@code-yeongyu/senpi 2026.8.28 → 2026.8.30

package/dist/core/agent-session.js

@@ -14,10 +14,11 @@
  */
 import { randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { rm } from "node:fs/promises";
 import { basename, dirname } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { ProviderRetryWatchdogAbortError, prepareAgentToolCall } from "@earendil-works/pi-agent-core";
-import { contentText, SERVER_FALLBACK_ABORTED_DIAGNOSTIC } from "@earendil-works/pi-ai";
+import { contentText, measureCursorHistorySerializedBytes, SERVER_FALLBACK_ABORTED_DIAGNOSTIC, } from "@earendil-works/pi-ai";
 import { cleanupSessionResources, cursorOverflowCompactionSettings, isClassifierRefusal, isContextOverflow, isCursorPayloadResourceExhausted, isCursorQuotaResourceExhausted, isCursorZeroTokenResourceExhausted, isProviderStreamStallError, isProviderTimeoutError, isRecoverableLength, isRetryableAssistantError, modelsAreEqual, resetApiProviders, shouldRetryOverflowWithoutCompact, streamSimple, } from "@earendil-works/pi-ai/compat";
 import { extract429RetryAfterMs, parseRetryAfterMsMarker } from "@earendil-works/pi-ai/utils/retry-hint";
 import { retryBackoffDelayMs } from "@earendil-works/pi-ai/utils/retry-profile/backoff";
@@ -47,7 +48,7 @@ import { ExecuteToolError, ExtensionRunner, wrapRegisteredTools, } from "./exten
 import { emitSessionShutdownEvent } from "./extensions/runner.js";
 import { normalizeToolExposure, RUNTIME_EXTENSION_PATH } from "./extensions/types.js";
 import { shouldWarnHighReasoning } from "./high-reasoning-warning.js";
-import { filterContextExcludedMessages } from "./messages.js";
+import { convertToLlm, filterContextExcludedMessages, } from "./messages.js";
 import { ModelRegistry } from "./model-registry.js";
 import { getModelNarrowingPatterns, resolveModelScope } from "./model-resolver.js";
 import { PROMPT_CACHE_SAFE_WAIT_ENV, resolvePromptCacheSafeWaitSeconds } from "./prompt-cache-budget.js";
@@ -70,9 +71,21 @@ import { getSupportedThinkingLevels, supportsMax, supportsXhigh } from "./thinki
 import { resetTimings, time } from "./timings.js";
 import { createLocalBashOperations } from "./tools/bash.js";
 import { composeFilesystemPolicies } from "./tools/filesystem-policy.js";
-import { createAllToolDefinitions } from "./tools/index.js";
+import { createAllToolDefinitions, temporarilyDisabledToolNames } from "./tools/index.js";
 import { createToolDefinitionFromAgentTool } from "./tools/tool-definition-wrapper.js";
 import { addUsageToTotals, createUsageTotals } from "./usage-totals.js";
+/** Built-in shell tools routed exclusively through eval when experimental.bashEvalOnly is enabled. */
+const EVAL_ONLY_SHELL_TOOL_NAMES = ["bash", "powershell"];
+/** Workflow tool routed exclusively through eval when experimental.workflowEvalOnly is enabled. */
+const EVAL_ONLY_WORKFLOW_TOOL_NAMES = ["workflow"];
+/** Sample eval-cell call for an eval-only tool, using the argument name that tool actually takes. */
+function evalHelperCall(name) {
+    if (EVAL_ONLY_SHELL_TOOL_NAMES.includes(name))
+        return `tool.${name}({ command: "..." })`;
+    if (EVAL_ONLY_WORKFLOW_TOOL_NAMES.includes(name))
+        return `tool.${name}({ action: "..." })`;
+    return `tool.${name}({ ... })`;
+}
 const TURN_RETRY_SUPPRESSION_PREFIX = "senpi:no-turn-retry:";
 const DEFERRED_RETRY_QUEUE_OWNERS = new WeakSet();
 /** Format the user-attributed payload for one or more explicit skill invocations. */
@@ -310,6 +323,121 @@ function isSameOverflowSource(message, model, upstreamModelId) {
 const THINKING_LEVELS_WITH_MAX = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
 /** Caps explicit skill expansion so one prompt cannot consume unbounded context. */
 export const MAX_SKILL_EXPANSIONS_PER_PROMPT = 5;
+/** Cursor ingest rejects large verbatim tool payloads. The bound is UTF-8 bytes. */
+export const CURSOR_TOOL_RESULT_MAX_CHARS = 2000;
+export const CURSOR_TOOL_RESULT_MAX_BYTES = 50_000;
+const CURSOR_TRUNCATION_MARKER = "\n...[truncated]";
+export function truncateToolResultBodies(messages, maxChars = CURSOR_TOOL_RESULT_MAX_CHARS, maxBytes = CURSOR_TOOL_RESULT_MAX_BYTES, convert = (candidate) => convertToLlm(candidate)) {
+    if (!Array.isArray(messages) || messages.length === 0)
+        return { messages, changed: false };
+    const segmenter = new Intl.Segmenter(undefined, { granularity: "grapheme" });
+    const markerChars = [...segmenter.segment(CURSOR_TRUNCATION_MARKER)].length;
+    const result = messages.slice();
+    let changed = false;
+    // Apply the per-result character cap first, independent of the aggregate wire cap.
+    for (let messageIndex = result.length - 1; messageIndex >= 0; messageIndex--) {
+        const message = result[messageIndex];
+        if (message.role !== "toolResult" || !Array.isArray(message.content))
+            continue;
+        let content = message.content;
+        for (let partIndex = content.length - 1; partIndex >= 0; partIndex--) {
+            const part = content[partIndex];
+            if (part.type === "image" && typeof part.data === "string")
+                continue;
+            if (part.type !== "text" || typeof part.text !== "string")
+                continue;
+            const graphemes = [...segmenter.segment(part.text)].map((item) => item.segment);
+            if (graphemes.length <= maxChars)
+                continue;
+            const kept = graphemes.slice(0, Math.max(0, maxChars - markerChars)).join("");
+            const nextText = kept + CURSOR_TRUNCATION_MARKER;
+            content = content === message.content ? content.slice() : content;
+            content[partIndex] = { ...part, text: nextText };
+            result[messageIndex] = { ...message, content };
+            changed = true;
+        }
+    }
+    const measure = (candidate) => {
+        const converted = convert(candidate);
+        const activeUserMessageIndex = converted.at(-1)?.role === "user" ? converted.length - 1 : -1;
+        return measureCursorHistorySerializedBytes(converted, activeUserMessageIndex);
+    };
+    const fits = (candidate = result) => measure(candidate) <= maxBytes;
+    if (fits())
+        return { messages: changed ? result : messages, changed };
+    // Empty the oldest result bodies. Search the monotonic prefix of candidates
+    // rather than serializing once for every result (admission must stay bounded).
+    const emptyToolResult = (message) => {
+        if (message.role !== "toolResult" || !Array.isArray(message.content))
+            return message;
+        const emptiedContent = message.content.map((part) => part.type === "text" ? { ...part, text: "" } : part.type === "image" ? { ...part, data: "" } : part);
+        const content = emptiedContent.filter((part, index) => {
+            if (index === 0)
+                return true;
+            const previous = emptiedContent[index - 1];
+            const empty = part.type === "text" ? part.text === "" : part.type === "image" && part.data === "";
+            const previousEmpty = previous.type === "text" ? previous.text === "" : previous.type === "image" && previous.data === "";
+            return !empty || !previousEmpty;
+        });
+        return { ...message, content };
+    };
+    const toolResultIndexes = result.flatMap((message, index) => message.role === "toolResult" && Array.isArray(message.content) ? [index] : []);
+    const withEmptyPrefix = (count) => {
+        const candidate = result.slice();
+        for (let i = 0; i < count; i++)
+            candidate[toolResultIndexes[i]] = emptyToolResult(candidate[toolResultIndexes[i]]);
+        return candidate;
+    };
+    let low = 0;
+    let high = toolResultIndexes.length;
+    while (low < high) {
+        const middle = Math.floor((low + high) / 2);
+        if (fits(withEmptyPrefix(middle + 1)))
+            high = middle;
+        else
+            low = middle + 1;
+    }
+    const emptyCount = Math.min(low + 1, toolResultIndexes.length);
+    if (emptyCount > 0) {
+        result.splice(0, result.length, ...withEmptyPrefix(emptyCount));
+        changed = true;
+    }
+    if (fits())
+        return { messages: changed ? result : messages, changed };
+    // If metadata alone exceeds the cap, discard the oldest complete turns. This
+    // search is also monotonic and avoids quadratic whole-history reserialization.
+    const turnRanges = [];
+    const isConvertedUser = (message) => convert([message])[0]?.role === "user";
+    for (let index = 0; index < result.length; index++) {
+        if (!isConvertedUser(result[index]))
+            continue;
+        const nextUser = result.findIndex((message, nextIndex) => nextIndex > index && isConvertedUser(message));
+        turnRanges.push([index, nextUser < 0 ? result.length : nextUser]);
+    }
+    const withoutTurns = (count) => {
+        if (count === 0)
+            return result;
+        const start = turnRanges[0]?.[0] ?? 0;
+        const end = turnRanges[count - 1]?.[1] ?? start;
+        return [...result.slice(0, start), ...result.slice(end)];
+    };
+    low = 0;
+    high = turnRanges.length;
+    while (low < high) {
+        const middle = Math.floor((low + high) / 2);
+        if (fits(withoutTurns(middle + 1)))
+            high = middle;
+        else
+            low = middle + 1;
+    }
+    const turnCount = Math.min(low + 1, turnRanges.length);
+    if (turnCount > 0) {
+        const next = withoutTurns(turnCount);
+        result.splice(0, result.length, ...next);
+        changed = true;
+    }
+    return { messages: changed ? result : messages, changed };
+}
 // ============================================================================
 // AgentSession Class
 // ============================================================================
@@ -395,6 +523,10 @@ export class AgentSession {
         this._pendingBashMessages = [];
         this._turnIndex = 0;
         this._baseToolDefinitions = new Map();
+        /** Policy tools withheld from the model, retained so disarming can restore direct access. */
+        this._withheldEvalOnlyToolNames = new Set();
+        /** Eval-only hint names this session published, so a disarm can withdraw exactly those. */
+        this._publishedEvalOnlyHintNames = new Set();
         this._extensionMode = "print";
         // Tool registry for extension getTools/setTools
         this._toolRegistry = new Map();
@@ -516,6 +648,8 @@ export class AgentSession {
         this._extensionRunnerRef = config.extensionRunnerRef;
         this._initialActiveToolNames = config.initialActiveToolNames;
         this._defaultToolNames = config.defaultToolNames ? new Set(config.defaultToolNames) : undefined;
+        this._evalOnlyToolNamesOverride = config.evalOnlyToolNames ? new Set(config.evalOnlyToolNames) : undefined;
+        this._evalOnlyToolNames = this._resolveEvalOnlyToolNames();
         this._allowedToolNames = config.allowedToolNames ? new Set(config.allowedToolNames) : undefined;
         this._excludedToolNames = config.excludedToolNames ? new Set(config.excludedToolNames) : undefined;
         this._baseToolsOverride = config.baseToolsOverride;
@@ -727,6 +861,14 @@ export class AgentSession {
             (this.agent.prepareNextTurn
                 ? async (_turn, signal) => await this.agent.prepareNextTurn?.(signal)
                 : undefined);
+        const previousTransformContext = this.agent.transformContext;
+        this.agent.transformContext = async (messages, signal) => {
+            const transformed = previousTransformContext ? await previousTransformContext(messages, signal) : messages;
+            if (this.model?.provider === "cursor" || this.model?.provider === "cursor-cli-oauth") {
+                return ((await truncateToolResultBodies(transformed, CURSOR_TOOL_RESULT_MAX_CHARS, CURSOR_TOOL_RESULT_MAX_BYTES, (candidate) => this.agent.convertToLlm(candidate))).messages ?? transformed);
+            }
+            return transformed;
+        };
         this.agent.prepareNextTurnWithContext = async (turn, signal) => {
             // Enforce compaction only when this prepare precedes an actual provider
             // admission: a tool continuation or queued steer/follow-up messages. A
@@ -735,7 +877,8 @@ export class AgentSession {
             const compactBeforeNextAdmission = async () => {
                 const provider = this.model?.provider;
                 // Cursor rebuilds the full conversation each hop. Compacting here
-                // mutates rootPrompt mid-run and poisons conversationId.
+                // mutates rootPrompt mid-run and poisons conversationId (#984).
+                // Still truncate verbatim toolResult bodies so the skip cannot send MB-scale payloads (#1043).
                 if (provider === "cursor" || provider === "cursor-cli-oauth") {
                     return false;
                 }
@@ -816,6 +959,19 @@ export class AgentSession {
     // Event Subscription
     // =========================================================================
     /** Emit an event to all listeners */
+    _emitEntryAppended(entryId) {
+        if (this._extensionMode !== "rpc")
+            return;
+        const entry = this.sessionManager.getEntry(entryId);
+        if (entry)
+            this._emit({ type: "entry_appended", entry });
+    }
+    /** Append a transport-provided entry and publish it on the RPC event stream. */
+    appendSessionEntry(entry) {
+        this.sessionManager.appendEntry(entry);
+        this.agent.state.messages = this.sessionManager.buildSessionContext().messages;
+        this._emitEntryAppended(entry.id);
+    }
     _emit(event) {
         this._logSessionEvent(event);
         for (const l of this._eventListeners) {
@@ -934,6 +1090,7 @@ export class AgentSession {
             type: "queue_update",
             steering: [...this._steeringMessages],
             followUp: [...this._followUpMessages],
+            ordered: [...this._queuedInputOrder].sort((a, b) => a.enqueueOrder - b.enqueueOrder),
         });
     }
     _incrementMessageRevision() {
@@ -975,6 +1132,7 @@ export class AgentSession {
     _invalidateCompactionForModelSelection() {
         this.abortCompaction();
         this.abortBranchSummary();
+        this._delegatedCompactionKey = undefined;
         this._incrementMessageRevision();
     }
     _getIdleWaitPromise() {
@@ -1366,7 +1524,7 @@ export class AgentSession {
                 event.message.role === "assistant" ||
                 event.message.role === "toolResult") {
                 // Regular LLM message - persist as SessionMessageEntry
-                this.sessionManager.appendMessage(event.message);
+                this._emitEntryAppended(this.sessionManager.appendMessage(event.message));
                 this._incrementMessageRevision();
             }
             // Other message types (bashExecution, compactionSummary, branchSummary) are persisted elsewhere
@@ -2000,6 +2158,9 @@ export class AgentSession {
     async executeTool(toolName, params, options) {
         let activeTools = this.getActiveToolNames();
         let tool = this.agent.state.tools.find((candidate) => candidate.name === toolName);
+        if (!tool && this._isEvalOnlyPolicyArmed() && this._evalOnlyToolNames?.has(toolName)) {
+            tool = this._toolRegistry.get(toolName);
+        }
         if (!tool &&
             options?.activateInactiveTool === true &&
             this._toolDefinitions.has(toolName) &&
@@ -2074,6 +2235,45 @@ export class AgentSession {
             return false;
         return this._lazyToolActivators.some((activate) => activate(toolName));
     }
+    _isEvalOnlyPolicyArmed() {
+        return this._evalOnlyToolNames !== undefined && this._toolRegistry.has("eval");
+    }
+    /**
+     * Resolve the eval-only policy from settings so a reload picks up a flag change.
+     * An explicitly configured set stays authoritative for SDK embedders and tests.
+     */
+    _resolveEvalOnlyToolNames() {
+        if (this._evalOnlyToolNamesOverride !== undefined)
+            return this._evalOnlyToolNamesOverride;
+        const names = [
+            ...(this.settingsManager.getExperimentalBashEvalOnly() ? EVAL_ONLY_SHELL_TOOL_NAMES : []),
+            ...(this.settingsManager.getExperimentalWorkflowEvalOnly() ? EVAL_ONLY_WORKFLOW_TOOL_NAMES : []),
+        ];
+        return names.length > 0 ? new Set(names) : undefined;
+    }
+    /**
+     * Publish per-tool eval-only redirect hints so a direct call names its own eval helper.
+     *
+     * Hints published here are tracked so a disarm - or a shrinking armed set, e.g. bash+workflow
+     * down to workflow only - withdraws the stale ones. Only tracked names are ever deleted, so
+     * hints owned by other publishers survive.
+     */
+    _publishEvalOnlyToolHints() {
+        const armed = this._isEvalOnlyPolicyArmed() ? (this._evalOnlyToolNames ?? new Set()) : undefined;
+        for (const name of this._publishedEvalOnlyHintNames) {
+            if (armed?.has(name))
+                continue;
+            delete this.agent.removedToolHints[name];
+        }
+        this._publishedEvalOnlyHintNames.clear();
+        if (!armed)
+            return;
+        for (const name of armed) {
+            this.agent.removedToolHints[name] =
+                `Run ${name} inside an eval cell via ${evalHelperCall(name)}; hooks and permissions still apply.`;
+            this._publishedEvalOnlyHintNames.add(name);
+        }
+    }
     /**
      * Set active tools by name.
      * Only tools in the registry can be enabled. Unknown tool names are ignored.
@@ -2101,7 +2301,23 @@ export class AgentSession {
     setActiveToolsByName(toolNames) {
         const tools = [];
         const validToolNames = [];
-        for (const name of toolNames) {
+        const policyArmed = this._isEvalOnlyPolicyArmed();
+        this._publishEvalOnlyToolHints();
+        const policyNames = this._evalOnlyToolNames;
+        let filteredToolNames = toolNames;
+        if (policyArmed && policyNames) {
+            for (const name of toolNames) {
+                if (policyNames.has(name))
+                    this._withheldEvalOnlyToolNames.add(name);
+            }
+            filteredToolNames = toolNames.filter((name) => !policyNames.has(name));
+        }
+        else {
+            this._withheldEvalOnlyToolNames.clear();
+        }
+        // Remember the unfiltered request so a later disarm can restore withheld shell tools.
+        this._requestedActiveToolNames = [...new Set([...toolNames, ...this._withheldEvalOnlyToolNames])];
+        for (const name of filteredToolNames) {
             const tool = this._toolRegistry.get(name);
             if (tool) {
                 tools.push(tool);
@@ -2258,9 +2474,26 @@ export class AgentSession {
             appendSystemPrompt: loaderAppendSystemPrompt.length > 0 ? loaderAppendSystemPrompt.join("\n\n") : undefined,
         };
         const basePrompt = loaderSystemPrompt ?? buildDynamicSystemPrompt(this._baseSystemPromptOptions);
-        return loaderAppendSystemPrompt.length > 0
-            ? `${basePrompt}\n\n${loaderAppendSystemPrompt.join("\n\n")}`
-            : basePrompt;
+        const prompt = loaderAppendSystemPrompt.length > 0 ? `${basePrompt}\n\n${loaderAppendSystemPrompt.join("\n\n")}` : basePrompt;
+        if (!this._isEvalOnlyPolicyArmed())
+            return prompt;
+        const armed = this._evalOnlyToolNames ?? new Set();
+        const sentences = [];
+        const shellHelpers = EVAL_ONLY_SHELL_TOOL_NAMES.filter((name) => armed.has(name)).map(evalHelperCall);
+        if (shellHelpers.length > 0) {
+            sentences.push(`Shell commands run ONLY inside eval cells via ${shellHelpers.join(" or ")}; hooks and permissions still apply.`);
+        }
+        if (armed.has("workflow")) {
+            sentences.push(`The workflow tool runs ONLY inside eval cells via ${evalHelperCall("workflow")}; hooks and permissions still apply.`);
+        }
+        // SDK embedders can arm names outside the built-in groups; they still need eval guidance.
+        const otherHelpers = [...armed]
+            .filter((name) => !EVAL_ONLY_SHELL_TOOL_NAMES.includes(name) && name !== "workflow")
+            .map(evalHelperCall);
+        if (otherHelpers.length > 0) {
+            sentences.push(`These tools run ONLY inside eval cells via ${otherHelpers.join(" or ")}; hooks and permissions still apply.`);
+        }
+        return sentences.length > 0 ? `${prompt}\n\n${sentences.join("\n\n")}` : prompt;
     }
     /**
      * Send a prompt to the agent.
@@ -3052,7 +3285,7 @@ export class AgentSession {
     }
     _appendCustomMessage(appMessage) {
         this.agent.state.messages.push(appMessage);
-        this.sessionManager.appendCustomMessageEntry(appMessage.customType, appMessage.content, appMessage.display, appMessage.details);
+        this._emitEntryAppended(this.sessionManager.appendCustomMessageEntry(appMessage.customType, appMessage.content, appMessage.display, appMessage.details));
         this._incrementMessageRevision();
         this._emit({ type: "message_start", message: appMessage });
         this._emit({ type: "message_end", message: appMessage });
@@ -3335,7 +3568,10 @@ export class AgentSession {
     }
     async _switchActiveModel(model, opts) {
         const previousModel = this.model;
-        if (opts.invalidateCompaction && this._modelSelectionChangesContext(previousModel, model)) {
+        if (opts.invalidateCompaction &&
+            (this._modelSelectionChangesContext(previousModel, model) ||
+                previousModel?.provider !== model.provider ||
+                previousModel?.id !== model.id)) {
             this._invalidateCompactionForModelSelection();
         }
         const thinking = this._getThinkingForModelSwitch(model, opts.ephemeralThinkingLevel);
@@ -3407,7 +3643,9 @@ export class AgentSession {
             nextIndex = direction === "forward" ? (currentIndex + 1) % len : (currentIndex - 1 + len) % len;
         }
         const next = favoriteModels[nextIndex];
-        const invalidatesCompaction = this._modelSelectionChangesContext(currentModel, next.model);
+        const invalidatesCompaction = this._modelSelectionChangesContext(currentModel, next.model) ||
+            currentModel?.provider !== next.model.provider ||
+            currentModel?.id !== next.model.id;
         if (invalidatesCompaction) {
             this._invalidateCompactionForModelSelection();
         }
@@ -3609,6 +3847,7 @@ export class AgentSession {
     setSteeringMode(mode) {
         this.agent.steeringMode = mode;
         this.settingsManager.setSteeringMode(mode);
+        this._emitSessionSettingsChanged();
     }
     /**
      * Set follow-up message mode.
@@ -3617,6 +3856,7 @@ export class AgentSession {
     setFollowUpMode(mode) {
         this.agent.followUpMode = mode;
         this.settingsManager.setFollowUpMode(mode);
+        this._emitSessionSettingsChanged();
     }
     // =========================================================================
     // Compaction
@@ -4099,7 +4339,7 @@ export class AgentSession {
             if (sourceChanged) {
                 return await this._rejectCompaction(request, requestId, operationId, "stale-revision", false);
             }
-            if (this._wouldCompactionOverflow(pathEntries, compactionResult, fromExtension, model)) {
+            if (await this._wouldCompactionOverflow(pathEntries, compactionResult, fromExtension, model)) {
                 return await this._rejectCompaction(request, requestId, operationId, "would-overflow", false);
             }
             const compactionEntryId = this.sessionManager.appendCompaction(compactionResult.summary, compactionResult.firstKeptEntryId, compactionResult.tokensBefore, compactionResult.details, fromExtension, compactionResult.usage);
@@ -4140,6 +4380,7 @@ export class AgentSession {
             })) {
                 throw new CompactionCancelledError();
             }
+            this._delegatedCompactionKey = undefined;
             if (request.owner === "compaction" && this._compactionAbortController === request.controller) {
                 this._compactionAbortController = undefined;
             }
@@ -4190,7 +4431,7 @@ export class AgentSession {
             finishCompactionWork();
         }
     }
-    _wouldCompactionOverflow(pathEntries, compactionResult, fromExtension, model) {
+    async _wouldCompactionOverflow(pathEntries, compactionResult, fromExtension, model) {
         const currentLeaf = pathEntries[pathEntries.length - 1];
         if (!currentLeaf)
             return false;
@@ -4205,7 +4446,12 @@ export class AgentSession {
             details: compactionResult.details,
             fromHook: fromExtension,
         };
-        const simulatedMessages = buildSessionContext([...pathEntries, simulatedCompactionEntry], simulatedCompactionEntry.id).messages;
+        let simulatedMessages = buildSessionContext([...pathEntries, simulatedCompactionEntry], simulatedCompactionEntry.id).messages;
+        // Size the same retained context that will be admitted to Cursor. Persisted JSONL
+        // remains verbatim, but the in-memory request representation is bounded first.
+        if (model.provider === "cursor" || model.provider === "cursor-cli-oauth") {
+            simulatedMessages = truncateToolResultBodies(simulatedMessages).messages ?? simulatedMessages;
+        }
         const contextTokens = estimateMessagesTokens(filterContextExcludedMessages(simulatedMessages));
         const settings = this.settingsManager.getCompactionSettings();
         return contextTokens > model.contextWindow - settings.reserveTokens;
@@ -4236,6 +4482,9 @@ export class AgentSession {
         // also emitted with accepted:false so the compaction extension's circuit-breaker
         // bookkeeping stops being dead code; other builtin session_compact handlers guard
         // on event.accepted.
+        if (rejectionCause === "external-owner" && this.model) {
+            this._delegatedCompactionKey = { provider: this.model.provider, id: this.model.id };
+        }
         const trimmedExtensionReason = extensionReason?.trim();
         const detailedMessage = trimmedExtensionReason
             ? `Compaction rejected: ${trimmedExtensionReason}`
@@ -4572,15 +4821,15 @@ export class AgentSession {
         return claimant !== undefined && !claimant.signal.aborted;
     }
     _isCompactionDelegated() {
-        const state = this._compactionLifecycle.state;
         const model = this.model;
-        return (state.status === "failed" &&
-            state.rejectionCause === "external-owner" &&
-            state.model !== undefined &&
+        return (this._delegatedCompactionKey !== undefined &&
             model !== undefined &&
-            state.model.provider === model.provider);
+            this._delegatedCompactionKey.provider === model.provider &&
+            this._delegatedCompactionKey.id === model.id);
     }
     async _runPrePromptCompaction(lastAssistantMessage, skipAbortedCheck, reason = "pre_prompt", willRetry = false, allowSummaryOnly = false) {
+        if (this._isCompactionDelegated())
+            return false;
         const controller = new AbortController();
         const requestId = randomUUID();
         this._claimCompactionController(controller, "compaction");
@@ -4753,6 +5002,8 @@ export class AgentSession {
      * @returns Whether the post-run loop should call `agent.continue()`
      */
     async _runAutoCompaction(reason, willRetry) {
+        if (this._isCompactionDelegated())
+            return false;
         const finishCompactionWork = this._sessionWorkBarrier.begin();
         const agentMessagesAtStart = this.agent.state.messages.slice();
         const autoCompactionController = new AbortController();
@@ -4886,6 +5137,15 @@ export class AgentSession {
      */
     setAutoCompactionEnabled(enabled) {
         this.settingsManager.setCompactionEnabled(enabled);
+        this._emitSessionSettingsChanged();
+    }
+    _emitSessionSettingsChanged() {
+        this._emit({
+            type: "session_settings_changed",
+            steeringMode: this.steeringMode,
+            followUpMode: this.followUpMode,
+            autoCompactionEnabled: this.autoCompactionEnabled,
+        });
     }
     /** Whether auto-compaction is enabled */
     get autoCompactionEnabled() {
@@ -4983,6 +5243,7 @@ export class AgentSession {
             : undefined;
     }
     _refreshCurrentModelFromRegistry() {
+        this._delegatedCompactionKey = undefined;
         const currentModel = this.model;
         if (!currentModel) {
             return;
@@ -5307,8 +5568,11 @@ export class AgentSession {
                 }),
             })),
         ].filter((tool) => isAllowedTool(tool.definition.name));
+        // Withheld tools stay in _baseToolDefinitions (and therefore in _toolRegistry, which
+        // getRegisteredTool serves to the Cursor exec bridge) but are dropped from the model-facing
+        // definitions so they never reach the prompt. See temporarilyDisabledToolNames.
         const definitionRegistry = new Map(Array.from(this._baseToolDefinitions.entries())
-            .filter(([name]) => isAllowedTool(name))
+            .filter(([name]) => isAllowedTool(name) && !temporarilyDisabledToolNames.has(name))
             .map(([name, definition]) => [
             name,
             {
@@ -5350,13 +5614,22 @@ export class AgentSession {
             toolRegistry.set(tool.name, tool);
         }
         this._toolRegistry = toolRegistry;
+        this._publishEvalOnlyToolHints();
         const isDirectlyExposed = (name) => {
             const entry = this._toolDefinitions.get(name);
             return entry !== undefined && normalizeToolExposure(entry.definition).exposure === "direct";
         };
-        const nextActiveToolNames = (options?.activeToolNames ? [...options.activeToolNames] : [...previousActiveToolNames]).filter((name) => {
+        // A withheld tool is dropped from the DEFAULT selection only. An explicit activeToolNames
+        // request names the tool deliberately, and callers that do so (tests, SDK embedders,
+        // filesystem-policy wiring) still expect it to activate.
+        const hasExplicitActiveToolNames = options?.activeToolNames !== undefined;
+        const nextActiveToolNames = (options?.activeToolNames
+            ? [...options.activeToolNames]
+            : [...(this._requestedActiveToolNames ?? previousActiveToolNames)]).filter((name) => {
             if (!isAllowedTool(name))
                 return false;
+            if (!hasExplicitActiveToolNames && temporarilyDisabledToolNames.has(name))
+                return false;
             const previousRegistrationIds = options?.previousActiveToolRegistrationIds;
             if (!previousRegistrationIds)
                 return true;
@@ -5387,6 +5660,7 @@ export class AgentSession {
         this.setActiveToolsByName([...new Set(nextActiveToolNames)]);
     }
     _buildRuntime(options) {
+        this._delegatedCompactionKey = undefined;
         const autoResizeImages = this.settingsManager.getImageAutoResize();
         const shellCommandPrefix = this.settingsManager.getShellCommandPrefix();
         const shellPath = this.settingsManager.getShellPath();
@@ -5438,7 +5712,9 @@ export class AgentSession {
         const oldExtensionIdentities = oldExtensionRunner.getExtensionIdentities();
         const previousFlagValues = oldExtensionRunner.getFlagValues();
         const previousActiveToolRegistrationIds = new Map();
-        for (const name of this.getActiveToolNames()) {
+        // Cover withheld eval-only tools too: the rebuild drops any seeded name missing from this
+        // map, which would strand shell tools when the policy disarms during this reload.
+        for (const name of this._requestedActiveToolNames ?? this.getActiveToolNames()) {
             const entry = this._toolDefinitions.get(name);
             if (entry)
                 previousActiveToolRegistrationIds.set(name, deriveExtensionRegistrationId(entry.sourceInfo, name));
@@ -5449,6 +5725,12 @@ export class AgentSession {
         });
         time("shutdown", "reload");
         await this.settingsManager.reload();
+        this._delegatedCompactionKey = undefined;
+        // Capture the unfiltered request BEFORE the rebuild reassigns it, so a policy that
+        // disarms during this reload can still restore its withheld shell tools.
+        const requestedActiveToolNamesBeforeRebuild = [...(this._requestedActiveToolNames ?? this.getActiveToolNames())];
+        // A flag change must take effect on reload, matching documented settings hot-reload behavior.
+        this._evalOnlyToolNames = this._resolveEvalOnlyToolNames();
         this.syncQueueModesFromSettings();
         resetApiProviders();
         time("settings", "reload");
@@ -5473,7 +5755,7 @@ export class AgentSession {
         time("resources", "reload");
         try {
             this._buildRuntime({
-                activeToolNames: this.getActiveToolNames(),
+                activeToolNames: requestedActiveToolNamesBeforeRebuild,
                 flagValues: previousFlagValues,
                 includeAllExtensionTools: true,
                 previousActiveToolRegistrationIds,
@@ -6178,12 +6460,13 @@ export class AgentSession {
         try {
             const result = await executeBashWithOperations(resolvedCommand, this.sessionManager.getCwd(), options?.operations ?? createLocalBashOperations({ shellPath }), {
                 onChunk: (delta) => {
-                    onChunk?.(delta);
+                    const callbackResult = onChunk?.(delta);
                     this._emit({
                         type: "bash_execution_update",
                         id: options?.id,
                         delta,
                     });
+                    return callbackResult;
                 },
                 signal: abortController.signal,
             });
@@ -6231,6 +6514,10 @@ export class AgentSession {
             abortController.abort();
         }
     }
+    /** Remove a host-owned full-output spill after a remote observer failed. */
+    async cleanupBashOutput(path) {
+        await rm(path, { force: true });
+    }
     /** Whether a bash command is currently running */
     get isBashRunning() {
         return this._bashAbortControllers.size > 0;
@@ -6432,6 +6719,7 @@ export class AgentSession {
             }
             // Update agent state (preserving exact messages still awaiting persistence)
             this._restoreAgentMessagesFromSession();
+            this._delegatedCompactionKey = undefined;
             this._incrementMessageRevision();
             // Emit session_tree event
             await this._extensionRunner.emit({