@genesislcap/ai-assistant 15.10.3 → 15.10.5

package/src/main/main.ts

@@ -1232,6 +1232,23 @@ export class FoundationAiAssistant extends GenesisElement {
   ): void {
     if (reason !== 'budget-exhausted') return;
     const vendor = vendorTypeOfLabel(budget?.vendorLabel) ?? budget?.vendor ?? vendorHint;
+    // Meter feed (GENC-1464): snap this vendor's meter to the figures the 402
+    // itself reported, the moment the wall lands. Hosts refresh the meter on
+    // `tool-loop-end`, and a walled turn may never reach one — the user then
+    // stares at the pre-turn figures next to a banner saying the budget is gone
+    // until something else ends a loop (observed live: the meter only caught up
+    // when the user cancelled the stuck interaction). Deliberately NOT under the
+    // per-vendor idempotence guard below, for the same reason as the sweep: a
+    // later 402 for an already-walled vendor carries fresher spend. Both figures
+    // are required (`VendorBudgetFigures` is total, and half a meter is a lie),
+    // and the write goes through the captured `ref` like every other write here,
+    // so a teardown race cannot land it in a new session's store.
+    if (vendor && vendor !== 'none' && budget?.budgetUsd != null && budget?.spentUsd != null) {
+      ref?.actions.aiAssistant.setVendorBudget({
+        vendor,
+        figures: { budgetUsd: budget.budgetUsd, spentUsd: budget.spentUsd },
+      });
+    }
     if (!vendor || vendor === 'none') {
       if (!this.blocked) {
         ref?.actions.aiAssistant.setBlocked({ blocked: true, reason: formatBlockedReason(budget) });
@@ -1362,27 +1379,29 @@ export class FoundationAiAssistant extends GenesisElement {
   }
 
   /**
-   * Copy the driver writes into the TRANSCRIPT when a turn hits the budget wall.
+   * Copy the driver writes into the TRANSCRIPT when a turn hits the budget wall,
+   * or `undefined` to let the driver compose it per wall.
    *
-   * A host-set `blockedReason` still wins, so a white-labelled host does not read
-   * its own explanation in the banner and the shipped default directly below it —
-   * that is the whole reason the driver takes this at all.
+   * A set `blockedReason` still wins — a white-labelled host must not read its
+   * own explanation in the banner and shipped copy directly below it, and the
+   * vendor-agnostic latch's `formatBlockedReason(budget)` form stays advice-free
+   * exactly as before.
    *
-   * What it deliberately is NOT is
-   * {@link FoundationAiAssistant.effectiveBlockedReason}. That getter
-   * composes advice — `"…Switch to Gemini to keep going."` — which is true only
-   * while that vendor has headroom, and the transcript is a permanent record. The
-   * driver reads this once at CONSTRUCTION, and `getOrCreateDriver` keys on the
-   * agents list, so an agents swap *after* a wall re-runs `createDriver` and would
-   * freeze that sentence into every later turn's bubble. Reading the latch's own
-   * copy instead is structurally incapable of carrying the advice: the only
-   * writer of `blockedReason` is the vendor-agnostic branch of
-   * `latchBlockedFrom`, whose `formatBlockedReason(budget)` form has no switch
-   * clause. Per-vendor copy lives in `blockedVendorReasons` and reaches the
-   * banner alone.
+   * `undefined` (the usual case) is NOT the old `DEFAULT_BUDGET_EXHAUSTED_MESSAGE`
+   * fallback: it hands composition to the driver, which builds the bubble from
+   * EACH wall's own 402 — naming the exhausted vendor and advising a switch only
+   * when that refusal's `otherVendorAvailable` positively vouched for headroom
+   * elsewhere. That is immune to the staleness this getter used to guard against
+   * by freezing the copy: construction-time advice could outlive its truth
+   * (`getOrCreateDriver` re-runs on an agents swap and would have baked the
+   * sentence into every later bubble), but per-wall advice is derived from the
+   * refusal it annotates and dies with the turn. Forcing the default here was
+   * also what made the driver's composed bubble unreachable in every real
+   * mount — the banner advised switching while the bubble under it never did
+   * (the GENC-1464 tester finding, root cause).
    */
-  private get transcriptBudgetExhaustedMessage(): string {
-    return this.blockedReason ?? DEFAULT_BUDGET_EXHAUSTED_MESSAGE;
+  private get transcriptBudgetExhaustedMessage(): string | undefined {
+    return this.blockedReason ?? undefined;
   }
 
   /**

package/src/utils/condense-history.test.ts

@@ -3,6 +3,7 @@ import { assert, createLogicSuite } from '@genesislcap/foundation-testing';
 import {
   applyCondensation,
   CONDENSE_MIN_CHARS,
+  CONDENSED_ARGS_KEY,
   type CondenseContext,
   type CondensedEventDetail,
   type RegisteredCondensePolicy,
@@ -193,7 +194,15 @@ suite('drop / pointer / replaceWith produce distinct collapsed forms', () => {
   const { on } = sink();
   const out = applyCondensation(history, policies, ctx(), on);
 
-  assert.is(out[1].toolResult!.content, '[elided]', 'drop is a minimal non-empty placeholder');
+  // `drop` differs from `pointer` ONLY by the restore promise — it still identifies the call,
+  // because a stub too bare to say what the call did is how GENC-1494 started.
+  assert.match(out[1].toolResult!.content, /vfs_read/, 'drop names the tool');
+  assert.match(out[1].toolResult!.content, /result elided/, 'drop says what was elided');
+  assert.not.match(
+    out[1].toolResult!.content,
+    /re-call to restore/,
+    'drop makes no restore promise',
+  );
   assert.match(
     out[5].toolResult!.content,
     /re-call to restore/,
@@ -202,7 +211,12 @@ suite('drop / pointer / replaceWith produce distinct collapsed forms', () => {
   assert.is(out[9].toolResult!.content, 'SUMMARY', 'replaceWith is verbatim — no hint appended');
 });
 
-suite('args drop yields an empty object; pointer stashes a stub under one key', () => {
+// GENC-1494: dropped args must NEVER collapse to `{}`. A bare empty object is
+// indistinguishable from a call the model made with no arguments at all, and the model
+// treats its own history as fact — a ui-builder run read its elided `vfs_write` calls as
+// proof it was writing files with no content and re-wrote them for two hours. A bare marker
+// is not enough either: `path` goes with the args, so the stub must still say WHICH file.
+suite('args drop identifies the call; pointer stashes a stub under one key', () => {
   const history: ChatMessage[] = [
     asstCall('w1', 'vfs_write', { path: 'A', content: big() }),
     toolMsg('w1', 'ok'),
@@ -215,10 +229,58 @@ suite('args drop yields an empty object; pointer stashes a stub under one key',
   ]);
   const { on } = sink();
   const out = applyCondensation(history, policies, ctx(), on);
-  assert.equal(out[0].toolCalls![0].args, {}, 'dropped args is an empty object');
+  const dropped = out[0].toolCalls![0].args;
+  const stub = String(dropped[CONDENSED_ARGS_KEY]);
+
+  assert.ok(
+    Object.keys(dropped).length > 0,
+    'dropped args are never empty — that reads as a no-argument call',
+  );
+  assert.match(stub, /vfs_write/, 'stub names the tool');
+  assert.match(stub, /\bA\b/, 'stub names the superseded key — which file this call wrote');
+  assert.not.match(stub, /re-call to restore/, 'drop must not promise a restore it cannot honour');
   assert.equal(out[2].toolCalls![0].args, { path: 'A', content: big() }, 'latest write kept');
 });
 
+// GENC-1494: trigger resolution picks the first LISTED trigger that is currently true, so it
+// used to change after the collapse — with the usual `on: [{superseded}, {agentEnd}]`, a payload
+// collapsed at `agentEnd` re-resolved to `superseded` the moment a newer same-key call landed,
+// rewriting the stub and breaking the prompt cache a second time for an already-collapsed
+// payload. In one reported session that was 22/22 args collapses and 97 response collapses.
+suite('the fired trigger is latched, so a collapsed stub is never rewritten', () => {
+  const history: ChatMessage[] = [asstCall('r1', 'vfs_read', { path: 'A' }), toolMsg('r1', big())];
+  const entry = reg({
+    on: [{ kind: 'superseded', by: 'A' }, { kind: 'agentEnd' }],
+    response: 'pointer', // pointer embeds the reason, so a re-resolve is visible in the text
+  });
+  const policies = new Map<string, RegisteredCondensePolicy>([['r1', entry]]);
+  const { events, on } = sink();
+
+  // Pass 1: the activation has ended but nothing supersedes r1 yet → collapses as agentEnd.
+  const first = applyCondensation(history, policies, ctx({ activationEnded: () => true }), on);
+  assert.match(first[1].toolResult!.content, /agent finished/, 'collapses under agentEnd');
+  assert.is(events.length, 1);
+  assert.is(events[0].trigger, 'agentEnd');
+
+  // Pass 2: a newer read of the SAME key now exists, which would re-resolve the trigger to
+  // `superseded` (it is listed first). The already-collapsed stub must not change.
+  const grown: ChatMessage[] = [
+    ...history,
+    asstCall('r2', 'vfs_read', { path: 'A' }),
+    toolMsg('r2', big()),
+  ];
+  policies.set('r2', reg({ on: { kind: 'superseded', by: 'A' }, response: 'pointer' }));
+  const second = applyCondensation(grown, policies, ctx({ activationEnded: () => true }), on);
+
+  assert.match(second[1].toolResult!.content, /agent finished/, 'reason stays pinned to agentEnd');
+  assert.not.match(second[1].toolResult!.content, /superseded/, 'must not re-resolve');
+  assert.is(
+    second[1].toolResult!.content,
+    first[1].toolResult!.content,
+    'stub text is byte-stable',
+  );
+});
+
 // ---------------------------------------------------------------------------
 // envelope + metadata invariants
 // ---------------------------------------------------------------------------

package/src/utils/condense-history.ts

@@ -56,6 +56,28 @@ export interface RegisteredCondensePolicy {
   reportedArgs?: boolean;
   /** `context.condensed` already emitted for the response payload (fire-once). */
   reportedResponse?: boolean;
+  /**
+   * The first trigger to fire for this call, latched on the pass it fired.
+   *
+   * "Fired", not "collapsed": it is written during trigger resolution, before the
+   * per-payload size floor is applied, so an entry whose payloads are all below the floor
+   * can latch without anything ever rendering. That is deliberate and safe — both payloads
+   * of a call resolve off the same clocks in the same pass, so they can never disagree
+   * about which trigger fired, and a payload's size is fixed for the life of the call
+   * (condensation never touches stored history), so a below-floor payload can never later
+   * become a large one under a stale reason.
+   *
+   * Trigger resolution picks the first LISTED trigger that is *currently* true, so without
+   * this it re-evaluates on every provider call and can change after the collapse: with the
+   * usual `on: [{superseded}, {agentEnd}]`, a payload collapsed at `agentEnd` silently
+   * re-resolves to `superseded` as soon as a newer call on the same key lands. Any stub that
+   * embeds the reason (`pointer` does) is then rewritten — an in-place history mutation that
+   * invalidates the prompt cache from that position a second time, for a payload that had
+   * already collapsed. Latching keeps the rendered stub stable, which is sound because a
+   * collapse is monotonic and never reverts, so the first trigger to fire is the correct
+   * one to keep.
+   */
+  firedTrigger?: CondenseTrigger;
 }
 
 /**
@@ -131,16 +153,27 @@ function triggerReason(trigger: CondenseTrigger): string {
   }
 }
 
-/** Framework-generated `pointer` stub — advertises that re-calling restores the content. */
+/**
+ * Framework-generated stub, shared by `pointer` and `drop`. Names the tool, the superseded key
+ * (the only surviving identifier once args are elided — the model cannot otherwise tell WHICH
+ * file a collapsed `vfs_write` wrote) and the original size.
+ *
+ * `restorable` is the ONLY difference between the two modes: `pointer` promises that re-calling
+ * reproduces the content and is valid solely for idempotent tools; `drop` makes no such promise
+ * and must not carry the clause. Identifying information is not what separates them — a stub too
+ * bare to say what the call did is how GENC-1494 started.
+ */
 function condenseStub(
   target: 'args' | 'response',
   tool: string,
   trigger: CondenseTrigger,
   origLen: number,
+  restorable: boolean,
 ): string {
   const what = target === 'args' ? 'args' : 'result';
   const key = trigger.kind === 'superseded' ? ` ${trigger.by}` : '';
-  return `[${tool}${key} — ${what} elided, ~${origLen} chars (${triggerReason(trigger)}); re-call to restore]`;
+  const restore = restorable ? '; re-call to restore' : '';
+  return `[${tool}${key} — ${what} elided, ~${origLen} chars (${triggerReason(trigger)})${restore}]`;
 }
 
 /** Stable label for the `context.condensed` meta-event's `trigger` field. */
@@ -181,10 +214,12 @@ function marksDiscontinuity(kind: CondenseTrigger['kind']): boolean {
  * Collapse stale tool payloads (declared via `condenseWhen`) out of the
  * model-bound history. Pure over the `history` array — it emits new message
  * objects and never mutates the input messages (mirroring the agent-masking
- * transform). It DOES, however, flip the `reported*` flag on the matching
- * `policies` entry the first time a payload collapses — the report-once gate that
- * keeps `onCondensed` firing once per (tool call, payload) even though the
- * collapse itself re-runs before every provider call.
+ * transform). It DOES, however, write two latches onto the matching `policies`
+ * entry the first time a payload collapses, both because the collapse itself
+ * re-runs before every provider call: the `reported*` flag (the report-once gate
+ * that keeps `onCondensed` firing once per (tool call, payload)) and
+ * `firedTrigger` (which pins the reason so a reason-bearing stub is rendered
+ * once and never rewritten).
  *
  * Triggers (a policy may list several via `on: Trigger[]` — the FIRST to fire
  * collapses the payload; all are monotonic, so the collapse never reverts):
@@ -284,14 +319,24 @@ export function applyCondensation(
 
   // The first listed trigger that fires — drives the collapse, the stub reason,
   // and the event label. `undefined` means the payload stays full.
+  //
+  // Latched on first fire (see `firedTrigger`): re-resolving on every pass lets the reason
+  // change under a payload that has already collapsed, which rewrites any reason-bearing stub
+  // and costs a second cache break. Both payloads of a call share the latch — they are
+  // evaluated in the same pass off the same clocks, so they never disagree about which
+  // trigger fired; only the size floor decides whether each one renders.
   const firstFired = (
     toolCallId: string,
     entry: RegisteredCondensePolicy,
-  ): CondenseTrigger | undefined =>
-    triggersOf(entry).find(
+  ): CondenseTrigger | undefined => {
+    if (entry.firedTrigger) return entry.firedTrigger;
+    const fired = triggersOf(entry).find(
       (t) =>
         (marksDiscontinuity(t.kind) || withinBatch(entry)) && triggerFires(toolCallId, entry, t),
     );
+    if (fired) entry.firedTrigger = fired;
+    return fired;
+  };
 
   return history.map((msg) => {
     // Tool-call ARGS live on the assistant message.
@@ -306,18 +351,24 @@ export function applyCondensation(
         if (origLen < CONDENSE_MIN_CHARS) return tc;
         changed = true;
         const result = entry.policy.args;
-        // Args must stay a Record; `drop` is an empty object, otherwise stash the
-        // stub under a single key. Spread `tc` so providerMetadata (e.g. the
-        // Gemini reasoning signature that must round-trip) and UI fields survive.
-        const args: Record<string, unknown> =
-          result === 'drop'
-            ? {}
-            : {
-                [CONDENSED_ARGS_KEY]:
-                  result === 'pointer'
-                    ? condenseStub('args', tc.name, fired, origLen)
-                    : result.replaceWith,
-              };
+        // Args must stay a Record, so every mode stashes its stub under a single key.
+        // Spread `tc` so providerMetadata (e.g. the Gemini reasoning signature that must
+        // round-trip) and UI fields survive.
+        //
+        // GENC-1494: `drop` used to collapse args to a bare `{}`. That is indistinguishable
+        // from a call the model made with NO arguments, and the model reads its own history
+        // as fact: a ui-builder run saw its elided `vfs_write` calls as `vfs_write {}` beside
+        // a live `{"status":"buffered","path":"…"}` result, concluded it was calling the tool
+        // without content, and burned two hours re-writing files that were already correct.
+        // A bare marker is not enough either — it still fails to say WHICH file the call
+        // wrote, since `path` went with the args. So `drop` renders the same identifying stub
+        // as `pointer`, minus only the restore promise it cannot honour.
+        const args: Record<string, unknown> = {
+          [CONDENSED_ARGS_KEY]:
+            result === 'drop' || result === 'pointer'
+              ? condenseStub('args', tc.name, fired, origLen, result === 'pointer')
+              : result.replaceWith,
+        };
         if (!entry.reportedArgs) {
           entry.reportedArgs = true;
           const stubLen = JSON.stringify(args).length;
@@ -350,11 +401,9 @@ export function applyCondensation(
         const result = entry.policy.response!; // `fired` is only set when response is declared
         // Kept non-empty — Anthropic rejects empty tool_result content.
         const content =
-          result === 'drop'
-            ? '[elided]'
-            : result === 'pointer'
-              ? condenseStub('response', tool, fired, origLen)
-              : result.replaceWith;
+          result === 'drop' || result === 'pointer'
+            ? condenseStub('response', tool, fired, origLen, result === 'pointer')
+            : result.replaceWith;
         if (!entry.reportedResponse) {
           entry.reportedResponse = true;
           onCondensed({