@code-yeongyu/senpi 2026.9.19 → 2026.9.20

package/dist/core/agent-session.js

@@ -50,7 +50,8 @@ import { CLAUDE_SDK_OAUTH_PROVIDER_ID } from "./extensions/builtin/claude-sdk-oa
 import { ModelUsabilityBudgetError, projectModelUsabilityBudget, } from "./extensions/builtin/compaction/model-usability-budget.js";
 import { resolveEffectiveReserveTokens, resolveReserveTokens, shouldTriggerCompaction, } from "./extensions/builtin/compaction/policy.js";
 import { createResumeCompactionRequirement, } from "./extensions/builtin/compaction/resume-admission.js";
-import { RESUME_SLICE_ORIGIN, RESUME_SLICE_SCHEMA, resumeSliceNotice, } from "./extensions/builtin/compaction/resume-slice.js";
+import { planResumeSlice, RESUME_SLICE_ORIGIN, RESUME_SLICE_SCHEMA, resumeSliceNotice, } from "./extensions/builtin/compaction/resume-slice.js";
+import { createPendingModelSwitch, pendingSwitchKeepRecentTokens, } from "./extensions/builtin/compaction/switch-admission.js";
 import { WAKE_SOURCE_STATE_EVENT } from "./extensions/builtin/monitor-state-event.js";
 import { CODEX_RESPONSES_API } from "./extensions/builtin/service-tier.js";
 import { deriveExtensionRegistrationId } from "./extensions/builtin/tool-search/engine/marker.js";
@@ -440,6 +441,8 @@ export class AgentSession {
                     modelSelectSource: reason,
                     invalidateCompaction: true,
                     ephemeralThinkingLevel: thinking,
+                    allowDeferral: false,
+                    repairWithSlice: true,
                 });
             },
             emit: (event) => this._emit(event),
@@ -1081,17 +1084,30 @@ export class AgentSession {
         this._delegatedCompactionKey = undefined;
         this._incrementMessageRevision();
     }
+    /**
+     * #1873 narrows #1378: a cycle silently passes over a candidate only when no
+     * reduction could ever make it serve. A candidate that one compaction would fix
+     * is landed on and held as a pending switch instead, because skipping it throws
+     * away the model the user was cycling towards.
+     */
     _modelChangeWouldExhaustContext(model) {
         if (model.contextWindow <= 0)
             return undefined;
+        const compaction = this._getCompactionSettings();
         const projection = projectModelUsabilityBudget({
             model,
             systemPrompt: this.agent.state.systemPrompt,
             tools: this.agent.state.tools,
             liveContextTokens: this._getDownswitchLiveContextTokens(model),
-            compaction: this._getCompactionSettings(),
+            compaction,
+            includeSpeculationLead: false,
+            admission: this._modelSwitchAdmission(),
         });
-        return projection.usable ? undefined : projection;
+        if (projection.usable)
+            return undefined;
+        if (compaction.enabled && projection.verdict === "fits-after-compaction")
+            return undefined;
+        return projection;
     }
     _getIdleWaitPromise() {
         if (!this._idleWaitPromise) {
@@ -2936,30 +2952,7 @@ export class AgentSession {
             }
             // Emit before_agent_start extension event
             const result = await this._extensionRunner.emitBeforeAgentStart(expandedText, currentImages, this._baseSystemPrompt, this._baseSystemPromptOptions);
-            // Add all custom messages from extensions
-            if (result?.messages) {
-                for (const msg of result.messages) {
-                    messages.push({
-                        role: "custom",
-                        customType: msg.customType,
-                        // Untyped extensions can pass null/missing content; normalize at ingestion.
-                        content: msg.content ?? [],
-                        display: msg.display,
-                        details: msg.details,
-                        timestamp: Date.now(),
-                    });
-                }
-            }
-            // Apply extension-modified system prompt, or reset to base
-            if (result?.systemPrompt !== undefined) {
-                this._systemPromptOverride = result.systemPrompt;
-                this.agent.state.systemPrompt = result.systemPrompt;
-            }
-            else {
-                // Ensure we're using the base prompt (in case previous turn had modifications)
-                this._systemPromptOverride = undefined;
-                this.agent.state.systemPrompt = this._baseSystemPrompt;
-            }
+            this._applyBeforeAgentStartResult(messages, result);
             // The preflight above only sees persisted session context. These prompt,
             // next-turn, and before_agent_start additions are also provider-visible,
             // so make one final admission decision against the complete request.
@@ -3008,6 +3001,31 @@ export class AgentSession {
             this._startSessionTitleGeneration(titlePrompt);
         }
     }
+    /** Apply before_agent_start additions and reset any prior turn's system-prompt override. */
+    _applyBeforeAgentStartResult(messages, result) {
+        if (result?.messages) {
+            for (const msg of result.messages) {
+                messages.push({
+                    role: "custom",
+                    customType: msg.customType,
+                    // Untyped extensions can pass null/missing content; normalize at ingestion.
+                    content: msg.content ?? [],
+                    display: msg.display,
+                    details: msg.details,
+                    timestamp: Date.now(),
+                });
+            }
+        }
+        if (result?.systemPrompt !== undefined) {
+            this._systemPromptOverride = result.systemPrompt;
+            this.agent.state.systemPrompt = result.systemPrompt;
+        }
+        else {
+            // Ensure we're using the base prompt (in case a previous turn had modifications).
+            this._systemPromptOverride = undefined;
+            this.agent.state.systemPrompt = this._baseSystemPrompt;
+        }
+    }
     /**
      * Try to execute an extension command. Returns true if command was found and executed.
      */
@@ -3384,24 +3402,43 @@ export class AgentSession {
                 }
             }
             else if (options?.triggerTurn) {
+                finishSessionWork ??= this._sessionWorkBarrier.begin();
+                const messages = [appMessage];
+                const queueTriggerForLater = () => {
+                    if (options.deliverAs === "followUp") {
+                        this.agent.followUp(appMessage);
+                    }
+                    else {
+                        this.agent.steer(appMessage);
+                    }
+                };
+                this._triggerTurnAdmissionAbortGeneration = userAbortGeneration;
                 try {
                     await this._enforceCompactionBeforeProvider(this._findLastAssistantMessage(), false, "pre_prompt");
-                    await this._enforceFinalProviderAdmission([appMessage]);
+                    const result = await this._extensionRunner.emitBeforeAgentStart(contentText(appMessage.content, ""), undefined, this._baseSystemPrompt, this._baseSystemPromptOptions);
+                    if (userAbortGeneration !== this._userAbortGeneration) {
+                        queueTriggerForLater();
+                        return;
+                    }
+                    this._applyBeforeAgentStartResult(messages, result);
+                    await this._enforceFinalProviderAdmission(messages);
+                    if (userAbortGeneration !== this._userAbortGeneration) {
+                        queueTriggerForLater();
+                        return;
+                    }
                 }
                 catch (error) {
                     // Mirror sendUserMessage's retention contract: an admission
                     // rejection must retain the message for later delivery instead
                     // of silently dropping it (the fire-and-forget extension action
                     // swallows this rejection).
-                    if (options.deliverAs === "followUp") {
-                        this.agent.followUp(appMessage);
-                    }
-                    else {
-                        this.agent.steer(appMessage);
-                    }
+                    queueTriggerForLater();
                     throw error;
                 }
-                await this._promptAgent(appMessage, deferredTurnClaim);
+                finally {
+                    this._triggerTurnAdmissionAbortGeneration = undefined;
+                }
+                await this._promptAgent(messages, deferredTurnClaim);
             }
             else if (this.isStreaming) {
                 this._pendingCustomMessages.push(appMessage);
@@ -3593,12 +3630,15 @@ export class AgentSession {
         // Streaming aborts are carried by agent_end provenance; only gaps need session_abort.
         const wasMidRun = this.isStreaming && this._retryAbortController === undefined;
         const hadRetryBackoff = this._retryAbortController !== undefined;
-        const hadCompactionOrPending = !this.isStreaming && (this.isCompacting || this.pendingMessageCount > 0);
+        const hasPendingTriggerTurnAdmission = this._triggerTurnAdmissionAbortGeneration === this._userAbortGeneration;
+        const hadCompactionOrPending = !this.isStreaming && (this.isCompacting || this.pendingMessageCount > 0 || hasPendingTriggerTurnAdmission);
         const hadClearedQueues = this._hadClearedQueuedMessages;
         const joinedAgentEndBoundary = this._abortProvenance.hasOpenAgentEndBoundary;
         this._hadClearedQueuedMessages = false;
         const shouldEmitAbort = !joinedAgentEndBoundary && !wasMidRun && (hadRetryBackoff || hadCompactionOrPending || hadClearedQueues);
         this.abortCompaction();
+        if (hasPendingTriggerTurnAdmission)
+            this._recordUserAbort();
         await this._abortActiveAgentAndRetry("user");
         if (!shouldEmitAbort)
             return;
@@ -3678,6 +3718,120 @@ export class AgentSession {
             throw new ModelUsabilityBudgetError(projection);
     }
     /** Admit an oversized restored transcript so the normal pre-provider compaction can run. */
+    /** The switch waiting for the next send to compact for it, if any (#1873). */
+    get pendingModelSwitch() {
+        return this._pendingModelSwitch;
+    }
+    /**
+     * A switch the target cannot hold yet but one compaction would fix. Refusing it
+     * discards what the user asked for; committing it strands the session on a model
+     * that cannot answer. Holding it does neither: nothing durable is written until
+     * the next send has reduced the transcript and the switch actually applies.
+     */
+    _projectSwitchDeferral(model, liveContextTokens) {
+        if (model.contextWindow <= 0)
+            return undefined;
+        const compaction = this._getCompactionSettings();
+        if (!compaction.enabled)
+            return undefined;
+        if (this._modelSwitchAdmission() !== "switch")
+            return undefined;
+        const projection = projectModelUsabilityBudget({
+            model,
+            systemPrompt: this.agent.state.systemPrompt,
+            tools: this.agent.state.tools,
+            liveContextTokens,
+            compaction,
+            includeSpeculationLead: false,
+            admission: "switch",
+        });
+        return projection.verdict === "fits-after-compaction" ? projection : undefined;
+    }
+    _admitSwitchCompactionRequired(model, projection, persistDefault) {
+        const pending = createPendingModelSwitch({ model, projection, persistDefault });
+        this._pendingModelSwitch = pending;
+        this._emit({
+            type: "model_change_pending",
+            model,
+            contextWindow: projection.contextWindow,
+            liveContextTokens: projection.liveContextTokens,
+            requiredTokens: projection.requiredTokens,
+            shortfallTokens: projection.shortfallTokens,
+            notice: pending.notice,
+        });
+    }
+    /**
+     * Fit a fallback rung by reducing the transcript without a provider request
+     * (#1873). Summarizing is not available here: the model being fallen back from
+     * has usually just failed, and the rung itself cannot hold the transcript, so
+     * the deterministic slice is the only reduction that can run. The recorded
+     * transcript stays intact in the session file.
+     */
+    _reduceForSwitchTarget(model, liveContextTokens) {
+        if (!this._getCompactionSettings().enabled)
+            return liveContextTokens;
+        const projection = this._projectSwitchFit(model);
+        if (projection.usable || projection.verdict !== "fits-after-compaction")
+            return liveContextTokens;
+        const plan = planResumeSlice({ entries: this.sessionManager.getBranch(), projection });
+        if (!plan)
+            return liveContextTokens;
+        this.applyResumeSlice(plan);
+        return this._projectSwitchFit(model).liveContextTokens;
+    }
+    _projectSwitchFit(model) {
+        // Measured per message rather than through the context estimate: a retained
+        // turn keeps the usage it reported before the reduction, so a usage-derived
+        // total cannot observe the compaction that just ran (the sdk.ts convention).
+        const liveContextTokens = filterContextExcludedMessages(this.sessionManager.buildSessionContext().messages).reduce((total, message) => total + estimateTokens(message), 0);
+        return projectModelUsabilityBudget({
+            model,
+            systemPrompt: this.agent.state.systemPrompt,
+            tools: this.agent.state.tools,
+            liveContextTokens,
+            compaction: this._getCompactionSettings(),
+            includeSpeculationLead: false,
+            admission: "switch",
+        });
+    }
+    /**
+     * Repair and apply a held switch, in the one order that works: the model that
+     * can still hold the transcript writes the summary, the reduction aims at the
+     * window the transcript must end up inside, and only a transcript that actually
+     * fits is allowed to carry the switch. The deterministic slice is the floor when
+     * summarization did not get there, so a repairable switch cannot strand itself.
+     */
+    async _applyPendingModelSwitch(assistantMessage, skipAbortedCheck, inlineReason) {
+        const pending = this._pendingModelSwitch;
+        if (pending === undefined)
+            return false;
+        if (!this.model)
+            throw new RequiredCompactionError();
+        await this._runPrePromptCompaction(assistantMessage, skipAbortedCheck, inlineReason, false, false, pendingSwitchKeepRecentTokens(pending.projection));
+        let projection = this._projectSwitchFit(pending.model);
+        if (!projection.usable) {
+            const plan = planResumeSlice({ entries: this.sessionManager.getBranch(), projection });
+            if (plan) {
+                this.applyResumeSlice(plan);
+                projection = this._projectSwitchFit(pending.model);
+            }
+        }
+        this._pendingModelSwitch = undefined;
+        if (!projection.usable) {
+            const error = new ModelUsabilityBudgetError(projection);
+            this._recordRejectedModelChange(pending.model, error);
+            throw error;
+        }
+        await this._switchActiveModel(pending.model, {
+            persistDefault: pending.persistDefault,
+            appendSessionEntry: true,
+            emitModelSelect: true,
+            modelSelectSource: "set",
+            invalidateCompaction: true,
+            allowDeferral: false,
+        });
+        return true;
+    }
     admitResumeCompactionRequired(projection) {
         this._resumeCompactionRequirement = createResumeCompactionRequirement(projection);
     }
@@ -3783,8 +3937,17 @@ export class AgentSession {
      * observable on one path and invisible on its sibling.
      */
     _assertModelUsableForSwitch(model, liveContextTokens) {
+        const admission = this._modelSwitchAdmission();
         try {
-            this.assertModelUsable(model, liveContextTokens, { admission: this._modelSwitchAdmission() });
+            // #1873: a live switch only has to fit the next single request. Speculation
+            // runs after the switch is admitted and cannot shrink a transcript it has not
+            // been admitted to yet - the reasoning #1339 applied to resume, which this
+            // extends to the switch path. The cold-start floor (`start`) keeps charging
+            // the lead, because there it is a property of the model, not of a transcript.
+            this.assertModelUsable(model, liveContextTokens, {
+                admission,
+                includeSpeculationLead: admission === "start",
+            });
         }
         catch (error) {
             this._recordRejectedModelChange(model, error);
@@ -3792,12 +3955,23 @@ export class AgentSession {
         }
     }
     async _setModel(model, updateGlobalDefaults) {
-        this._assertModelUsableForSwitch(model, this._getDownswitchLiveContextTokens(model));
+        const liveContextTokens = this._getDownswitchLiveContextTokens(model);
+        const deferral = this._projectSwitchDeferral(model, liveContextTokens);
+        if (deferral === undefined) {
+            this._assertModelUsableForSwitch(model, liveContextTokens);
+        }
         if (!(await this._modelRuntime.checkAuth(model.provider))) {
             const error = new Error(`No API key for ${model.provider}/${model.id}`);
             this._recordRejectedModelChange(model, error);
             throw error;
         }
+        // Auth is the last check that can refuse outright, so the switch is only held
+        // once it is otherwise good: a pending switch to a model with no key would
+        // surface its failure a whole message later.
+        if (deferral !== undefined) {
+            this._admitSwitchCompactionRequired(model, deferral, updateGlobalDefaults);
+            return undefined;
+        }
         // A manual model change abandons any active fallback window; if a fallback
         // retry sleep is still pending, cancel it so no surprise continuation fires.
         const hadActiveFallback = this._retryFallback.activeState !== undefined;
@@ -3844,6 +4018,11 @@ export class AgentSession {
         }
         const thinking = this._getThinkingForModelSwitch(model, opts.ephemeralThinkingLevel);
         const liveContextTokens = this._getDownswitchLiveContextTokens(model);
+        // Snapshot before any mutation: the baseline reset below used to run first, so the
+        // "previous" value captured the already-cleared one and a refused switch restored
+        // `undefined` instead of the baseline the session came in with.
+        const previousReasoningBaseline = this.agent.state.reasoningBaseline;
+        const previousAbortServerSideFallback = this.agent.abortServerSideFallback;
         this.agent.state.model = model;
         if (!(model.id === "gpt-6-astra" && (model.provider === "openai" || model.provider === "openai-codex"))) {
             this.agent.state.reasoningBaseline = undefined;
@@ -3853,8 +4032,6 @@ export class AgentSession {
         const previousFastMode = this.isFastModeActive();
         const previousThinkingLevel = this.agent.state.thinkingLevel;
         const previousThinkingSelection = this.agent.state.thinkingSelection;
-        const previousReasoningBaseline = this.agent.state.reasoningBaseline;
-        const previousAbortServerSideFallback = this.agent.abortServerSideFallback;
         this.agent.abortServerSideFallback =
             this.settingsManager.getAbortServerSideFallback() && this._retryFallback.hasConfiguredChain();
         this._currentServiceTier = this._resolveServiceTier(model, scopedMatch?.serviceTier);
@@ -3870,12 +4047,35 @@ export class AgentSession {
             const systemPromptChange = opts.emitModelSelect
                 ? await this._emitModelSelect(model, previousModel, opts.modelSelectSource)
                 : undefined;
-            this._assertModelUsableForSwitch(model, liveContextTokens);
+            const deferral = opts.allowDeferral === false ? undefined : this._projectSwitchDeferral(model, liveContextTokens);
+            if (deferral !== undefined) {
+                // Roll the in-memory selection back: the switch is held, not applied, so
+                // nothing may observe the target as active until the next send repairs it.
+                if (previousModel)
+                    this.agent.state.model = previousModel;
+                this.agent.state.systemPrompt = previousSystemPrompt;
+                this.agent.state.thinkingLevel = previousThinkingLevel;
+                this.agent.state.thinkingSelection = previousThinkingSelection;
+                this.agent.state.reasoningBaseline = previousReasoningBaseline;
+                this.agent.abortServerSideFallback = previousAbortServerSideFallback;
+                this._currentServiceTier = previousTier;
+                this._admitSwitchCompactionRequired(model, deferral, opts.persistDefault);
+                return undefined;
+            }
+            const admittedLiveContextTokens = opts.repairWithSlice
+                ? this._reduceForSwitchTarget(model, liveContextTokens)
+                : liveContextTokens;
+            this._assertModelUsableForSwitch(model, admittedLiveContextTokens);
             if (opts.appendSessionEntry) {
                 this.sessionManager.appendModelChange(model.provider, model.id, opts.entryReason, previousModel?.provider, previousModel?.id);
             }
             if (opts.persistDefault)
                 this.settingsManager.setDefaultModelAndProvider(model.provider, model.id);
+            // A switch that actually landed supersedes anything still being held (#1873).
+            // Without this a held switch survives its own resolution - an explicit
+            // /compact followed by a manual retry applies the switch here, and the stale
+            // hold would compact and re-switch again on the next message.
+            this._pendingModelSwitch = undefined;
             // Emit only after all admission hooks have accepted the candidate.
             this._emit({
                 type: "model_changed",
@@ -3970,7 +4170,14 @@ export class AgentSession {
             const alternatives = favoriteModels.filter((entry) => !modelsAreEqual(entry.model, currentModel));
             const onlyAlternative = alternatives.length === 1 ? alternatives[0] : undefined;
             if (onlyAlternative) {
-                this._assertModelUsableForSwitch(onlyAlternative.model, this._getDownswitchLiveContextTokens(onlyAlternative.model));
+                const onlyLiveContextTokens = this._getDownswitchLiveContextTokens(onlyAlternative.model);
+                const onlyDeferral = this._projectSwitchDeferral(onlyAlternative.model, onlyLiveContextTokens);
+                if (onlyDeferral !== undefined) {
+                    this._admitSwitchCompactionRequired(onlyAlternative.model, onlyDeferral, true);
+                }
+                else {
+                    this._assertModelUsableForSwitch(onlyAlternative.model, onlyLiveContextTokens);
+                }
             }
             return {
                 model: currentModel,
@@ -3981,6 +4188,18 @@ export class AgentSession {
         }
         const next = favoriteModels[selectedIndex];
         const liveContextTokens = this._getDownswitchLiveContextTokens(next.model);
+        // #1873: the cycle lands on a candidate one compaction would admit instead of
+        // refusing it. Nothing is mutated yet, so holding here needs no rollback.
+        const cycleDeferral = this._projectSwitchDeferral(next.model, liveContextTokens);
+        if (cycleDeferral !== undefined) {
+            this._admitSwitchCompactionRequired(next.model, cycleDeferral, true);
+            return {
+                model: currentModel,
+                thinkingLevel: this.thinkingLevel,
+                isScoped: true,
+                skippedModels,
+            };
+        }
         this._assertModelUsableForSwitch(next.model, liveContextTokens);
         const invalidatesCompaction = this._modelSelectionChangesContext(currentModel, next.model) ||
             currentModel?.provider !== next.model.provider ||
@@ -4005,9 +4224,29 @@ export class AgentSession {
             // default - may be written before this guard accepts, or a refused cycle
             // would resume on a model that never ran (the ordering `_switchActiveModel`
             // already uses).
+            // #1873: a prompt that only grew past the budget is held, not refused; the
+            // in-memory selection rolls back exactly as the catch below would.
+            const postHookDeferral = this._projectSwitchDeferral(next.model, liveContextTokens);
+            if (postHookDeferral !== undefined) {
+                if (currentModel)
+                    this.agent.state.model = currentModel;
+                this.agent.state.systemPrompt = previousSystemPrompt;
+                this._currentServiceTier = previousTier;
+                this._admitSwitchCompactionRequired(next.model, postHookDeferral, true);
+                return {
+                    model: currentModel,
+                    thinkingLevel: this.thinkingLevel,
+                    isScoped: true,
+                    skippedModels,
+                };
+            }
             this._assertModelUsableForSwitch(next.model, liveContextTokens);
             this.sessionManager.appendModelChange(next.model.provider, next.model.id);
             this.settingsManager.setDefaultModelAndProvider(next.model.provider, next.model.id);
+            // #1873: the cycle commits here rather than through `_switchActiveModel`, so it
+            // has to supersede a held switch itself - otherwise cycling onto a model that
+            // fits leaves an older hold to reclaim the session on the next message.
+            this._pendingModelSwitch = undefined;
             // Post-switch, same contract as _switchActiveModel: the level in force AFTER the cycle.
             this._emit({
                 type: "model_changed",
@@ -4638,7 +4877,10 @@ export class AgentSession {
                 throw new CompactionCancelledError();
             }
             const pathEntries = this.sessionManager.getBranch();
-            const settings = cursorOverflowCompactionSettings(this._getCompactionSettings(), this.model?.provider, request.reason);
+            const resolvedSettings = this._getCompactionSettings();
+            const settings = cursorOverflowCompactionSettings(request.keepRecentTokensOverride === undefined
+                ? resolvedSettings
+                : { ...resolvedSettings, keepRecentTokens: request.keepRecentTokensOverride }, this.model?.provider, request.reason);
             let compactionResult = request.precomputed;
             let fromExtension = request.precomputed !== undefined;
             if (!compactionResult) {
@@ -4965,6 +5207,9 @@ export class AgentSession {
         }
         const settings = this._getCompactionSettings();
         const model = this.model;
+        if (this._pendingModelSwitch !== undefined) {
+            return await this._applyPendingModelSwitch(assistantMessage, skipAbortedCheck, inlineReason);
+        }
         if (this._resumeCompactionRequirement !== undefined) {
             if (!model)
                 throw new RequiredCompactionError();
@@ -5281,7 +5526,7 @@ export class AgentSession {
             this._delegatedCompactionKey.provider === model.provider &&
             this._delegatedCompactionKey.id === model.id);
     }
-    async _runPrePromptCompaction(lastAssistantMessage, skipAbortedCheck, reason = "pre_prompt", willRetry = false, allowSummaryOnly = false) {
+    async _runPrePromptCompaction(lastAssistantMessage, skipAbortedCheck, reason = "pre_prompt", willRetry = false, allowSummaryOnly = false, keepRecentTokensOverride) {
         if (this._isCompactionDelegated())
             return false;
         const controller = new AbortController();
@@ -5298,6 +5543,7 @@ export class AgentSession {
                 lastAssistantMessage,
                 skipAbortedCheck,
                 allowSummaryOnly,
+                keepRecentTokensOverride,
             });
             if (!execution.accepted &&
                 lastAssistantMessage &&