS) {
+        capped = true;
+        failure = new Error("The endpoint sent more than this tool will read.");
+        done = true;
+        try {
+          xhr.abort();
+        } catch {
+          /* already gone */
+        }
+        wake();
+        return;
+      }
+      queue.push(text.slice(offset));
+      offset = text.length;
+      wake();
+    };
+    const settleHeaders = () => {
+      if (headersSeen) return;
+      headersSeen = true;
+      let contentType = "";
+      let retryAfter = null;
+      try {
+        contentType = xhr.getResponseHeader("content-type") ?? "";
+        retryAfter = xhr.getResponseHeader("retry-after");
+      } catch {
+        contentType = "";
+      }
+      resolveHeaders({
+        status: xhr.status,
+        ok: xhr.status >= 200 && xhr.status < 300,
+        contentType,
+        retryAfter,
+        async text() {
+          // Whatever has arrived. For a non-2xx that is the error body; the
+          // request is over by the time anyone asks.
+          await new Promise(r => {
+            if (done) return r();
+            waiters.push(() => r());
+          });
+          try {
+            return xhr.responseText ?? "";
+          } catch {
+            return "";
+          }
+        },
+        frames(options) {
+          return (0, _sse.framesFrom)(chunks(), options);
+        }
+      });
+    };
+    async function* chunks() {
+      try {
+        for (;;) {
+          while (queue.length) yield queue.shift();
+          if (done) break;
+          await new Promise(r => waiters.push(r));
+        }
+        while (queue.length) yield queue.shift();
+        if (failure) throw failure;
+      } finally {
+        if (!done) {
+          // The consumer left early — a completed turn, a Stop, a timeout.
+          // Nothing else will read this socket.
+          try {
+            xhr.abort();
+          } catch {
+            /* already gone */
+          }
+        }
+      }
+    }
+    const onAbort = () => {
+      try {
+        xhr.abort();
+      } catch {
+        /* already gone */
+      }
+    };
+    xhr.onreadystatechange = () => {
+      // HEADERS_RECEIVED. Status and content type are known here, long before
+      // the body finishes — which is the whole point of using XHR directly.
+      if (xhr.readyState === 2) settleHeaders();
+    };
+    xhr.onprogress = () => {
+      settleHeaders();
+      pull();
+    };
+    xhr.onload = () => {
+      settleHeaders();
+      if (!capped) pull();
+      done = true;
+      wake();
+    };
+    xhr.onerror = () => {
+      failure = new Error("The request failed before it finished.");
+      done = true;
+      if (!headersSeen) {
+        headersSeen = true;
+        rejectHeaders(failure);
+      }
+      wake();
+    };
+    xhr.onabort = () => {
+      const err = new Error("Aborted");
+      err.name = "AbortError";
+      failure = err;
+      done = true;
+      if (!headersSeen) {
+        headersSeen = true;
+        rejectHeaders(err);
+      }
+      wake();
+    };
+    xhr.ontimeout = () => {
+      failure = new Error("The request timed out.");
+      done = true;
+      if (!headersSeen) {
+        headersSeen = true;
+        rejectHeaders(failure);
+      }
+      wake();
+    };
+    try {
+      xhr.open("POST", req.url, true);
+      // Text, and nothing else: RN emits no progress events for any other
+      // response type, which turns this back into a buffered read in silence.
+      xhr.responseType = "text";
+      for (const [k, v] of Object.entries(req.headers)) {
+        try {
+          xhr.setRequestHeader(k, v);
+        } catch {
+          /* a header the runtime forbids is not worth failing the turn over */
+        }
+      }
+      if (req.signal) {
+        if (req.signal.aborted) onAbort();else req.signal.addEventListener?.("abort", onAbort);
+      }
+      xhr.send(req.body);
+    } catch (err) {
+      headersSeen = true;
+      rejectHeaders(err instanceof Error ? err : new Error(String(err)));
+    }
+  });
+}
+//# sourceMappingURL=xhrStream.js.map

package/lib/commonjs/providers/xhrStream.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_sse","require","MAX_RESPONSE_CHARS","xhrAvailable","XMLHttpRequest","xhrStream","req","Promise","resolveHeaders","rejectHeaders","xhr","queue","waiters","offset","done","failure","headersSeen","capped","wake","length","shift","pull","text","responseText","Error","abort","push","slice","settleHeaders","contentType","retryAfter","getResponseHeader","status","ok","r","frames","options","framesFrom","chunks","onAbort","onreadystatechange","readyState","onprogress","onload","onerror","onabort","err","name","ontimeout","open","url","responseType","k","v","Object","entries","headers","setRequestHeader","signal","aborted","addEventListener","send","body","String"],"sourceRoot":"../../../src","sources":["providers/xhrStream.ts"],"mappings":";;;;;;;AAoBA,IAAAA,IAAA,GAAAC,OAAA;AApBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA;AACA,MAAMC,kBAAkB,GAAG,SAAS;AAoB7B,SAASC,YAAYA,CAAA,EAAY;EACtC,OAAO,OAAOC,cAAc,KAAK,UAAU;AAC7C;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASC,SAASA,CAACC,GAAqB,EAA8B;EAC3E,OAAO,IAAIC,OAAO,CAAoB,CAACC,cAAc,EAAEC,aAAa,KAAK;IACvE,MAAMC,GAAG,GAAG,IAAIN,cAAc,CAAC,CAAC;;IAEhC;IACA,MAAMO,KAAe,GAAG,EAAE;IAC1B;IACA,MAAMC,OAA0B,GAAG,EAAE;IACrC,IAAIC,MAAM,GAAG,CAAC;IACd,IAAIC,IAAI,GAAG,KAAK;IAChB,IAAIC,OAA0B;IAC9B,IAAIC,WAAW,GAAG,KAAK;IACvB,IAAIC,MAAM,GAAG,KAAK;IAElB,MAAMC,IAAI,GAAGA,CAAA,KAAM;MACjB,OAAON,OAAO,CAACO,MAAM,EAAEP,OAAO,CAACQ,KAAK,CAAC,CAAC,CAAE,CAAC;IAC3C,CAAC;IAED,MAAMC,IAAI,GAAGA,CAAA,KAAM;MACjB;MACA;MACA;MACA,IAAIC,IAAY;MAChB,IAAI;QACFA,IAAI,GAAGZ,GAAG,CAACa,YAAY,IAAI,EAAE;MAC/B,CAAC,CAAC,MAAM;QACN,OAAO,CAAC;MACV;MACA,IAAID,IAAI,CAACH,MAAM,IAAIN,MAAM,EAAE;MAC3B,IAAIS,IAAI,CAACH,MAAM,GAAGjB,kBAAkB,EAAE;QACpCe,MAAM,GAAG,IAAI;QACbF,OAAO,GAAG,IAAIS,KAAK,CAAC,kDAAkD,CAAC;QACvEV,IAAI,GAAG,IAAI;QACX,IAAI;UACFJ,GAAG,CAACe,KAAK,CAAC,CAAC;QACb,CAAC,CAAC,MAAM;UACN;QAAA;QAEFP,IAAI,CAAC,CAAC;QACN;MACF;MACAP,KAAK,CAACe,IAAI,CAACJ,IAAI,CAACK,KAAK,CAACd,MAAM,CAAC,CAAC;MAC9BA,MAAM,GAAGS,IAAI,CAACH,MAAM;MACpBD,IAAI,CAAC,CAAC;IACR,CAAC;IAED,MAAMU,aAAa,GAAGA,CAAA,KAAM;MAC1B,IAAIZ,WAAW,EAAE;MACjBA,WAAW,GAAG,IAAI;MAClB,IAAIa,WAAW,GAAG,EAAE;MACpB,IAAIC,UAAyB,GAAG,IAAI;MACpC,IAAI;QACFD,WAAW,GAAGnB,GAAG,CAACqB,iBAAiB,CAAC,cAAc,CAAC,IAAI,EAAE;QACzDD,UAAU,GAAGpB,GAAG,CAACqB,iBAAiB,CAAC,aAAa,CAAC;MACnD,CAAC,CAAC,MAAM;QACNF,WAAW,GAAG,EAAE;MAClB;MACArB,cAAc,CAAC;QACbwB,MAAM,EAAEtB,GAAG,CAACsB,MAAM;QAClBC,EAAE,EAAEvB,GAAG,CAACsB,MAAM,IAAI,GAAG,IAAItB,GAAG,CAACsB,MAAM,GAAG,GAAG;QACzCH,WAAW;QACXC,UAAU;QACV,MAAMR,IAAIA,CAAA,EAAG;UACX;UACA;UACA,MAAM,IAAIf,OAAO,CAAQ2B,CAAC,IAAK;YAC7B,IAAIpB,IAAI,EAAE,OAAOoB,CAAC,CAAC,CAAC;YACpBtB,OAAO,CAACc,IAAI,CAAC,MAAMQ,CAAC,CAAC,CAAC,CAAC;UACzB,CAAC,CAAC;UACF,IAAI;YACF,OAAOxB,GAAG,CAACa,YAAY,IAAI,EAAE;UAC/B,CAAC,CAAC,MAAM;YACN,OAAO,EAAE;UACX;QACF,CAAC;QACDY,MAAMA,CAACC,OAAwB,EAAE;UAC/B,OAAO,IAAAC,eAAU,EAACC,MAAM,CAAC,CAAC,EAAEF,OAAO,CAAC;QACtC;MACF,CAAC,CAAC;IACJ,CAAC;IAED,gBAAgBE,MAAMA,CAAA,EAAuC;MAC3D,IAAI;QACF,SAAS;UACP,OAAO3B,KAAK,CAACQ,MAAM,EAAE,MAAMR,KAAK,CAACS,KAAK,CAAC,CAAE;UACzC,IAAIN,IAAI,EAAE;UACV,MAAM,IAAIP,OAAO,CAAQ2B,CAAC,IAAKtB,OAAO,CAACc,IAAI,CAACQ,CAAC,CAAC,CAAC;QACjD;QACA,OAAOvB,KAAK,CAACQ,MAAM,EAAE,MAAMR,KAAK,CAACS,KAAK,CAAC,CAAE;QACzC,IAAIL,OAAO,EAAE,MAAMA,OAAO;MAC5B,CAAC,SAAS;QACR,IAAI,CAACD,IAAI,EAAE;UACT;UACA;UACA,IAAI;YACFJ,GAAG,CAACe,KAAK,CAAC,CAAC;UACb,CAAC,CAAC,MAAM;YACN;UAAA;QAEJ;MACF;IACF;IAEA,MAAMc,OAAO,GAAGA,CAAA,KAAM;MACpB,IAAI;QACF7B,GAAG,CAACe,KAAK,CAAC,CAAC;MACb,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ,CAAC;IAEDf,GAAG,CAAC8B,kBAAkB,GAAG,MAAM;MAC7B;MACA;MACA,IAAI9B,GAAG,CAAC+B,UAAU,KAAK,CAAC,EAAEb,aAAa,CAAC,CAAC;IAC3C,CAAC;IACDlB,GAAG,CAACgC,UAAU,GAAG,MAAM;MACrBd,aAAa,CAAC,CAAC;MACfP,IAAI,CAAC,CAAC;IACR,CAAC;IACDX,GAAG,CAACiC,MAAM,GAAG,MAAM;MACjBf,aAAa,CAAC,CAAC;MACf,IAAI,CAACX,MAAM,EAAEI,IAAI,CAAC,CAAC;MACnBP,IAAI,GAAG,IAAI;MACXI,IAAI,CAAC,CAAC;IACR,CAAC;IACDR,GAAG,CAACkC,OAAO,GAAG,MAAM;MAClB7B,OAAO,GAAG,IAAIS,KAAK,CAAC,wCAAwC,CAAC;MAC7DV,IAAI,GAAG,IAAI;MACX,IAAI,CAACE,WAAW,EAAE;QAChBA,WAAW,GAAG,IAAI;QAClBP,aAAa,CAACM,OAAO,CAAC;MACxB;MACAG,IAAI,CAAC,CAAC;IACR,CAAC;IACDR,GAAG,CAACmC,OAAO,GAAG,MAAM;MAClB,MAAMC,GAAG,GAAG,IAAItB,KAAK,CAAC,SAAS,CAAC;MAChCsB,GAAG,CAACC,IAAI,GAAG,YAAY;MACvBhC,OAAO,GAAG+B,GAAG;MACbhC,IAAI,GAAG,IAAI;MACX,IAAI,CAACE,WAAW,EAAE;QAChBA,WAAW,GAAG,IAAI;QAClBP,aAAa,CAACqC,GAAG,CAAC;MACpB;MACA5B,IAAI,CAAC,CAAC;IACR,CAAC;IACDR,GAAG,CAACsC,SAAS,GAAG,MAAM;MACpBjC,OAAO,GAAG,IAAIS,KAAK,CAAC,wBAAwB,CAAC;MAC7CV,IAAI,GAAG,IAAI;MACX,IAAI,CAACE,WAAW,EAAE;QAChBA,WAAW,GAAG,IAAI;QAClBP,aAAa,CAACM,OAAO,CAAC;MACxB;MACAG,IAAI,CAAC,CAAC;IACR,CAAC;IAED,IAAI;MACFR,GAAG,CAACuC,IAAI,CAAC,MAAM,EAAE3C,GAAG,CAAC4C,GAAG,EAAE,IAAI,CAAC;MAC/B;MACA;MACAxC,GAAG,CAACyC,YAAY,GAAG,MAAM;MACzB,KAAK,MAAM,CAACC,CAAC,EAAEC,CAAC,CAAC,IAAIC,MAAM,CAACC,OAAO,CAACjD,GAAG,CAACkD,OAAO,CAAC,EAAE;QAChD,IAAI;UACF9C,GAAG,CAAC+C,gBAAgB,CAACL,CAAC,EAAEC,CAAC,CAAC;QAC5B,CAAC,CAAC,MAAM;UACN;QAAA;MAEJ;MACA,IAAI/C,GAAG,CAACoD,MAAM,EAAE;QACd,IAAIpD,GAAG,CAACoD,MAAM,CAACC,OAAO,EAAEpB,OAAO,CAAC,CAAC,CAAC,KAC7BjC,GAAG,CAACoD,MAAM,CAACE,gBAAgB,GAAG,OAAO,EAAErB,OAAO,CAAC;MACtD;MACA7B,GAAG,CAACmD,IAAI,CAACvD,GAAG,CAACwD,IAAI,CAAC;IACpB,CAAC,CAAC,OAAOhB,GAAG,EAAE;MACZ9B,WAAW,GAAG,IAAI;MAClBP,aAAa,CAACqC,GAAG,YAAYtB,KAAK,GAAGsB,GAAG,GAAG,IAAItB,KAAK,CAACuC,MAAM,CAACjB,GAAG,CAAC,CAAC,CAAC;IACpE;EACF,CAAC,CAAC;AACJ","ignoreList":[]}

package/lib/commonjs/session.js

@@ -3,13 +3,34 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+Object.defineProperty(exports, "compressConsumed", {
+  enumerable: true,
+  get: function () {
+    return _historyBudget.compressConsumed;
+  }
+});
 exports.createAskBuoySession = createAskBuoySession;
 exports.resumableHistory = resumableHistory;
+Object.defineProperty(exports, "trimHistory", {
+  enumerable: true,
+  get: function () {
+    return _historyBudget.trimHistory;
+  }
+});
+Object.defineProperty(exports, "trimHistoryReport", {
+  enumerable: true,
+  get: function () {
+    return _historyBudget.trimHistoryReport;
+  }
+});
 var _catalog = require("./catalog/catalog.g");
 var _buildContextPack = require("./context/buildContextPack");
 var _runAgentTurn = require("./engine/runAgentTurn");
 var _systemPrompt = require("./engine/systemPrompt");
 var _ledger = require("./effects/ledger");
+var _evidence = require("./engine/evidence");
+var _tokenCalibration = require("./engine/tokenCalibration");
+var _historyBudget = require("./engine/historyBudget");
 var _anthropic = require("./providers/anthropic");
 var _openai = require("./providers/openai");
 var _policy = require("./policy/policy");
@@ -20,43 +41,11 @@ var _redact = require("./policy/redact");
  * This is the one-call surface the UI packages use. It owns the pieces that
  * have to agree with each other across a whole session — the provider, the
  * catalog filtered to what this device can actually do, the system prompt
- * (built once, after grounding), the effect ledger, and the message history —
+ * (the stable part built once after grounding, the RIGHT NOW part re-read every
+ * turn), the effect ledger, and the message history —
  * so a chat UI is a message list plus a text box rather than an orchestrator.
  */
 
-/**
- * A long QA session must not die on the provider's context limit with an
- * opaque error — the transcript grows without bound (tool results are the
- * heavy part), so the OLDEST rounds are dropped once the history passes a
- * budget. Rounds are dropped whole — a round starts at a user message — so
- * the assistant/tool-result pairing every provider requires stays intact and
- * the history still begins with a user message.
- */
-const MAX_HISTORY_CHARS = 150_000;
-const MIN_KEEP_MESSAGES = 4;
-function messageSize(m) {
-  try {
-    return JSON.stringify(m).length;
-  } catch {
-    return 0;
-  }
-}
-function trimHistory(messages) {
-  let total = 0;
-  for (const m of messages) total += messageSize(m);
-  if (total <= MAX_HISTORY_CHARS) return messages;
-  const out = [...messages];
-  while (out.length > MIN_KEEP_MESSAGES && total > MAX_HISTORY_CHARS) {
-    total -= messageSize(out[0]);
-    out.shift();
-    while (out.length > MIN_KEEP_MESSAGES && out[0].role !== "user") {
-      total -= messageSize(out[0]);
-      out.shift();
-    }
-  }
-  return out;
-}
-
 /**
  * A stored history, made safe to send as the start of a new request.
  *
@@ -73,6 +62,9 @@ function trimHistory(messages) {
  * always resumes with a fresh user message instead, so their signatures are
  * dead weight at best and a stale-signature 400 at worst.
  */
+// Re-exported: these were defined here before the engine needed them too, and
+// the tests and the package surface still reach them through this module.
+
 function resumableHistory(history) {
   let end = history.length;
   while (end > 0) {
@@ -90,8 +82,60 @@ function createAskBuoySession(config) {
   const ledger = new _ledger.EffectLedger();
   const policy = config.policy ?? {};
   let messages = [];
+  /**
+   * Image-URL provenance for the whole conversation, not one turn of it.
+   *
+   * "Show me the shop as pictures" and "no, actually render them" are two
+   * turns; the second has no tool calls of its own, so a per-turn set held
+   * nothing and every image was stripped out from under the model. It kept
+   * describing artwork that was not on screen. The rule is unchanged — a URL
+   * still has to have been READ — the window is just the conversation. Reset
+   * with the conversation.
+   */
+  const seenUrls = new Set();
+  /**
+   * Every result's full text, for `ask-buoy.retrieve` — see engine/evidence.ts.
+   * Conversation-scoped like `seenUrls`: "what were the stats in that response"
+   * is a normal second message. Cleared with the conversation; never persisted.
+   */
+  const evidence = new _evidence.EvidenceStore();
+  /** Chars-per-token as measured on THIS session's provider — see engine/tokenCalibration.ts. */
+  const calibration = new _tokenCalibration.TokenCalibration();
   let system;
   let primed = false;
+  /** See `setApprovalBypass`. Consulted per turn, never captured. */
+  let bypassApproval = false;
+  /** Actions the user waived the card for in this conversation — see RunTurnInput.trusted. */
+  const trusted = new Set();
+  /** See `setReadOnly`. */
+  let deviceReadOnly = false;
+  /**
+   * Rounds dropped by `restore` — reported on the first send, because there is
+   * no open turn to carry the event when the restore happens.
+   */
+  let trimmedOnRestore = 0;
+  /**
+   * Which conversation is live. Bumped by `reset`.
+   *
+   * A turn's history is committed when its generator drains, and a turn does
+   * not stop the moment Stop is pressed — an in-flight dispatch has to settle
+   * first, and nothing can pull a store write back out of an adapter. So the
+   * sequence Stop -> "New conversation" -> the write finishes used to end with
+   * the OLD turn assigning its whole history over the empty one: a chat the
+   * user had just cleared came back, carrying a change they never saw made.
+   * The turn still finishes and its effect still lands in the app; it simply
+   * no longer owns a conversation that has moved on.
+   */
+  let generation = 0;
+  /**
+   * The grounding probe's result, held past `prime`.
+   *
+   * The system prompt is a pure function of this plus the policy, and the
+   * approval paragraph changes when the device toggle does — holding the
+   * digest lets the prompt be rebuilt without re-probing the app for state it
+   * already read.
+   */
+  let digest = {};
   /**
    * `storage key -> the live store that owns it`, derived from the grounding.
    *
@@ -105,16 +149,63 @@ function createAskBuoySession(config) {
   // So the agent's own requests to the model endpoint never come back to it
   // out of the network tool — that would feed it its own auth headers.
   (0, _redact.registerSelfEndpoint)(config.endpoint);
-  const provider = config.protocol === "openai" ? (0, _openai.createOpenAIProvider)(config) : (0, _anthropic.createAnthropicProvider)(config);
+  const provider = config.provider ?? (config.protocol === "openai" ? (0, _openai.createOpenAIProvider)(config) : (0, _anthropic.createAnthropicProvider)(config));
 
   // Mutable: the device's tool list fills in over the first frames and can
   // change while the sheet is open. See setAvailableActions.
   let availableActions = config.availableActions;
   let availableToolIds = Object.keys(availableActions);
+
+  /**
+   * THE policy object the engine reads, mutated in place.
+   *
+   * One object for the life of the session, not a fresh one per turn: the
+   * engine reads `policy.readOnly` and the approval lists at each call, so a
+   * toggle flipped mid-turn lands on the very next call of that turn. A new
+   * object per turn would leave a running turn on the old rules until it
+   * finished — "Read only" switched on while the agent was writing would let
+   * the rest of the batch through.
+   */
+  const live = {
+    ...policy
+  };
+  function refreshLive() {
+    for (const k of Object.keys(live)) delete live[k];
+    Object.assign(live, policy);
+    if (bypassApproval) {
+      live.requireApproval = [];
+      live.requireApprovalFor = [];
+    }
+    // OR, never override: the device can narrow, the app's own read-only stands.
+    if (deviceReadOnly) live.readOnly = true;
+  }
+  function activePolicy() {
+    return live;
+  }
+  function composeSystem() {
+    system = (0, _systemPrompt.buildSystemPrompt)({
+      catalog,
+      context: {
+        ...config.context,
+        digest: {
+          ...digest,
+          ...config.context?.digest
+        }
+      },
+      isRelease: config.isRelease,
+      readOnly: live.readOnly ?? false,
+      readOnlySource: policy.readOnly ? "app" : deviceReadOnly ? "device" : undefined,
+      requireApproval: (0, _policy.resolveRequireApproval)(live),
+      approvalsBypassed: bypassApproval,
+      appName: config.appName,
+      platform: config.platform,
+      availableToolIds
+    });
+  }
   async function prime() {
     if (primed) return;
     primed = true;
-    let digest = {};
+    digest = {};
     try {
       digest = await (0, _buildContextPack.buildContextDigest)({
         dispatch: config.dispatch,
@@ -131,24 +222,16 @@ function createAskBuoySession(config) {
       const store = raw;
       if (store?.persistsTo && store.name) storeKeyOwners[store.persistsTo] = store.name;
     }
-    system = (0, _systemPrompt.buildSystemPrompt)({
-      catalog,
-      context: {
-        ...config.context,
-        digest: {
-          ...digest,
-          ...config.context?.digest
-        }
-      },
-      isRelease: config.isRelease,
-      readOnly: policy.readOnly ?? false,
-      requireApproval: (0, _policy.resolveRequireApproval)(policy),
-      appName: config.appName,
-      platform: config.platform
-    });
+    composeSystem();
   }
   return {
     ledger,
+    evidence,
+    calibration,
+    trustedActions: () => [...trusted],
+    untrust: key => {
+      trusted.delete(key);
+    },
     get messages() {
       return messages;
     },
@@ -157,35 +240,128 @@ function createAskBuoySession(config) {
       availableActions = actions;
       availableToolIds = Object.keys(actions);
     },
+    setApprovalBypass(enabled) {
+      if (bypassApproval === enabled) return;
+      bypassApproval = enabled;
+      refreshLive();
+      // The prompt tells the model whether a card will appear before its
+      // change lands; leaving that paragraph stale would have it announce an
+      // approval step that no longer exists. Rebuilt from the held digest, so
+      // toggling mid-conversation costs nothing and re-reads nothing.
+      if (system) composeSystem();
+    },
+    setReadOnly(enabled) {
+      if (deviceReadOnly === enabled) return;
+      deviceReadOnly = enabled;
+      refreshLive();
+      if (system) composeSystem();
+    },
     restore(history) {
       // Only into a session that has not been talked to. Restoring over a live
       // conversation would drop whatever was said since the app started.
       if (messages.length > 0) return;
-      messages = trimHistory(resumableHistory(history));
+      const report = (0, _historyBudget.trimHistoryReport)(resumableHistory(history), calibration.charsPerToken, ledger.liveCallIds());
+      messages = report.messages;
+      trimmedOnRestore = report.droppedRounds;
     },
     async *send(text, signal) {
+      /**
+       * Captured FIRST, before any await.
+       *
+       * Priming and the live-context probes are awaits like any other, and a
+       * reset can land inside them. Reading the generation after them would
+       * pick up the NEW conversation's value and let this turn commit into it —
+       * the precise bug this guards against, reintroduced one line lower.
+       */
+      const myGeneration = generation;
       await prime();
-      messages.push({
+      // The RIGHT NOW block: re-read on EVERY turn, not once at open. The
+      // stable digest above was once the whole picture, and it was built
+      // before the user had navigated anywhere — so the query that owned the
+      // screen they were looking at was simply not in the prompt. This is the
+      // uncached tail of the system prompt (see ProviderRequest.systemVolatile).
+      let live;
+      try {
+        live = await (0, _buildContextPack.buildLiveContext)({
+          dispatch: config.dispatch,
+          readSnapshot: config.readSnapshot,
+          availableToolIds,
+          availableActions
+        });
+      } catch {
+        live = undefined;
+      }
+      /**
+       * The conversation was cleared while this turn was still getting ready.
+       *
+       * Priming and the live probes take real time, so "New conversation"
+       * lands here often enough to matter. Abandoning now costs nothing: the
+       * model has not been asked anything yet.
+       */
+      if (myGeneration !== generation) {
+        yield {
+          type: "done",
+          stopReason: "superseded"
+        };
+        return;
+      }
+
+      /**
+       * The turn works on its OWN array, and `messages` is assigned in exactly
+       * one place — the commit at the bottom.
+       *
+       * `runAgentTurn` pushes each round into the array it is handed. Handing
+       * it the session's own array made every push a live edit of session
+       * state, so a turn racing a reset wrote its whole history into the new
+       * conversation one push at a time and the commit guard had nothing left
+       * to protect. Copying makes ownership checkable in one place instead of
+       * spread across the loop.
+       */
+      const trimmed = (0, _historyBudget.trimHistoryReport)([...messages, {
         role: "user",
         text
-      });
-      messages = trimHistory(messages);
+      }], calibration.charsPerToken, ledger.liveCallIds());
+      const working = trimmed.messages;
+      // Said once, before the answer it affects. The screen still shows the
+      // rounds the model just lost; this is the only thing that tells the two
+      // apart. See the `history-trimmed` event.
+      const droppedRounds = trimmed.droppedRounds + trimmedOnRestore;
+      trimmedOnRestore = 0;
+      if (droppedRounds > 0) yield {
+        type: "history-trimmed",
+        droppedRounds,
+        droppedPinned: trimmed.droppedPinned
+      };
       const gen = (0, _runAgentTurn.runAgentTurn)({
         provider,
         catalog,
-        messages,
+        messages: working,
         system: system,
+        systemVolatile: (0, _systemPrompt.buildLiveBlock)(live,
+        // What this conversation has already done to the app. See
+        // buildLiveBlock — without it the model answers "what have you
+        // changed?" from memory of its own sentences, and reports a value it
+        // overwrote itself as the app's own.
+        ledger.list().map(e => ({
+          label: `${e.toolId}.${e.action}${e.effect.label ? ` — ${e.effect.label}` : ""}`,
+          undone: e.undoneAt !== undefined
+        }))),
         model: config.model,
         maxTokens: config.maxTokens ?? 4096,
         dispatch: config.dispatch,
         readSnapshot: config.readSnapshot,
         storeKeyOwners,
         ledger,
-        policy,
+        policy: activePolicy(),
         isRelease: config.isRelease,
         availableToolIds,
         availableActions,
         requestApproval: config.requestApproval,
+        seenUrls,
+        evidence,
+        calibration,
+        trusted,
+        procedures: (0, _systemPrompt.listableProcedures)(config.context?.procedures, availableToolIds),
         signal
       });
       let next = await gen.next();
@@ -194,11 +370,19 @@ function createAskBuoySession(config) {
         next = await gen.next();
       }
       // The generator's return value is the full history including tool turns.
-      messages = next.value;
+      // Committed only if this turn still owns the conversation — see
+      // `generation`.
+      if (myGeneration === generation) messages = next.value;
     },
     reset() {
+      // Before anything else: a turn still draining must not commit over this.
+      generation += 1;
       messages = [];
+      trimmedOnRestore = 0;
       ledger.clear();
+      seenUrls.clear();
+      evidence.clear();
+      trusted.clear();
       // The grounding digest is a snapshot of the app AT OPEN — stores and
       // routes registered since are invisible to it. A new conversation is
       // the natural moment to re-read the world.