@code-yeongyu/senpi 2026.10.21-1 → 2026.10.21-2

package/dist/core/extensions/builtin/compaction/openai-remote.js

@@ -1,4 +1,5 @@
 import { convertResponsesMessages, getContextProvenance, normalizeContext, } from "@earendil-works/pi-ai";
+import { deriveOpenAIPromptCacheKey } from "@earendil-works/pi-ai/api/openai-prompt-cache";
 import { streamSimple } from "@earendil-works/pi-ai/compat";
 import { convertToLlm } from "../../../messages.js";
 import { buildContextEntries, buildSessionContext, getSessionContextEntryId, SESSION_CONTEXT_ENTRY_ID, sessionEntryToContextMessages, } from "../../../session-manager.js";
@@ -25,11 +26,12 @@ export function createOpenAiRemoteCompactionRequest(options) {
     if (input.length === 0)
         return undefined;
     return {
+        sessionId: options.sessionId,
         body: {
             model: options.model.id,
             input,
             ...(options.systemPrompt ? { instructions: options.systemPrompt } : {}),
-            ...(options.promptCacheKey ? { prompt_cache_key: options.promptCacheKey } : {}),
+            prompt_cache_key: deriveOpenAIPromptCacheKey(options.model.id, normalizeContext({ systemPrompt: options.systemPrompt, messages: [] })),
             ...(options.serviceTier ? { service_tier: options.serviceTier } : {}),
         },
         inputItemCount: input.length,
@@ -98,7 +100,6 @@ export function createOpenAiResponsesStreamCompactionPayload(payload, request) {
         ...payload,
         model: request.body.model,
         input: [...leadingPromptMessages(payload.input), ...createOpenAiResponsesStreamCompactionInput(request)],
-        ...(request.body.prompt_cache_key ? { prompt_cache_key: request.body.prompt_cache_key } : {}),
         ...(request.body.service_tier ? { service_tier: request.body.service_tier } : {}),
     };
 }
@@ -173,7 +174,7 @@ async function runOpenAiResponsesStreamCompaction(options) {
             }
             return transformedPayload;
         },
-        sessionId: options.request.body.prompt_cache_key,
+        sessionId: options.request.sessionId,
         signal: options.signal,
         transport: "websocket",
     });
@@ -361,7 +362,7 @@ export async function runOpenAiRemoteCompaction(ctx, event, emit, dependencies =
         branchEntries: event.branchEntries,
         messages: providerRequest?.messages,
         tokensBefore: event.preparation.tokensBefore,
-        promptCacheKey: ctx.sessionManager.getSessionId(),
+        sessionId: ctx.sessionManager.getSessionId(),
         serviceTier,
     });
     if (!request) {
@@ -403,7 +404,7 @@ export async function runOpenAiRemoteCompaction(ctx, event, emit, dependencies =
     const transformedHeaders = providerRequest
         ? await providerRequest.transformHeaders(auth.headers ?? {})
         : auth.headers;
-    const requestHeaders = createOpenAiRemoteCompactionHeaders(requestModel, { ...auth, headers: transformedHeaders }, request.body.prompt_cache_key);
+    const requestHeaders = createOpenAiRemoteCompactionHeaders(requestModel, { ...auth, headers: transformedHeaders }, request.sessionId);
     if (!requestHeaders) {
         emit?.({
             version: 1,

package/dist/core/extensions/builtin/goal/provider-retry.d.ts

@@ -3,8 +3,8 @@ export declare const PROVIDER_RETRY_BASE_MS = 15000;
 export declare const PROVIDER_RETRY_CAP_MS: number;
 export declare const PROVIDER_RETRY_WAKE_CAP_MS: number;
 /**
- * The earliest future instant the failed turn's error names (never the assistant's own text), e.g. a credential pool's
- * "blocked until 2026-10-14T12:15:00.000Z": the moment an account frees up.
+ * Prefer a provider's structured usage reset, then its retry-after marker. Legacy
+ * pool guidance falls back to the earliest future ISO instant in the error only.
  */
 export declare function providerRetryAt(messages: readonly AgentMessage[], now: number): number | undefined;
 /**

package/dist/core/extensions/builtin/goal/provider-retry.js

@@ -1,18 +1,30 @@
+import { parseRetryAfterMsMarker } from "@earendil-works/pi-ai/utils/retry-hint";
 import { lastAssistantMessage } from "./last-assistant-message.js";
 export const PROVIDER_RETRY_BASE_MS = 15_000;
 export const PROVIDER_RETRY_CAP_MS = 30 * 60_000;
 export const PROVIDER_RETRY_WAKE_CAP_MS = 6 * 60 * 60_000;
 const WAKE_MARGIN_MS = 1_000;
 const ISO_INSTANT = /\b\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z\b/g;
-function failureText(messages) {
-    return lastAssistantMessage(messages)?.errorMessage ?? "";
-}
 /**
- * The earliest future instant the failed turn's error names (never the assistant's own text), e.g. a credential pool's
- * "blocked until 2026-10-14T12:15:00.000Z": the moment an account frees up.
+ * Prefer a provider's structured usage reset, then its retry-after marker. Legacy
+ * pool guidance falls back to the earliest future ISO instant in the error only.
  */
 export function providerRetryAt(messages, now) {
-    const instants = [...failureText(messages).matchAll(ISO_INSTANT)]
+    const failure = lastAssistantMessage(messages);
+    const diagnostic = failure?.providerDiagnostic;
+    const reset = diagnostic?.resetsAt;
+    if ((diagnostic?.category === "quota" || diagnostic?.category === "rate_limit") &&
+        reset !== undefined &&
+        Number.isFinite(reset) &&
+        reset > now) {
+        return reset;
+    }
+    const text = failure?.errorMessage ?? "";
+    const retryAfterMs = parseRetryAfterMsMarker(text);
+    if (retryAfterMs !== undefined && Number.isFinite(retryAfterMs) && retryAfterMs > 0) {
+        return now + retryAfterMs;
+    }
+    const instants = [...text.matchAll(ISO_INSTANT)]
         .map((match) => Date.parse(match[0]))
         .filter((at) => Number.isFinite(at) && at > now);
     return instants.length === 0 ? undefined : Math.min(...instants);

package/dist/core/extensions/builtin/terminal/command-monitor-source.d.ts

@@ -1,7 +1,9 @@
 /**
- * Command watches: a PTY session's output, line-buffered and filtered, with the durable fire budget
- * that auto-mutes a restartable watch that fires too often. Output stays in the runtime's bounded
- * history; a record holds at most one unfinished line.
+ * Command watches: a PTY session's output, line-buffered and filtered. A durable (restartable) watch
+ * counts its matched lines in a persisted rolling fire window and carries the runaway guard, which
+ * pauses it with a visible notice only after a sustained flood; a busy watch is never muted, its
+ * wakes are paced by the notifier instead. Output stays in the runtime's bounded history; a record
+ * holds at most one unfinished line.
  */
 import { MonitorLineBuffer } from "./monitor-line-buffer.ts";
 import { type MonitorFireWindow, type MonitorRecordBase, type MonitorSourceHost } from "./monitor-types.ts";
@@ -17,7 +19,7 @@ export interface RegisterMonitorOptions {
     readonly description: string;
     readonly runtime: TerminalRuntimeSession;
     readonly filter?: RegExp;
-    /** Durability class from the manifest spec; non-ephemeral records carry the fire budget. */
+    /** Durability class from the manifest spec; non-ephemeral records carry the fire window and runaway guard. */
     readonly durabilityClass?: MonitorDurabilityClass;
     /** Persisted fire window re-bound by a restore, so a restart cannot reset the budget. */
     readonly fireWindow?: MonitorFireWindow;
@@ -25,6 +27,14 @@ export interface RegisterMonitorOptions {
     readonly expiresAt?: number;
     /** Output lines are a person's words (a chat bridge); goal continuation counts them as new input. */
     readonly humanInput?: boolean;
+    /** Per-monitor wake-rate override of a persistent watch; unset uses terminal.monitorWakesPerHour. */
+    readonly wakesPerHour?: number;
+}
+/** One-minute bucket of matched lines plus the run of consecutive flood minutes before it. */
+interface RunawayWindow {
+    minuteStartMs: number;
+    count: number;
+    floodMinutes: number;
 }
 export interface MonitorRecord extends MonitorRecordBase {
     readonly id: string;
@@ -45,6 +55,8 @@ export interface MonitorRecord extends MonitorRecordBase {
     paused: boolean;
     settled: boolean;
     fireWindow: MonitorFireWindow | undefined;
+    runaway: RunawayWindow | undefined;
+    readonly wakesPerHour: number | undefined;
     unsubscribeOutput: (() => void) | undefined;
     unsubscribeExit: (() => void) | undefined;
     readonly humanInput: boolean;
@@ -60,4 +72,5 @@ export declare class CommandMonitorSource {
     adoptFireWindow(monitorId: string, fireWindow: MonitorFireWindow): boolean;
     dispose(): void;
 }
+export {};
 //# sourceMappingURL=command-monitor-source.d.ts.map

package/dist/core/extensions/builtin/terminal/command-monitor-source.js

@@ -1,11 +1,13 @@
 /**
- * Command watches: a PTY session's output, line-buffered and filtered, with the durable fire budget
- * that auto-mutes a restartable watch that fires too often. Output stays in the runtime's bounded
- * history; a record holds at most one unfinished line.
+ * Command watches: a PTY session's output, line-buffered and filtered. A durable (restartable) watch
+ * counts its matched lines in a persisted rolling fire window and carries the runaway guard, which
+ * pauses it with a visible notice only after a sustained flood; a busy watch is never muted, its
+ * wakes are paced by the notifier instead. Output stays in the runtime's bounded history; a record
+ * holds at most one unfinished line.
  */
 import { MonitorLineBuffer } from "./monitor-line-buffer.js";
 import { allocateMonitorId, } from "./monitor-types.js";
-import { DEFAULT_DURABLE_MONITOR_FIRE_BUDGET, FIRE_BUDGET_AUTO_MUTE_SUMMARY, FIRE_BUDGET_WINDOW_MS } from "./shared.js";
+import { FIRE_BUDGET_WINDOW_MS, runawayPauseSummary } from "./shared.js";
 import { describeExit } from "./tools/spawn.js";
 export class CommandMonitorSource {
     #records = new Map();
@@ -43,6 +45,8 @@ export class CommandMonitorSource {
             paused: false,
             settled: false,
             fireWindow: durable ? { ...(options.fireWindow ?? { startMs: Date.now(), count: 0 }) } : undefined,
+            runaway: undefined,
+            wakesPerHour: options.wakesPerHour,
             unsubscribeOutput: undefined,
             unsubscribeExit: undefined,
             humanInput: options.humanInput === true,
@@ -96,19 +100,42 @@ export class CommandMonitorSource {
                 if (now - record.fireWindow.startMs >= FIRE_BUDGET_WINDOW_MS)
                     record.fireWindow = { startMs: now, count: 0 };
                 record.fireWindow.count += 1;
-                if (record.fireWindow.count >= DEFAULT_DURABLE_MONITOR_FIRE_BUDGET) {
+                if (this.#floodsRunaway(record, now)) {
+                    const guard = this.#host.runawayGuard();
                     record.paused = true;
                     this.#host.emit(record, {
                         type: "summary",
                         id: record.id,
                         description: record.description,
-                        summary: FIRE_BUDGET_AUTO_MUTE_SUMMARY,
+                        summary: runawayPauseSummary(record.id, guard.linesPerMinute, guard.minutes),
                     });
                     this.#host.changed();
                 }
             }
         }
     }
+    /**
+     * Count one matched line into the record's minute bucket. A minute with more lines than the guard
+     * allows is a flood minute; the watch trips once the current minute floods and the minutes right
+     * before it flooded too, `minutes` in a row. A quiet or skipped minute resets the run.
+     */
+    #floodsRunaway(record, now) {
+        const guard = this.#host.runawayGuard();
+        const previous = record.runaway;
+        let current = previous;
+        if (current === undefined || now - current.minuteStartMs >= 60_000) {
+            const elapsedMinutes = previous === undefined ? 0 : Math.floor((now - previous.minuteStartMs) / 60_000);
+            const previousFlooded = previous !== undefined && elapsedMinutes === 1 && previous.count > guard.linesPerMinute;
+            current = {
+                minuteStartMs: previous === undefined ? now : previous.minuteStartMs + elapsedMinutes * 60_000,
+                count: 0,
+                floodMinutes: previous !== undefined && previousFlooded ? previous.floodMinutes + 1 : 0,
+            };
+            record.runaway = current;
+        }
+        current.count += 1;
+        return current.count > guard.linesPerMinute && current.floodMinutes + 1 >= guard.minutes;
+    }
     #settle(record) {
         if (record.settled)
             return;

package/dist/core/extensions/builtin/terminal/durable-command.js

@@ -129,6 +129,7 @@ export function createRestartableCommandHandler(deps) {
             runtime: spawned.runtime,
             filter: compileFilter(monitor.filter),
             ...(monitor.humanInput === true ? { humanInput: true } : {}),
+            ...(monitor.wakesPerHour !== undefined ? { wakesPerHour: monitor.wakesPerHour } : {}),
             // The persisted deadline rides through verbatim; a restore never extends it.
             ...(monitor.expiresAt !== null ? { expiresAt: monitor.expiresAt } : {}),
         });

package/dist/core/extensions/builtin/terminal/extension.js

@@ -6,6 +6,7 @@ import { isEvalOnlyRouting } from "../eval-only-routing.js";
 import { buildToolContext, bundleSinks, createBundle, sessionKeyOf, } from "./extension-state.js";
 import { currentLeaseToken, releaseTerminalLease, retireLeaseToken } from "./manifest-lease.js";
 import { MonitorNotifier } from "./monitor-notify.js";
+import { appendMonitorOverflow } from "./monitor-overflow-file.js";
 import { terminalStateDir } from "./monitor-state-dir.js";
 import { MONITOR_STATUS_KEY } from "./monitor-status.js";
 import { MonitorStatusTicker } from "./monitor-status-ticker.js";
@@ -24,6 +25,26 @@ import { createBashResizeTool } from "./tools/bash-resize.js";
 import { TERMINAL_CHILD_JOB_KINDS, terminalChildJob } from "./tools/child-placement.js";
 import { createKillBashTool } from "./tools/kill-bash.js";
 import { bindTerminalManifestWriter, createMonitorTool } from "./tools/monitor.js";
+/**
+ * Only paced (persistent command) watches of a session with a durable state dir get an overflow file.
+ * A failing file is reported once per monitor, not once per spilled chunk.
+ */
+function spillMonitorOverflow(state, warned, id, lines) {
+    const terminalDir = terminalStateDir(state.ctx);
+    const monitorId = state.bundle?.manager.monitorIdOf(id);
+    if (terminalDir === undefined || monitorId === undefined || state.bundle?.monitors.wakePacing(id) === undefined)
+        return undefined;
+    try {
+        return appendMonitorOverflow(terminalDir, monitorId, lines);
+    }
+    catch (error) {
+        if (warned.has(monitorId))
+            return undefined;
+        warned.add(monitorId);
+        state.ctx?.ui?.notify?.(`Could not write the overflow file of ${monitorId}: ${error instanceof Error ? error.message : String(error)}`, "warning");
+        return undefined;
+    }
+}
 function shouldStepAside(ctx) {
     return isAnthropicBashEnabled() && ctx?.model?.api === "anthropic-messages";
 }
@@ -106,12 +127,18 @@ export function registerTerminalExtension(pi) {
             getMode: () => state.settings.notify,
         });
         state.monitorNotifier?.dispose();
+        const overflowWarned = new Set();
         state.monitorNotifier = new MonitorNotifier({
             sendMessage: (message, options) => pi.sendMessage(message, options),
             getContext: () => state.ctx,
             getMode: () => state.settings.notify,
             getSettings: () => state.settings.monitor,
             pauseMonitors: (ids) => state.bundle?.monitors.pause(ids) ?? [],
+            wakesPerHour: (id) => {
+                const pacing = state.bundle?.monitors.wakePacing(id);
+                return pacing === undefined ? undefined : (pacing.wakesPerHour ?? state.settings.monitor.wakesPerHour);
+            },
+            spillOverflow: (id, lines) => spillMonitorOverflow(state, overflowWarned, id, lines),
         });
         const sessionKey = sessionKeyOf(ctx);
         if (event.reason === "reload") {
@@ -128,6 +155,7 @@ export function registerTerminalExtension(pi) {
             state.bundle = createBundle(state);
         }
         state.bundle ??= createBundle(state);
+        state.bundle.monitors.setRunawayGuard(state.settings.monitorRunaway);
         state.bundle.bind(bundleSinks(pi, state));
         const holdsLease = sessionKey !== undefined && currentLeaseToken(encodedSessionId(sessionKey)) !== undefined;
         if (event.reason === "reload" && holdsLease) {

package/dist/core/extensions/builtin/terminal/monitor-notify-details.d.ts

@@ -0,0 +1,6 @@
+import type { MonitorNotificationDetail } from "../monitor-state-event.ts";
+import type { OverflowBook } from "./monitor-overflow.ts";
+import type { MonitorEvent } from "./monitor-registry.ts";
+/** Per-monitor attribution of one wake: what it carried inline plus what overflowed. */
+export declare function monitorDetails(events: readonly MonitorEvent[], ids: ReadonlySet<string>, overflowBook: OverflowBook): MonitorNotificationDetail[];
+//# sourceMappingURL=monitor-notify-details.d.ts.map

package/dist/core/extensions/builtin/terminal/monitor-notify-details.js

@@ -0,0 +1,19 @@
+/** Per-monitor attribution of one wake: what it carried inline plus what overflowed. */
+export function monitorDetails(events, ids, overflowBook) {
+    return [...ids].map((id) => {
+        const own = events.filter((event) => event.id === id);
+        const overflow = overflowBook.get(id);
+        const kinds = new Set(own.map((event) => event.type));
+        for (const kind of overflow?.kinds ?? [])
+            kinds.add(kind);
+        const humanInput = own.some((event) => event.type === "line" && event.humanInput === true) || overflow?.humanInput === true;
+        return {
+            id,
+            description: own[0]?.description ?? overflow?.description ?? id,
+            eventCount: own.length + (overflow?.count ?? 0),
+            kinds: [...kinds],
+            ...(humanInput ? { humanInput: true } : {}),
+        };
+    });
+}
+//# sourceMappingURL=monitor-notify-details.js.map

package/dist/core/extensions/builtin/terminal/monitor-notify-format.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Rendering of monitor wakes: one event body, a monitor's group header, and the size of a
+ * monitor's share of a wake, so the notifier can fill a wake by whole monitors without clipping.
+ */
+import type { MonitorEvent } from "./monitor-registry.ts";
+export declare const SYSTEM_REMINDER_OPEN = "<system-reminder>";
+export declare const SYSTEM_REMINDER_CLOSE = "</system-reminder>";
+export declare const WAKE_BUDGET_PAUSE_NOTICE = "Monitor paused after repeated updates. Completion still wakes this session; peek bash_output or re-arm only for intermediate events.";
+export declare function eventBody(event: MonitorEvent): string;
+export declare function renderedLength(event: MonitorEvent): number;
+/** Characters one monitor adds to a wake: its group, its overflow notice, and their separators. */
+export declare function monitorShareChars(events: readonly MonitorEvent[], notice: string): number;
+/**
+ * One wake message. The notifier fills a wake by whole monitors within `maxChars`, so the clip is a
+ * last-resort guard that a correctly sized wake never reaches.
+ */
+export declare function buildWakeMessage(events: readonly MonitorEvent[], notices: readonly string[], pauseNotice: string, maxChars: number): string;
+//# sourceMappingURL=monitor-notify-format.d.ts.map

package/dist/core/extensions/builtin/terminal/monitor-notify-format.js

@@ -0,0 +1,52 @@
+import { sanitizeTerminalOutput } from "./output-format.js";
+export const SYSTEM_REMINDER_OPEN = "<system-reminder>";
+export const SYSTEM_REMINDER_CLOSE = "</system-reminder>";
+export const WAKE_BUDGET_PAUSE_NOTICE = "Monitor paused after repeated updates. Completion still wakes this session; peek bash_output or re-arm only for intermediate events.";
+export function eventBody(event) {
+    const value = event.type === "line" ? event.line : event.summary;
+    return sanitizeTerminalOutput(value)
+        .replace(/[\r\n]+/g, " ")
+        .trimEnd();
+}
+export function renderedLength(event) {
+    return `Monitor event(${event.description}): ${eventBody(event)}`.length;
+}
+function groupHeader(description) {
+    return `Monitor event(${description}): `;
+}
+/** Characters one monitor adds to a wake: its group, its overflow notice, and their separators. */
+export function monitorShareChars(events, notice) {
+    const first = events[0];
+    const group = first === undefined
+        ? 0
+        : groupHeader(first.description).length +
+            events.reduce((total, event) => total + eventBody(event).length + 1, 0);
+    return group + (notice.length > 0 ? notice.length + 1 : 0);
+}
+function clip(text, maxChars) {
+    if (text.length <= maxChars)
+        return text;
+    if (maxChars <= 3)
+        return text.slice(0, maxChars);
+    return `${text.slice(0, maxChars - 3)}...`;
+}
+function formatEvents(events) {
+    const groups = new Map();
+    for (const event of events) {
+        const group = groups.get(event.id) ?? { description: event.description, bodies: [] };
+        group.bodies.push(eventBody(event));
+        groups.set(event.id, group);
+    }
+    return [...groups.values()].map((group) => `${groupHeader(group.description)}${group.bodies.join("\n")}`).join("\n");
+}
+/**
+ * One wake message. The notifier fills a wake by whole monitors within `maxChars`, so the clip is a
+ * last-resort guard that a correctly sized wake never reaches.
+ */
+export function buildWakeMessage(events, notices, pauseNotice, maxChars) {
+    const suffix = [...notices, pauseNotice].filter(Boolean).join("\n");
+    const fixedChars = SYSTEM_REMINDER_OPEN.length + SYSTEM_REMINDER_CLOSE.length + (suffix ? suffix.length + 1 : 0);
+    const body = clip(formatEvents(events), Math.max(0, maxChars - fixedChars));
+    return `${SYSTEM_REMINDER_OPEN}${body}${body && suffix ? "\n" : ""}${suffix}${SYSTEM_REMINDER_CLOSE}`;
+}
+//# sourceMappingURL=monitor-notify-format.js.map

package/dist/core/extensions/builtin/terminal/monitor-notify.d.ts

@@ -1,6 +1,8 @@
+import { type MonitorSpill } from "./monitor-overflow.ts";
 import type { MonitorEvent } from "./monitor-registry.ts";
 import { type TerminalNotifierDeps } from "./notify.ts";
 import type { MonitorDeliverySettings } from "./settings.ts";
+export type { MonitorSpill, MonitorSpillResult } from "./monitor-overflow.ts";
 export interface MonitorNotificationScheduler {
     now(): number;
     setTimeout(callback: () => void, delayMs: number): unknown;
@@ -10,11 +12,16 @@ export interface MonitorNotifierDeps extends TerminalNotifierDeps {
     readonly getSettings: () => MonitorDeliverySettings;
     /** Pause the monitors contributing to a shared wake-budget exhaustion. */
     readonly pauseMonitors: (ids: readonly string[]) => readonly string[];
+    /** Wake rate (and burst) of a paced monitor; undefined leaves the monitor unpaced. */
+    readonly wakesPerHour?: (id: string) => number | undefined;
+    /** Append overflow lines to the monitor's overflow file; undefined when it has none. */
+    readonly spillOverflow?: MonitorSpill;
     readonly scheduler?: MonitorNotificationScheduler;
 }
 /**
  * Session-scoped monitor delivery queue. It preserves the terminal runtime as the authoritative,
- * bounded event history while retaining only one capped coalescing batch for chat injection.
+ * bounded event history while retaining only capped per-monitor batches for chat injection. A
+ * wake is filled by whole monitors; a monitor that does not fit stays queued for the next wake.
  */
 export declare class MonitorNotifier {
     #private;