@giovannijecha/jecode 0.7.1 → 0.7.3

package/README.md

@@ -168,7 +168,7 @@ Type `/` to open searchable command completion inside the composer.
 | `/providers` | Manage provider connections, API keys, ChatGPT sign-in, and Ollama endpoints |
 | `/models` | Search all currently usable provider catalogues and select a model |
 | `/permissions` | Change session tool access and review remembered approvals |
-| `/timeline` | Browse completed turns and select where the next branch should begin |
+| `/timeline` | Browse resumable turns and select where the next branch should begin |
 | `/compact` | Compact the current branch context without deleting saved conversation history |
 | `/new` | Start a new conversation and reset session tool permissions |
 | `/export` | Save a timestamped Markdown transcript in the launch directory |
@@ -203,13 +203,16 @@ the resume picker until it has a settled turn. Resuming and continuing a
 conversation keeps its durable session identity and updates one picker entry
 instead of creating duplicates.
 
-`/timeline` shows completed turns in the conversation tree. Selecting an older
-turn changes only the in-memory path: it creates and saves a branch only after
-the next real user message. Cancelling the picker or exiting before that message
-leaves the durable head unchanged. Historical tools are displayed but never
-executed. If a crash interrupted a tool loop, Jecode resumes from the latest
-completed ancestor and lets the next user turn create a branch. `/export`
-writes only the currently selected path.
+`/timeline` shows completed, failed, and interrupted turns in the conversation
+tree. Selecting an older turn changes only the in-memory path: it creates and
+saves a branch only after the next real user message. Cancelling the picker or
+exiting before that message leaves the durable head unchanged. A failed turn
+keeps the same partial evidence and outcome in the live transcript, export, and
+resume, while the next model receives a neutral failure boundary instead of
+incomplete streamed text. Historical tools are displayed but never executed.
+If a process stops abruptly inside a tool loop, Jecode resumes from the latest
+safe ancestor and lets the next user turn create a branch. `/export` writes
+only the currently selected path.
 
 When model-facing context approaches the selected model's usable capacity,
 Jecode asks the provider for a bounded summary of the older prefix and keeps
@@ -250,7 +253,7 @@ settings, then built-in defaults.
 | `--ollama-host` | `OLLAMA_HOST` | Cloud with an Ollama key, local without one |
 | `--root` | - | Current directory |
 | `--effort` | `JECODE_EFFORT` | `high` |
-| `--max-tokens` | `JECODE_MAX_TOKENS` | `64000`; not sent by `openai-codex` |
+| `--max-tokens` | `JECODE_MAX_TOKENS` | `64000` ceiling, clamped to the usable request budget; not sent by `openai-codex` |
 | `--max-steps` | `JECODE_MAX_STEPS` | `40` |
 | `--compaction-percent` | `JECODE_COMPACTION_PERCENT` | `85`; accepts `50` through `95` |
 | `--reduced-motion` | `JECODE_REDUCED_MOTION=1` | Off |
@@ -272,8 +275,8 @@ Jecode treats model output, workspace content, tool output, and terminal text as
 untrusted data.
 
 - Current filesystem tools are confined to the selected workspace. Writes
-  reject symlink and junction components, revalidate boundaries, and use atomic
-  replacement.
+  reject symlink and junction components, revalidate boundaries and the
+  approved file state immediately before atomic replacement.
 - Dangerous tools ask by default unless explicitly allowed for the session or
   the process starts with `--auto-approve`.
 - Credential fields are masked and excluded from transcripts. Recognized
@@ -289,8 +292,9 @@ untrusted data.
 - Provider handshakes and idle response bodies have finite deadlines. Only
   idempotent catalogue reads retry; generation requests are never replayed.
 - Model, terminal, and filesystem input are bounded before use.
-- Session files are versioned, size-bounded, atomically checkpointed, and
-  treated as untrusted when loaded. A live lease prevents concurrent resume.
+- Session files are versioned, symmetrically size-bounded before write and
+  after read, atomically checkpointed, and treated as untrusted when loaded. A
+  live lease prevents concurrent resume.
 
 `run_command` is not an operating-system sandbox. An approved command can still
 access files and account resources available to the current user. Review
@@ -339,8 +343,9 @@ npm run check
 ```
 
 Use `npm run tui:lab` to inspect production TUI components with inert local
-fixtures, and `npm run bench:transcript` for a manual long-session rendering
-probe. Architecture and security boundaries are documented in
+fixtures. `npm run bench:transcript` and `npm run bench:search` provide manual
+probes for long-session rendering and workspace search. Architecture and
+security boundaries are documented in
 [docs/architecture.md](docs/architecture.md); brand assets and usage rules live
 in [docs/brand.md](docs/brand.md).
 

package/dist/batch.js

@@ -8,7 +8,7 @@ import { runTurn } from "./controller.js";
 import { resolveContextPolicy } from "./context/capacity.js";
 import { compactContext } from "./context/compactor.js";
 import { compactSession } from "./context/manual.js";
-import { isContextOverflow, shouldResolveContextPolicy } from "./context/policy.js";
+import { isContextOverflow } from "./context/policy.js";
 import { handleCommand } from "./commands.js";
 import { renderBatch } from "./batch-view.js";
 import { columns } from "./ui/render.js";
@@ -45,7 +45,13 @@ export async function runBatch(session, environment = {}) {
             const prospectiveNodeId = session.conversation.nodes.length + 1;
             let nodeId;
             let context;
-            let contextPolicy;
+            const policy = () => {
+                return resolveContextPolicy({
+                    provider: session.provider,
+                    model: session.model,
+                    compactionPercent: session.config.compactionPercent,
+                });
+            };
             const user = { role: "user", content: [{ kind: "text", text: line }] };
             history.push(user);
             modelHistory.push(structuredClone(user));
@@ -66,19 +72,12 @@ export async function runBatch(session, environment = {}) {
                 }, settlement);
                 nodeId = session.conversation.activeNodeId;
             };
-            const compact = async (checkpoint, projected, reason, error) => {
-                if (reason === "overflow" && (error === undefined || !isContextOverflow(error))) {
-                    return undefined;
-                }
-                const force = reason === "overflow";
-                if (!shouldResolveContextPolicy(projected, session.usage.lastInputTokens, force)) {
+            const compact = async (checkpoint, projected, request) => {
+                if (request.reason === "overflow" &&
+                    (request.error === undefined || !isContextOverflow(request.error))) {
                     return undefined;
                 }
-                contextPolicy ??= resolveContextPolicy({
-                    provider: session.provider,
-                    model: session.model,
-                    compactionPercent: session.config.compactionPercent,
-                });
+                const force = request.reason === "overflow";
                 const result = await compactContext({
                     provider: session.provider,
                     model: session.model,
@@ -87,9 +86,9 @@ export async function runBatch(session, environment = {}) {
                     turn: checkpoint.slice(before),
                     nodeId: nodeId ?? prospectiveNodeId,
                     coveredMessages: context?.messageCount ?? 0,
-                    lastInputTokens: session.usage.lastInputTokens,
+                    lastInputTokens: Math.max(session.usage.lastInputTokens, request.inputTokens),
                     force,
-                    policy: await contextPolicy,
+                    policy: request.policy,
                 });
                 if (result === undefined)
                     return undefined;
@@ -101,12 +100,16 @@ export async function runBatch(session, environment = {}) {
             turn.onContext = compact;
             turn.onCheckpoint = async (checkpoint, settlement, projected) => {
                 commit(checkpoint, settlement);
-                const compacted = await compact(checkpoint, projected, "budget");
+                const compacted = await compact(checkpoint, projected, {
+                    reason: "budget",
+                    policy: await policy(),
+                    inputTokens: session.usage.lastInputTokens,
+                });
                 if (compacted !== undefined)
                     commit(checkpoint, settlement);
                 return compacted;
             };
-            await runTurn(history, options(session), turn, undefined, modelHistory);
+            await runTurn(history, options(session, policy), turn, undefined, modelHistory);
             turn.flush();
         }
     }
@@ -114,13 +117,14 @@ export async function runBatch(session, environment = {}) {
         rl?.close();
     }
 }
-function options(session) {
+function options(session, contextPolicy) {
     return {
         provider: session.provider,
         tools: session.tools,
         model: session.model,
         system: session.system,
         maxTokens: session.config.maxTokens,
+        contextPolicy,
         effort: session.config.effort,
         maxSteps: session.config.maxSteps,
         toolContext: { root: session.config.root },

package/dist/cli-info.js

@@ -18,7 +18,7 @@ Options:
   --max-steps <number>   tool-loop ceiling
   --compaction-percent <${MIN_COMPACTION_PERCENT}-${MAX_COMPACTION_PERCENT}>
                           context usage that triggers compaction (default: ${DEFAULT_COMPACTION_PERCENT})
-  --reduced-motion       disable animated terminal states
+  --reduced-motion       use a steady terminal cursor
   --auto-approve         allow dangerous tools for this process
   --ephemeral            do not save this conversation
   --latest               resume the newest session without a picker

package/dist/config.js

@@ -69,8 +69,9 @@ function optional(flag, env, fallback) {
 }
 function toInt(value, name) {
     const n = Number(value);
-    if (!Number.isInteger(n) || n <= 0)
-        throw new Error(`--${name} must be a positive integer`);
+    if (!Number.isSafeInteger(n) || n <= 0) {
+        throw new Error(`--${name} must be a positive safe integer`);
+    }
     return n;
 }
 function toPercent(value) {

package/dist/context/budget.js

@@ -0,0 +1,37 @@
+// Conservative provider-neutral budgeting for one complete model request.
+import { estimateSerializedTokens } from "./estimate.js";
+import { MIN_REQUEST_OUTPUT_TOKENS } from "./policy.js";
+const ENVELOPE_OVERHEAD_TOKENS = 64;
+const MESSAGE_OVERHEAD_TOKENS = 8;
+const TOOL_OVERHEAD_TOKENS = 16;
+/** Include system text and tool schemas instead of measuring conversation alone. */
+export function estimateRequestInputTokens(envelope) {
+    const contentTokens = estimateSerializedTokens({
+        system: envelope.system,
+        messages: envelope.messages,
+        tools: envelope.tools,
+    });
+    return contentTokens +
+        ENVELOPE_OVERHEAD_TOKENS +
+        envelope.messages.length * MESSAGE_OVERHEAD_TOKENS +
+        envelope.tools.length * TOOL_OVERHEAD_TOKENS;
+}
+/** Clamp the configured output ceiling so the complete request remains usable. */
+export function budgetRequest(envelope, configuredMaxOutputTokens, policy) {
+    if (!Number.isSafeInteger(configuredMaxOutputTokens) || configuredMaxOutputTokens <= 0) {
+        throw new Error("max output tokens must be a positive safe integer");
+    }
+    const inputTokens = estimateRequestInputTokens(envelope);
+    const available = policy.requestLimitTokens - inputTokens;
+    const minimum = Math.min(configuredMaxOutputTokens, MIN_REQUEST_OUTPUT_TOKENS);
+    if (available < minimum) {
+        throw new Error(`request input needs approximately ${inputTokens} tokens, leaving ` +
+            `${Math.max(0, available)} of the ${policy.requestLimitTokens}-token safe request budget; ` +
+            `at least ${minimum} output tokens are required`);
+    }
+    return Object.freeze({
+        inputTokens,
+        maxOutputTokens: Math.min(configuredMaxOutputTokens, available),
+        limitTokens: policy.requestLimitTokens,
+    });
+}

package/dist/context/compactor.js

@@ -1,4 +1,5 @@
 // One bounded provider request that condenses an older context prefix.
+import { budgetRequest } from "./budget.js";
 import { CONTEXT_LIMITS, summaryMessage } from "./projection.js";
 import { planCompaction } from "./policy.js";
 const SUMMARY_SYSTEM = [
@@ -17,12 +18,18 @@ export async function compactContext(options) {
         return undefined;
     options.onBegin?.();
     try {
+        const messages = normalized(plan.prefix);
+        const budget = budgetRequest({
+            system: SUMMARY_SYSTEM,
+            messages,
+            tools: [],
+        }, policy.summaryMaxTokens, policy);
         const response = await options.provider.send({
             model: options.model,
             system: SUMMARY_SYSTEM,
-            messages: normalized(plan.prefix),
+            messages,
             tools: [],
-            maxTokens: policy.summaryMaxTokens,
+            maxTokens: budget.maxOutputTokens,
             effort: options.effort,
             signal: options.signal,
         });

package/dist/context/estimate.js

@@ -0,0 +1,31 @@
+// One provider-neutral estimate shared by compaction and request budgeting.
+import { constants, deflateRawSync } from "node:zlib";
+const BYTES_PER_TOKEN = 3;
+const COMPRESSED_BYTES_PER_TOKEN = 5 / 6;
+export function estimateSerializedTokens(value) {
+    const serialized = Buffer.from(JSON.stringify(value), "utf8");
+    const compressedBytes = deflateRawSync(serialized, {
+        level: constants.Z_BEST_SPEED,
+    }).byteLength;
+    const literalTokens = literalTokenFloor(serialized);
+    // Normal prose and source code retain the established byte floor. Data that
+    // compresses poorly approaches the byte-fallback ceiling used by modern
+    // tokenizers. Non-ASCII bytes and punctuation retain a separate literal
+    // floor, including when repeated input compresses unusually well.
+    return Math.min(serialized.byteLength, Math.max(Math.ceil(serialized.byteLength / BYTES_PER_TOKEN), Math.ceil(compressedBytes / COMPRESSED_BYTES_PER_TOKEN), literalTokens));
+}
+function literalTokenFloor(serialized) {
+    let compactableAscii = 0;
+    let literalBytes = 0;
+    for (const byte of serialized) {
+        if ((byte >= 48 && byte <= 57) ||
+            (byte >= 65 && byte <= 90) ||
+            (byte >= 97 && byte <= 122)) {
+            compactableAscii++;
+        }
+        else {
+            literalBytes++;
+        }
+    }
+    return literalBytes + Math.ceil(compactableAscii / BYTES_PER_TOKEN);
+}

package/dist/context/manual.js

@@ -62,6 +62,7 @@ export async function compactSession(session, options = {}) {
         messages: active.messages,
         blocks: active.blocks,
         context: result.anchor,
+        ...(active.failure === undefined ? {} : { failure: active.failure }),
     }, active.settlement);
     await session.persistence?.checkpoint(next);
     session.conversation = next;

package/dist/context/policy.js

@@ -1,9 +1,11 @@
 // Provider-neutral context pressure and safe compaction boundaries.
+import { estimateSerializedTokens } from "./estimate.js";
 export const DEFAULT_COMPACTION_PERCENT = 85;
 export const MIN_COMPACTION_PERCENT = 50;
 export const MAX_COMPACTION_PERCENT = 95;
-export const CONTEXT_CAPACITY_PROBE_TOKENS = 16_000;
 export const FALLBACK_CONTEXT_WINDOW_TOKENS = 200_000;
+export const REQUEST_ESTIMATE_HEADROOM_PERCENT = 5;
+export const MIN_REQUEST_OUTPUT_TOKENS = 256;
 export function planCompaction(context, turn, coveredMessages, lastInputTokens, force, policy) {
     if (!validPolicy(policy) || coveredMessages < 0 || coveredMessages > turn.length)
         return undefined;
@@ -39,9 +41,6 @@ export function planCompaction(context, turn, coveredMessages, lastInputTokens,
         messageCount: boundary,
     };
 }
-export function shouldResolveContextPolicy(context, lastInputTokens, force = false) {
-    return force || Math.max(estimateTokens(context), lastInputTokens) >= CONTEXT_CAPACITY_PROBE_TOKENS;
-}
 export function policyForContextWindow(context, compactionPercent) {
     const windowTokens = validWindow(context?.tokens)
         ? context.tokens
@@ -52,12 +51,15 @@ export function policyForContextWindow(context, compactionPercent) {
     const percentageLimit = Math.floor(windowTokens * percent / 100);
     const providerLimit = validWindow(context?.compactAtTokens)
         ? context.compactAtTokens
-        : percentageLimit;
-    const triggerTokens = Math.min(percentageLimit, providerLimit, windowTokens);
+        : windowTokens;
+    const requestLimitTokens = Math.floor(Math.min(providerLimit, windowTokens) * (100 - REQUEST_ESTIMATE_HEADROOM_PERCENT) / 100);
+    const triggerTokens = Math.min(percentageLimit, requestLimitTokens - MIN_REQUEST_OUTPUT_TOKENS);
     const targetTokens = Math.max(512, Math.min(Math.floor(windowTokens / 4), Math.floor(triggerTokens / 2)));
     const recentTokens = Math.max(256, Math.min(Math.floor(windowTokens / 8), Math.floor(targetTokens / 2)));
     const minimumPrefixTokens = Math.max(256, Math.min(Math.floor(windowTokens / 20), Math.floor(targetTokens / 2)));
     return Object.freeze({
+        windowTokens,
+        requestLimitTokens,
         triggerTokens,
         targetTokens,
         recentTokens,
@@ -66,8 +68,7 @@ export function policyForContextWindow(context, compactionPercent) {
     });
 }
 export function estimateTokens(messages) {
-    const bytes = Buffer.byteLength(JSON.stringify(messages), "utf8");
-    return Math.ceil(bytes / 3) + messages.length * 8;
+    return estimateSerializedTokens(messages) + messages.length * 8;
 }
 export function isContextOverflow(error) {
     const candidate = error;
@@ -108,6 +109,8 @@ function safeBoundary(turn, index) {
 }
 function validPolicy(policy) {
     return Object.values(policy).every((value) => Number.isSafeInteger(value) && value > 0) &&
+        policy.requestLimitTokens <= policy.windowTokens &&
+        policy.triggerTokens <= policy.requestLimitTokens &&
         policy.targetTokens < policy.triggerTokens && policy.recentTokens < policy.triggerTokens;
 }
 function validWindow(value) {

package/dist/controller-request.js

@@ -1,16 +1,24 @@
 // One streamed provider request with a single safe context-overflow recovery.
+import { budgetRequest, estimateRequestInputTokens } from "./context/budget.js";
+import { isContextOverflow } from "./context/policy.js";
 export async function requestAssistant(history, current, specs, options, events, signal) {
-    const prepared = await events.onContext?.(history, current, "budget");
+    let policy = await options.contextPolicy();
+    const prepared = await prepareContext(history, current, specs, options, events, policy, "budget");
     let context = prepared === undefined ? [...current] : clone(prepared);
     let recovered = false;
     for (;;) {
+        const budget = budgetRequest({
+            system: options.system,
+            messages: context,
+            tools: specs,
+        }, options.maxTokens, policy);
         try {
             const message = await options.provider.send({
                 model: options.model,
                 system: options.system,
                 messages: context,
                 tools: specs,
-                maxTokens: options.maxTokens,
+                maxTokens: budget.maxOutputTokens,
                 effort: options.effort,
                 signal,
                 onStream: (event) => events.onStream(event),
@@ -21,7 +29,9 @@ export async function requestAssistant(history, current, specs, options, events,
         catch (error) {
             if (recovered)
                 throw error;
-            const projected = await events.onContext?.(history, context, "overflow", error);
+            if (isContextOverflow(error))
+                policy = await options.contextPolicy();
+            const projected = await prepareContext(history, context, specs, options, events, policy, "overflow", error);
             if (projected === undefined)
                 throw error;
             context = clone(projected);
@@ -29,6 +39,19 @@ export async function requestAssistant(history, current, specs, options, events,
         }
     }
 }
+async function prepareContext(history, context, specs, options, events, policy, reason, error) {
+    const inputTokens = estimateRequestInputTokens({
+        system: options.system,
+        messages: context,
+        tools: specs,
+    });
+    return events.onContext?.(history, context, {
+        reason,
+        policy,
+        inputTokens,
+        ...(error === undefined ? {} : { error }),
+    });
+}
 function clone(messages) {
     return structuredClone([...messages]);
 }

package/dist/controller.js

@@ -17,6 +17,7 @@ export const MAX_CONCURRENT_TOOL_CALLS = 4;
 export async function runTurn(history, options, events, signal, modelHistory = history) {
     const specs = toolSpecs(options.tools);
     let context = modelHistory;
+    throwIfAborted(signal);
     const append = (message) => {
         history.push(message);
         if (context !== history)

package/dist/conversation.js

@@ -5,6 +5,7 @@
 // project an older prefix before it is sent to a provider. Provider traffic
 // and live screen blocks remain prospective until a consistent checkpoint.
 import { projectContext, validContextAnchor } from "./context/projection.js";
+import { assertPersistableNode } from "./sessions/codec.js";
 export const CONVERSATION_LIMITS = Object.freeze({
     nodes: 1_024,
     messageCodeUnits: 8_388_608,
@@ -24,31 +25,25 @@ export class ConversationTree {
         return new ConversationTree([], 0);
     }
     static restore(nodes, activeNodeId) {
-        let tree = ConversationTree.empty();
+        if (nodes.length > CONVERSATION_LIMITS.nodes) {
+            throw new Error("conversation reached its session limit — start /new");
+        }
+        const restored = [];
         for (let index = 0; index < nodes.length; index++) {
             const node = nodes[index];
             if (node === undefined || node.id !== index + 1) {
                 throw new Error("session contains a non-sequential conversation node");
             }
-            tree = tree.select(node.parentId).commit({
-                parentId: node.parentId,
-                createdAt: node.createdAt,
-                identity: node.identity,
-                messages: node.messages,
-                blocks: node.blocks,
-                ...(node.context === undefined ? {} : { context: node.context }),
-            }, node.settlement);
-            const restored = tree.activeNode;
-            if (restored === undefined || restored.id !== node.id) {
-                throw new Error("session conversation could not be restored");
-            }
-            if (node.revision > 1) {
-                const copy = [...tree.#nodes];
-                copy[node.id - 1] = ownedNode({ ...restored, revision: node.revision });
-                tree = new ConversationTree(copy, node.id);
-            }
+            const owned = ownedNode({ ...node, blocks: settledBlocks(node.blocks) });
+            assertTurn(owned);
+            assertPersistableNode(owned);
+            restored.push(owned);
         }
-        return tree.select(activeNodeId);
+        assertBounds(restored);
+        if (!validNodeId(activeNodeId) ||
+            (activeNodeId !== 0 && restored[activeNodeId - 1]?.id !== activeNodeId))
+            throw new Error("conversation node does not exist");
+        return new ConversationTree(restored, activeNodeId);
     }
     /** Commit or extend the one prospective leaf turn. */
     commit(draft, settlement) {
@@ -92,6 +87,19 @@ export class ConversationTree {
         }
         return undefined;
     }
+    /** Select the newest turn that is safe to continue after a restart. */
+    latestResumable() {
+        let id = this.#activeNodeId;
+        while (id !== 0) {
+            const node = this.node(id);
+            if (node === undefined)
+                throw new Error("conversation path is incomplete");
+            if (node.settlement !== "checkpointed")
+                return this.select(id);
+            id = node.parentId;
+        }
+        return undefined;
+    }
     get history() {
         return this.#path().flatMap((node) => clone(node.messages));
     }
@@ -99,7 +107,12 @@ export class ConversationTree {
         return projectContext(this.#path());
     }
     get transcript() {
-        return this.#path().flatMap((node) => clone(node.blocks));
+        return this.#path().flatMap((node) => [
+            ...clone(node.blocks),
+            ...(node.failure === undefined
+                ? []
+                : [{ kind: "notice", text: node.failure.text, tone: node.failure.tone }]),
+        ]);
     }
     #append(draft, settlement) {
         if (this.#nodes.length >= CONVERSATION_LIMITS.nodes) {
@@ -115,8 +128,10 @@ export class ConversationTree {
             messages: draft.messages,
             blocks: settledBlocks(draft.blocks),
             ...(draft.context === undefined ? {} : { context: draft.context }),
+            ...(draft.failure === undefined ? {} : { failure: draft.failure }),
         });
         assertTurn(node);
+        assertPersistableNode(node);
         const nodes = [...this.#nodes, node];
         assertBounds(nodes);
         return new ConversationTree(nodes, node.id);
@@ -135,8 +150,10 @@ export class ConversationTree {
             messages: draft.messages,
             blocks: settledBlocks(draft.blocks),
             context: draft.context ?? current.context,
+            failure: draft.failure,
         });
         assertTurn(node);
+        assertPersistableNode(node);
         const nodes = [...this.#nodes];
         nodes[id - 1] = node;
         assertBounds(nodes);
@@ -163,6 +180,7 @@ function ownedNode(node) {
         messages: Object.freeze(clone(node.messages)),
         blocks: Object.freeze(clone(node.blocks)),
         ...(node.context === undefined ? {} : { context: Object.freeze({ ...node.context }) }),
+        ...(node.failure === undefined ? {} : { failure: Object.freeze({ ...node.failure }) }),
     });
 }
 function settledBlocks(blocks) {
@@ -174,6 +192,8 @@ function settledBlocks(blocks) {
             return [settled];
         }
         if (block.kind === "tool") {
+            if (block.tone === "pending")
+                return [];
             const { startedAt: _startedAt, expanded: _expanded, ...settled } = block;
             return [settled];
         }
@@ -185,26 +205,37 @@ function assertTurn(node) {
         !validNodeId(node.parentId) || node.parentId >= node.id ||
         !Number.isSafeInteger(node.revision) || node.revision < 1 ||
         node.createdAt.length === 0 || node.createdAt.length > 64 ||
-        (node.settlement !== "checkpointed" && node.settlement !== "completed") ||
+        !validSettlement(node.settlement) ||
         node.messages.length < 2 || node.messages[0]?.role !== "user" ||
         node.identity.providerId.length === 0 || node.identity.providerId.length > 128 ||
         node.identity.model.length === 0 || node.identity.model.length > 512 ||
         node.identity.effort.length === 0 || node.identity.effort.length > 32)
         throw new Error("turn checkpoint is invalid");
-    if (node.settlement === "completed" && node.messages.at(-1)?.role !== "assistant") {
-        throw new Error("a completed turn must end with an assistant message");
+    if (node.settlement !== "checkpointed" && node.messages.at(-1)?.role !== "assistant") {
+        throw new Error("a resumable turn must end with an assistant message");
+    }
+    const failed = node.settlement === "failed" || node.settlement === "interrupted";
+    if (failed !== (node.failure !== undefined) ||
+        (node.settlement === "failed" && node.failure?.tone !== "error") ||
+        (node.settlement === "interrupted" && node.failure?.tone !== "warn")) {
+        throw new Error("turn failure state is invalid");
     }
 }
+function validSettlement(value) {
+    return value === "checkpointed" || value === "completed" ||
+        value === "failed" || value === "interrupted";
+}
 function assertBounds(nodes) {
     let messageCodeUnits = 0;
     let transcriptCodeUnits = 0;
     let contextCodeUnits = 0;
+    const contextOwners = [];
     for (const node of nodes) {
         messageCodeUnits += JSON.stringify(node.messages).length;
         transcriptCodeUnits += JSON.stringify(node.blocks).length;
         contextCodeUnits += node.context?.summary.length ?? 0;
         if (node.context !== undefined)
-            assertContextPath(nodes, node);
+            contextOwners.push(node);
     }
     if (messageCodeUnits > CONVERSATION_LIMITS.messageCodeUnits) {
         throw new Error("conversation model history reached its session limit — start /new");
@@ -215,18 +246,41 @@ function assertBounds(nodes) {
     if (contextCodeUnits > CONVERSATION_LIMITS.contextCodeUnits) {
         throw new Error("conversation context summaries reached their session limit — start /new");
     }
+    assertContextPaths(nodes, contextOwners);
 }
-function assertContextPath(nodes, owner) {
-    const context = owner.context;
-    const boundary = nodes[context.throughNodeId - 1];
-    if (boundary === undefined || !validContextAnchor(context, boundary.messages.length)) {
-        throw new Error("turn context checkpoint is invalid");
-    }
-    let id = owner.id;
-    while (id !== 0 && id !== boundary.id)
-        id = nodes[id - 1]?.parentId ?? 0;
-    if (id !== boundary.id)
-        throw new Error("turn context checkpoint is outside its branch");
+function assertContextPaths(nodes, owners) {
+    if (owners.length === 0)
+        return;
+    const children = Array.from({ length: nodes.length + 1 }, () => []);
+    for (const node of nodes)
+        children[node.parentId]?.push(node.id);
+    const entered = new Uint32Array(nodes.length + 1);
+    const exited = new Uint32Array(nodes.length + 1);
+    const stack = [{ id: 0, exit: false }];
+    let clock = 0;
+    while (stack.length > 0) {
+        const current = stack.pop();
+        if (current.exit) {
+            exited[current.id] = clock++;
+            continue;
+        }
+        entered[current.id] = clock++;
+        stack.push({ id: current.id, exit: true });
+        const descendants = children[current.id];
+        for (let index = descendants.length - 1; index >= 0; index--) {
+            stack.push({ id: descendants[index], exit: false });
+        }
+    }
+    for (const owner of owners) {
+        const context = owner.context;
+        const boundary = nodes[context.throughNodeId - 1];
+        if (boundary === undefined || !validContextAnchor(context, boundary.messages.length)) {
+            throw new Error("turn context checkpoint is invalid");
+        }
+        if (entered[boundary.id] > entered[owner.id] ||
+            exited[owner.id] > exited[boundary.id])
+            throw new Error("turn context checkpoint is outside its branch");
+    }
 }
 function validNodeId(value) {
     return Number.isSafeInteger(value) && value >= 0;

package/dist/providers/anthropic.js

@@ -80,7 +80,7 @@ export const anthropic = {
                 effort: requireSupportedEffort(req.model, req.effort, efforts),
             };
         }
-        const events = await postSse(ENDPOINT, headers(key), body, req.signal, req.onStatus);
+        const events = await postSse(ENDPOINT, headers(key), body, req.maxTokens, req.signal, req.onStatus);
         const data = await assembleAnthropic(events, req.onStream);
         // A refusal or a truncation never arrives as streamed text, so it has to
         // be announced separately or the user watches the turn end in silence.