@hicaru/pi-rlm 0.1.2 → 0.1.5

package/src/prompts/system.ts

@@ -18,8 +18,56 @@ export interface SystemPromptOptions {
   readonly recursion?: boolean;
   readonly askUserQuestion?: boolean;
   readonly todo?: boolean;
+  readonly pipeline?: boolean;
+  readonly maxPromptChars?: number;
 }
 
+export type ContextKind = "files" | "text";
+
+/** "str" (raw string context, e.g. rlm_query children) → text; everything else → files. */
+export function contextKindOf(contextType: string): ContextKind {
+  return contextType === "str" ? "text" : "files";
+}
+
+const DEFAULT_PROMPT_CAP = 400_000;
+
+function promptCapTokensK(maxPromptChars: number): number {
+  return Math.round(maxPromptChars / 4_000);
+}
+
+/** Shared glossary entry for the chunked-query helper (headless + native). */
+const CHUNKED_GLOSSARY_LINES: readonly string[] = Object.freeze([
+  "- `llm_query_chunked(text: str, prompt: str, model=None) -> list[str]`: auto-splits `text` into",
+  "  chunks that fit the sub-LLM prompt cap, fans them out concurrently (order preserved), and",
+  "  returns one answer per chunk. Use it for ANY text too large for a single `llm_query` — a file",
+  "  you open()ed, an oversized sub-result, or several concatenated context files.",
+]);
+
+/** Why a file the user mentioned may be missing from `context`. */
+const CONTEXT_EXCLUSION_NOTE =
+  "  NOTE: files larger than 1MB and gitignored files are NOT in `context` — they exist only on disk.";
+
+/** The large-on-disk-file protocol (headless + native). */
+const LARGE_FILE_RULE_LINES: readonly string[] = Object.freeze([
+  "**Large on-disk files (profiles, logs, dumps, generated JSON):** files >1MB or gitignored are",
+  "absent from `context`. Protocol:",
+  '1. Load in Python: `raw = open("dhat-heap.json").read()` — loading into a variable is fine.',
+  "2. Deterministic processing in Python (`json.load`, `re`, counting, aggregation) is fine and preferred.",
+  "3. The moment you need MEANING from raw text (summarize, explain, find anomalies), do NOT read it",
+  "   yourself — call `llm_query_chunked(raw, question)`, or slice + `llm_query_batched`.",
+  "4. Never print more than a small probe (~2K chars) of raw content.",
+  'Example: `parts = llm_query_chunked(raw, "Extract top allocation sites with byte totals")`, then',
+  "aggregate `parts` in Python or with one final `llm_query`.",
+]);
+
+/** Concise native-mode glossary line for the chunked helper (native prompt has a 6K budget). */
+const CHUNKED_GLOSSARY_LINE_NATIVE =
+  "- `llm_query_chunked(text, prompt, model=None) -> list[str]` — auto-splits oversized text into cap-sized chunks, fans out concurrently; one answer per chunk.";
+
+/** Concise native-mode large-file rule (folds in the context-exclusion note; native 6K budget). */
+const LARGE_FILE_RULE_NATIVE =
+  "- Files >1MB or gitignored are NOT in `context`: open() + parse deterministically in Python is fine; ANY semantic reading of the raw text goes through llm_query_chunked. Never print >2K chars raw.";
+
 function howToRunCode(): string {
   return [
     "To run Python, write a fenced ```repl``` block. The REPL **persists** across turns. Only",
@@ -28,29 +76,41 @@ function howToRunCode(): string {
   ].join(" ");
 }
 
-function replGlossary(recursion: boolean, askUserQuestion: boolean, todo: boolean): string {
-  const lines = [
-    "Available in the REPL:",
-    "- `context`: list[dict] — a pre-packed JSON array of every file in the repository. Each dict has",
-    "  keys: `path` (relative file path, str), `content` (file text, str), `tokens` (estimated count, int).",
-    "  For large repos, chunk `context` into batches and delegate to sub-LLMs — never dump raw file",
-    "  bodies into your own output.",
-    "",
-    "  Chunking example:",
-    "  ```python",
-    "  chunk_size = 5",
-    "  for i in range(0, len(context), chunk_size):",
-    "      batch = context[i:i+chunk_size]",
-    "      results = llm_query_batched([",
-    "          f\"Analyze {f['path']} ({f['tokens']} tok):\\n{f['content']}\"",
-    "          for f in batch",
-    "      ])",
-    "  ```",
+function replGlossary(kind: ContextKind, recursion: boolean, askUserQuestion: boolean, todo: boolean, pipeline: boolean): string {
+  const lines = ["Available in the REPL:"];
+  if (kind === "text") {
+    lines.push(
+      "- `context`: str — the raw text you must analyze. Probe it with slices",
+      "  (`print(context[:2000])`), split it programmatically, and delegate large chunks",
+      "  to sub-LLMs — never dump the whole string into your own output.",
+    );
+  } else {
+    lines.push(
+      "- `context`: list[dict] — a pre-packed JSON array of every file in the repository. Each dict has",
+      "  keys: `path` (relative file path, str), `content` (file text, str), `tokens` (estimated count, int).",
+      "  For large repos, chunk `context` into batches and delegate to sub-LLMs — never dump raw file",
+      "  bodies into your own output.",
+      CONTEXT_EXCLUSION_NOTE,
+      "",
+      "  Chunking example:",
+      "  ```python",
+      "  chunk_size = 5",
+      "  for i in range(0, len(context), chunk_size):",
+      "      batch = context[i:i+chunk_size]",
+      "      results = llm_query_batched([",
+      "          f\"Analyze {f['path']} ({f['tokens']} tok):\\n{f['content']}\"",
+      "          for f in batch",
+      "      ])",
+      "  ```",
+    );
+  }
+  lines.push(
     "- `llm_query(prompt: str, model=None) -> str`: a single sub-LLM completion. Use for extraction,",
     "  summarization, or Q&A over a chunk of text.",
     "- `llm_query_batched(prompts: list[str], model=None) -> list[str]`: run several sub-LLM calls",
     "  concurrently; output order matches input order.",
-  ];
+    ...CHUNKED_GLOSSARY_LINES,
+  );
   if (askUserQuestion) {
     lines.push(
       "- `ask_user_question(questions: list[dict]) -> list[dict]`: pause and present the user",
@@ -86,11 +146,13 @@ function replGlossary(recursion: boolean, askUserQuestion: boolean, todo: boolea
       "    handle. Avoid excessive recursive sub-calls when a batched one-shot would suffice.",
     );
   }
-  lines.push(
-    "- `advance_phase(phase: str, summary=None) -> str`: transition the root RLM pipeline to the next phase.",
-    "  Valid phases in order: 'research' → 'blueprint' → 'implement' → 'validate'. You must advance forward",
-    "  one phase at a time. Only callable at the root depth; returns an error in sub-RLM contexts.",
-  );
+  if (pipeline) {
+    lines.push(
+      "- `advance_phase(phase: str, summary=None) -> str`: transition the root RLM pipeline to the next phase.",
+      "  Valid phases in order: 'research' → 'blueprint' → 'implement' → 'validate'. You must advance forward",
+      "  one phase at a time. Only callable at the root depth; returns an error in sub-RLM contexts.",
+    );
+  }
   lines.push(
     "- `SHOW_VARS() -> str`: list every variable currently in the REPL.",
     '- `answer`: a dict initialized to {"content": "", "ready": False}. To submit your final answer,',
@@ -99,24 +161,26 @@ function replGlossary(recursion: boolean, askUserQuestion: boolean, todo: boolea
   return lines.join("\n");
 }
 
-const ORCHESTRATOR_ADDENDUM = [
-  "As an RLM you are an **orchestrator, not a solver**. After you probe `context` and understand the",
-  "task, pause and plan: state how the task decomposes into sub-LLM / REPL steps, then execute one step",
-  "at a time, printing a small sample of each result to verify before moving on.",
-  "",
-  "Your own context window is small. Push every long-context operation — reading, summarizing,",
-  "classifying, answering sub-questions — into `llm_query` / `llm_query_batched` instead of pulling raw",
-  "text into your own message stream. Conversely, if a Python keyword/regex search over `context` would",
-  "already pin the answer, just read it directly. Aggregate the small results back in Python.",
-  "",
-  "Sub-call budget is finite on two axes: (1) per-prompt capacity — keep each sub-prompt modestly sized",
-  "(a useful ceiling is ~100K characters), packing a chunk of many items per call; (2) batch fan-out —",
-  "keep batches to roughly ~20 prompts. Fat prompts in small batches beat thousands of tiny prompts.",
-  "If the workload exceeds both at once, filter aggressively in Python first, then batch the survivors.",
-  "",
-  "Reserve your own tokens for high-level decisions: what to ask next, how to combine sub-LM outputs,",
-  "when to finalize. Delegate everything else. Do not submit a final answer before inspecting `context`.",
-].join("\n");
+function orchestratorAddendum(maxPromptChars: number): string {
+  return [
+    "As an RLM you are an **orchestrator, not a solver**. After you probe `context` and understand the",
+    "task, pause and plan: state how the task decomposes into sub-LLM / REPL steps, then execute one step",
+    "at a time, printing a small sample of each result to verify before moving on.",
+    "",
+    "Your own context window is small. Push every long-context operation — reading, summarizing,",
+    "classifying, answering sub-questions — into `llm_query` / `llm_query_batched` instead of pulling raw",
+    "text into your own message stream. Conversely, if a Python keyword/regex search over `context` would",
+    "already pin the answer, just read it directly. Aggregate the small results back in Python.",
+    "",
+    `Sub-call budget is finite on two axes: (1) per-prompt capacity — each sub-prompt must stay under ${maxPromptChars.toLocaleString()} characters`,
+    `(hard cap; ≈${promptCapTokensK(maxPromptChars)}K tokens), packing a chunk of many items per call; (2) batch fan-out —`,
+    "keep batches to roughly ~20 prompts. Fat prompts in small batches beat thousands of tiny prompts.",
+    "If the workload exceeds both at once, filter aggressively in Python first, then batch the survivors.",
+    "",
+    "Reserve your own tokens for high-level decisions: what to ask next, how to combine sub-LM outputs,",
+    "when to finalize. Delegate everything else. Do not submit a final answer before inspecting `context`.",
+  ].join("\n");
+}
 
 const INTRO = [
   "You are a Recursive Language Model (RLM): a language model with a prompt and a very important",
@@ -126,12 +190,14 @@ const INTRO = [
 /** Build the full RLM system prompt. */
 export function buildRlmSystemPrompt(meta: PromptMeta, opts: SystemPromptOptions = {}): string {
   const recursion = opts.recursion ?? false;
+  const kind = contextKindOf(meta.contextType);
+  const maxPromptChars = opts.maxPromptChars ?? DEFAULT_PROMPT_CAP;
   const parts = [
     INTRO,
     "",
     howToRunCode(),
     "",
-    replGlossary(recursion, opts.askUserQuestion ?? false, opts.todo ?? false),
+    replGlossary(kind, recursion, opts.askUserQuestion ?? false, opts.todo ?? false, opts.pipeline ?? false),
     "",
     "REPL stdout over ~800 characters is truncated to a short excerpt — large results stay in your",
     "REPL variables as buffers. Re-print only the slice you need (e.g. `print(result[:500])`); never",
@@ -140,9 +206,12 @@ export function buildRlmSystemPrompt(meta: PromptMeta, opts: SystemPromptOptions
     "Start by probing `context` (print a few lines, count items). Then build up an answer to the query.",
   ];
   if (opts.orchestrator ?? true) {
-    parts.push("", ORCHESTRATOR_ADDENDUM);
+    parts.push("", orchestratorAddendum(maxPromptChars));
   }
-  parts.push("", buildMetadataLine(meta));
+  if (kind === "files") {
+    parts.push("", LARGE_FILE_RULE_LINES.join("\n"));
+  }
+  parts.push("", buildMetadataLine(meta, maxPromptChars));
   return parts.join("\n");
 }
 
@@ -152,23 +221,19 @@ function nativeReplGlossary(): string {
     "## RLM Native Mode — Persistent Python REPL",
     "",
     "Call `repl({code: \"...\"})` to execute Python in a **persistent** sandbox. Variables, imports,",
-    "and state survive across calls — you build up results incrementally. Only `print()` output is",
-    "returned, so always wrap inspections in `print(...)`.",
+    "State persists; only `print()` output is returned, so wrap inspections in `print(...)`.",
     "",
     "### REPL Environment",
     "- `context`: list[dict] — every file in the repository. Each dict: `path` (str), `content` (str), `tokens` (int).",
     "- `llm_query(prompt, model=None) -> str` — one-shot sub-LLM. Use for extraction, summarization, Q&A over a chunk.",
     "- `llm_query_batched(prompts, model=None) -> list[str]` — concurrent sub-LLM calls; output order matches input order.",
-    "- `rlm_query(prompt, model=None) -> str` — recursive RLM with its own REPL for complex sub-tasks needing iterative reasoning.",
+    CHUNKED_GLOSSARY_LINE_NATIVE,
+    "- `rlm_query(prompt, model=None) -> str` — recursive RLM with its own REPL for complex sub-tasks needing iterative reasoning. Prefer llm_query — rlm_query is slower and costlier.",
     "- `rlm_query_batched(prompts, model=None) -> list[str]` — concurrent recursive RLM calls.",
     "",
-    "**Choosing between `llm_query` and `rlm_query`:** default to `llm_query`/batched; use `rlm_query` only for iterative sub-tasks.",
     "- `todo(action, **kwargs) -> str` — manage a task list. Actions: create, update, list, get, delete, clear. Statuses: pending → in_progress → completed.",
     "- `SHOW_VARS() -> str` — list all variables currently in the REPL.",
-    "- `stage_edit(path, old_text, new_text) -> str`: stage a file edit computed inside the REPL.",
-    "  Read the file from `context`, compute the exact change in Python, then call",
-    "  stage_edit once per file. The repl() result will include a STAGED_EDITS JSON block.",
-    "  The main agent must then call `edit` for each entry verbatim — zero analysis needed.",
+    "- `stage_edit(path, old_text, new_text)`: stage exact edits from `context`; apply returned STAGED_EDITS verbatim with edit().",
     "- `answer`: dict `{\"content\": \"\", \"ready\": False}`. To submit: `answer[\"content\"] = \"...\"; answer[\"ready\"] = True`.",
     "",
     "### Orchestrator Pattern",
@@ -190,15 +255,12 @@ function nativeReplGlossary(): string {
     "    ])",
     "    # aggregate results into a buffer",
     "```",
-    "- Keep sub-prompts ~100K characters; batch ~20 prompts per call. Fat prompts in small batches > thousands of tiny prompts.",
-    "- If your `context` is small enough (<20 files), you CAN read files directly via `read` / `grep` / `zebra-mcp`.",
-    "- For medium/large repos, delegate to sub-LLMs via the REPL.",
+    `- Keep sub-prompts under ${DEFAULT_PROMPT_CAP.toLocaleString()} characters (≈${promptCapTokensK(DEFAULT_PROMPT_CAP)}K tokens); batch ~20 prompts per call. Fat prompts in small batches > thousands of tiny prompts.`,
     "",
     "### Choosing Between Tools",
     "| Tool | When |",
     "|------|------|",
     "| `repl({code})` | Need to chunk/delegate `context` to sub-LLMs; need Python scripting; need REPL state across calls |",
-    "| `read` / `grep` | Inspect a few specific files directly; small codebase |",
     "| `zebra-mcp` | Semantic search over the codebase |",
     "| `edit` | Modify an existing file with exact text replacement (native Pi flow, visible to all plugins) |",
     "| `write` | Create a new file (native Pi flow, visible to all plugins) |",
@@ -214,6 +276,7 @@ function nativeReplGlossary(): string {
     "4. **Finalize**: For file changes, stage them inside repl() via stage_edit(path, old, new), then relay the STAGED_EDITS from the result to `edit`. For analysis tasks, write a normal message.",
     "",
     "### Task-Specific Patterns",
+    LARGE_FILE_RULE_NATIVE,
     "- Architecture/code review: chunk relevant files and delegate summaries or review to `llm_query_batched`.",
     "- Bug investigation: use Python string/regex search over `context`; delegate matching files for analysis.",
     "- If sub-LLM credits are exhausted, report partial results and stop — do not bypass REPL restrictions.",
@@ -230,7 +293,15 @@ export function buildNativeSystemPrompt(): string {
     "║  NATIVE RLM MODE — YOU ARE AN ORCHESTRATOR, NOT A READER      ║",
     "╚══════════════════════════════════════════════════════════════════╝",
     "",
-    "ABSOLUTE RESTRICTION: Do NOT use `read` or `grep` to access files.",
+    "ENFORCED BY THE RUNTIME (not advisory):",
+    "- `read`/`grep` are blocked; bash readers (cat/sed/head/tail/awk/rg) are blocked; bash output is hard-capped at 4K chars.",
+    "- repl() stdout returned to you is hard-capped at 4K chars — printing file bodies is USELESS; the text will not reach you.",
+    "",
+    "DELEGATION RULE: if a step needs MEANING from more than ~4K chars of text, that reading MUST",
+    "be an llm_query / llm_query_batched / llm_query_chunked call (rlm_query for iterative",
+    "sub-tasks). Deterministic Python (search, count, slice, json, re) over `context` is free and",
+    "preferred for lookups. Semantic reading is always delegated.",
+    "",
     "All file content is pre-loaded in the REPL `context` variable. Use ONLY `repl({code})`.",
     "If sub-LLM credits are exhausted → report the error to the user and stop.",
     "",
@@ -245,14 +316,30 @@ export function buildNativeSystemPrompt(): string {
   ].join("\n");
 }
 
+/** Soft cap on the static native prompt. Leaves headroom for per-turn context injection
+ *  without bloating the root model's system prompt. Exceeded → phase-guards.ts fails. */
+export const NATIVE_PROMPT_BUDGET = 6_000;
+
 /** Exported for tests — prompt length without context metadata (which is injected separately). */
 export const NATIVE_PROMPT_STATIC = buildNativeSystemPrompt();
 
+/** Per-turn last-position reminder for native mode — appended to every context build. */
+export const NATIVE_TURN_REMINDER = [
+  "[RLM orchestrator contract — enforced by the runtime, not optional:",
+  "repl() stdout to you is hard-capped at 4K chars; read/grep and bash readers are blocked.",
+  "Any SEMANTIC reading of file/text content MUST go through llm_query / llm_query_batched /",
+  "llm_query_chunked (rlm_query for iterative sub-tasks). Deterministic Python (search, count,",
+  "slice, json) is free. Keep your own output to decisions and aggregation.]",
+].join("\n");
+
 /** The one-line context metadata, also reused by the per-turn prompt in headless mode. */
-export function buildMetadataLine(meta: PromptMeta): string {
-  const contextDesc = `Your context is a JSON array of ${meta.contextChars.toLocaleString()} total characters — list[dict] where each dict has keys "path" (str), "content" (str), and "tokens" (int). Use Python list slicing to chunk it into batches for sub-LLM delegation.`;
-  const tail = "Each sub-LLM call can handle roughly ~100k tokens at once.";
-  const dist = meta.contextStats
+export function buildMetadataLine(meta: PromptMeta, maxPromptChars = DEFAULT_PROMPT_CAP): string {
+  const kind = contextKindOf(meta.contextType);
+  const contextDesc = kind === "text"
+    ? `Your context is a plain string of ${meta.contextChars.toLocaleString()} characters. Use Python slicing to chunk it for sub-LLM delegation.`
+    : `Your context is a JSON array of ${meta.contextChars.toLocaleString()} total characters — list[dict] where each dict has keys "path" (str), "content" (str), and "tokens" (int). Use Python list slicing to chunk it into batches for sub-LLM delegation.`;
+  const tail = `Each sub-LLM call accepts up to ${maxPromptChars.toLocaleString()} characters (≈${promptCapTokensK(maxPromptChars)}K tokens).`;
+  const dist = kind === "files" && meta.contextStats
     ? ` Your context has ${meta.contextStats.files} files; per-file tokens run min ${meta.contextStats.min.toLocaleString()} / median ${meta.contextStats.median.toLocaleString()} / max ${meta.contextStats.max.toLocaleString()} — use this to gauge how many files fit per batch.`
     : "";
   const body = `${contextDesc} ${tail}${dist}`;

package/src/sandbox/sandbox-manager.ts

@@ -13,6 +13,7 @@ export interface SandboxManagerConfig {
   readonly requestTimeoutMs: number;
   readonly python: string;
   readonly sandboxInitTimeoutMs: number;
+  readonly maxPromptChars: number;
   readonly signal?: AbortSignal;
 }
 
@@ -58,6 +59,7 @@ export class SandboxManager {
       python: this.config.python,
       signal: this.config.signal,
       initTimeoutMs: this.config.sandboxInitTimeoutMs,
+      maxPromptChars: this.config.maxPromptChars,
       handlers,
     }).then(async (s) => {
       // Load context on first creation if available.

package/src/sandbox/sandbox.ts

@@ -52,6 +52,8 @@ export interface SandboxOptions {
   readonly signal?: AbortSignal;
   /** Worker startup wait before init failure (ms). */
   readonly initTimeoutMs?: number;
+  /** Sub-LLM prompt cap (chars) — sizes llm_query_chunked chunks inside the worker. */
+  readonly maxPromptChars?: number;
 }
 
 const WORKER_PATH = join(dirname(fileURLToPath(import.meta.url)), "worker.py");
@@ -110,9 +112,17 @@ export class PythonSandbox {
     this.requestTimeoutMs = opts.requestTimeoutMs ?? 20 * 60_000;
     this.initTimeoutMs = opts.initTimeoutMs ?? 30_000;
     const python = opts.python ?? "python3";
+    const workerArgs = [
+      "-u", WORKER_PATH,
+      "--depth", String(opts.depth ?? 1),
+      "--timeout", String(opts.execTimeoutS ?? 600),
+    ];
+    if (opts.maxPromptChars !== undefined) {
+      workerArgs.push("--max-prompt-chars", String(opts.maxPromptChars));
+    }
     this.proc = spawn(
       python,
-      ["-u", WORKER_PATH, "--depth", String(opts.depth ?? 1), "--timeout", String(opts.execTimeoutS ?? 600)],
+      workerArgs,
       { stdio: ["pipe", "pipe", "pipe"], env: sanitizedEnv() },
     ) as ChildProcessWithoutNullStreams;
 

package/src/sandbox/worker.py

@@ -21,6 +21,7 @@ import io
 import json
 import os
 import pickle
+import re
 import signal
 import sys
 import time
@@ -28,10 +29,11 @@ import traceback
 from contextlib import contextmanager
 from typing import Any
 
-# Capture the REAL stdout/stdin before exec() redirects sys.stdout into a buffer.
+# Capture the REAL stdio before exec() redirects sys.stdout/sys.stderr into buffers.
 # All protocol writes must go to the real stdout even while user code's prints are captured.
 _REAL_STDOUT = sys.stdout
 _REAL_STDIN = sys.stdin
+_REAL_STDERR = sys.stderr
 
 
 def _builtin(name: str):
@@ -62,13 +64,37 @@ for _blocked in ("eval", "exec", "compile", "input", "globals", "locals"):
 
 RESERVED = frozenset(
     {
-        "llm_query", "llm_query_batched", "rlm_query", "rlm_query_batched",
+        "llm_query", "llm_query_batched", "llm_query_chunked",
+        "rlm_query", "rlm_query_batched",
         "advance_phase",
         "ask_user_question", "todo",
         "stage_edit",
         "SHOW_VARS", "answer", "context",
     }
 )
+_CONTEXT_SLOT = re.compile(r"context(_\d+)?\Z")
+
+# Sizing for llm_query_chunked: leave room for the instruction and the chunk header.
+_CHUNK_HEADER_OVERHEAD = 64
+_MAX_CHUNK_BATCH = 20          # fan-out per llm_query_batched call (matches prompt guidance)
+_MAX_CHUNKS = 500              # ceiling: above this, force pre-filtering in Python
+_NUDGE_CHARS = 500_000         # str/bytes vars above this trigger a one-time stdout hint
+
+
+def _chunk_text(text: str, chunk_chars: int) -> list[str]:
+    """Split text into <=chunk_chars pieces, preferring newline boundaries."""
+    chunks: list[str] = []
+    n = len(text)
+    start = 0
+    while start < n:
+        end = min(start + chunk_chars, n)
+        if end < n:
+            nl = text.rfind("\n", start, end)
+            if nl > start:
+                end = nl + 1
+        chunks.append(text[start:end])
+        start = end
+    return chunks
 
 
 class _AnswerDict(dict):
@@ -92,9 +118,10 @@ def _send(obj: dict[str, Any]) -> None:
 
 
 class Worker:
-    def __init__(self, depth: int, exec_timeout_s: float):
+    def __init__(self, depth: int, exec_timeout_s: float, max_prompt_chars: int):
         self.depth = depth
         self.exec_timeout_s = exec_timeout_s
+        self.max_prompt_chars = max_prompt_chars
         self._rid = 0
         self._final_answer: str | None = None
         self._context_count = 0
@@ -105,6 +132,7 @@ class Worker:
         self.ns = {"__builtins__": _SAFE_BUILTINS.copy(), "__name__": "__main__"}
         self._ctx_payloads: dict[int, Any] = {}
         self._staged_edits: list[dict[str, str]] = []
+        self._nudged: set[str] = set()
         self._restore_scaffold()
 
     def _capture_answer(self, content: Any) -> None:
@@ -115,6 +143,7 @@ class Worker:
         ns = self.ns
         ns["llm_query"] = self._llm_query
         ns["llm_query_batched"] = self._llm_query_batched
+        ns["llm_query_chunked"] = self._llm_query_chunked
         ns["rlm_query"] = self._rlm_query
         ns["rlm_query_batched"] = self._rlm_query_batched
         ns["advance_phase"] = self._advance_phase
@@ -131,11 +160,14 @@ class Worker:
                 if cur.get("ready") and self._final_answer is None:
                     self._final_answer = str(cur.get("content", ""))
             ns["answer"] = ans
-        # Restore context slots from immutable originals so REPL mutations don't persist.
+        # Context slots are ordinary variables (RLM paper: the context lives in the
+        # environment and the model may transform it in place). Re-inject only if the
+        # model deleted the name entirely; mutations and re-binds persist within the run.
+        # Resume reloads pristine context; keep derived resume-critical values in user vars.
         for idx, payload in self._ctx_payloads.items():
-            ns[f"context_{idx}"] = payload
+            ns.setdefault(f"context_{idx}", payload)
         if 0 in self._ctx_payloads:
-            ns["context"] = self._ctx_payloads[0]
+            ns.setdefault("context", self._ctx_payloads[0])
 
     def _user_var_names(self) -> list[str]:
         """User-created variable names — filters builtins, scaffold, and context slots.
@@ -146,7 +178,7 @@ class Worker:
         return [
             k for k in self.ns
             if not k.startswith("_")
-            and not k.startswith("context_")
+            and not _CONTEXT_SLOT.match(k)
             and k not in RESERVED
         ]
 
@@ -174,8 +206,11 @@ class Worker:
                 msg = json.loads(line)
                 if msg.get("type") == "llm_reply" and msg.get("rid") == rid:
                     return msg
-                # The parent only ever sends our reply mid-exec; anything else is a protocol error.
-                raise RuntimeError(f"unexpected parent message during sub-LLM request: {msg!r}")
+                # Stray/late message (e.g. a reply to an earlier timed-out request): skip it.
+                print(
+                    f"[rlm-sandbox] ignoring unexpected message during sub-LLM request: {str(msg)[:200]}",
+                    file=_REAL_STDERR,
+                )
         finally:
             if pause and remaining > 0:
                 signal.setitimer(signal.ITIMER_REAL, remaining)
@@ -196,6 +231,35 @@ class Worker:
             return ["Error: malformed batched response"] * len(prompts)
         return [s if isinstance(s, str) else f"Error: {s}" for s in out]
 
+    def _llm_query_chunked(self, text, prompt: str, model: str | None = None) -> list[str]:
+        """Split oversized text into cap-sized chunks and fan out via llm_query_batched.
+
+        Returns one answer per chunk, order preserved. No exceptions escape: errors come
+        back as "Error: ..." strings per chunk (same contract as llm_query_batched).
+
+        NOTE: budget uses Python code-point length (len) while the parent-side cap check counts
+        UTF-16 units (JS string.length); astral/emoji-heavy text may be marginally larger on the
+        parent and get per-chunk rejected. Acceptable trade-off for typical code/log/profile text.
+        """
+        text, prompt = str(text), str(prompt)
+        if not text:
+            return []
+        budget = self.max_prompt_chars - len(prompt) - _CHUNK_HEADER_OVERHEAD
+        if budget < 1_000:
+            return [f"Error: prompt leaves under 1,000 chars per chunk (cap {self.max_prompt_chars:,}) — shorten the instruction"]
+        chunks = _chunk_text(text, budget)
+        total = len(chunks)
+        if total > _MAX_CHUNKS:
+            return [f"Error: {total} chunks would be needed — filter/slice the text in Python first"]
+        results: list[str] = []
+        for i in range(0, total, _MAX_CHUNK_BATCH):
+            batch = [
+                f"{prompt}\n\n[chunk {i + j + 1}/{total} of the input]\n{c}"
+                for j, c in enumerate(chunks[i:i + _MAX_CHUNK_BATCH])
+            ]
+            results.extend(self._llm_query_batched(batch, model))
+        return results
+
     def _rlm_query(self, prompt: str, model: str | None = None) -> str:
         r = self._rpc("rlm_query", {"prompt": str(prompt), "model": model})
         return f"Error: {r['error']}" if r.get("error") else r.get("response", "")
@@ -334,6 +398,24 @@ class Worker:
             signal.setitimer(signal.ITIMER_REAL, 0)
             signal.signal(signal.SIGALRM, old)
 
+    def _nudge_lines(self) -> list[str]:
+        """One-time hint for newly created huge raw-text variables (single line).
+
+        Collapses to one line so it survives headless stdout elision (head 200 + tail 200).
+        """
+        names: list[str] = []
+        for k in self._user_var_names():
+            v = self.ns.get(k)
+            if isinstance(v, (str, bytes)) and len(v) > _NUDGE_CHARS and k not in self._nudged:
+                self._nudged.add(k)
+                names.append(f"{k} ({len(v):,} chars)")
+        if not names:
+            return []
+        return [
+            f"[rlm] huge raw-text variable(s): {', '.join(names)} — do NOT analyze them yourself; "
+            'delegate with llm_query_chunked(name, "your question") or slice + llm_query_batched.'
+        ]
+
     def execute(self, code: str) -> dict[str, Any]:
         start = time.perf_counter()
         raised = False
@@ -352,6 +434,15 @@ class Worker:
         edits, self._staged_edits = self._staged_edits, []
         answer = self.ns.get("answer")
         answer_content = answer.get("content", "") if isinstance(answer, dict) else ""
+        # ready may have been flipped with empty content before content was assigned later
+        # in the same block; the dict's current content is the real submission.
+        if final is not None and not final.strip() and str(answer_content).strip():
+            final = str(answer_content)
+        nudges = self._nudge_lines()
+        if nudges:
+            parts = [stdout] if stdout else []
+            parts.extend(nudges)
+            stdout = "\n".join(parts) + "\n"
         return {
             "stdout": stdout,
             "stderr": stderr,
@@ -381,7 +472,7 @@ class Worker:
         out, skipped = {}, []
         MAX_VAR_BYTES = 50 * 1024 * 1024
         for k, v in self.ns.items():
-            if k.startswith("_") or k.startswith("context") or k in RESERVED or k == "__builtins__":
+            if k.startswith("_") or _CONTEXT_SLOT.match(k) or k in RESERVED or k == "__builtins__":
                 continue
             try:
                 blob = s.dumps(v)
@@ -392,7 +483,7 @@ class Worker:
             except Exception:
                 skipped.append(k)
         if skipped:
-            print(f"[rlm-sandbox] snapshot skipped {len(skipped)} unpicklable/oversized vars: {skipped}", file=sys.stderr)
+            print(f"[rlm-sandbox] snapshot skipped {len(skipped)} unpicklable/oversized vars: {skipped}", file=_REAL_STDERR)
         tmp = path + ".tmp"
         with open(tmp, "wb") as f:
             s.dump({"nonce": nonce, "vars": out}, f)
@@ -420,9 +511,12 @@ def main() -> None:
     ap = argparse.ArgumentParser()
     ap.add_argument("--depth", type=int, default=int(os.environ.get("RLM_DEPTH", "1")))
     ap.add_argument("--timeout", type=float, default=float(os.environ.get("RLM_EXEC_TIMEOUT_S", "600")))
+    ap.add_argument("--max-prompt-chars", type=int,
+                    default=int(os.environ.get("RLM_MAX_PROMPT_CHARS", "400000")))
     args = ap.parse_args()
 
-    worker = Worker(depth=args.depth, exec_timeout_s=args.timeout)
+    worker = Worker(depth=args.depth, exec_timeout_s=args.timeout,
+                    max_prompt_chars=args.max_prompt_chars)
     _send({"id": "_init", "ok": True})
 
     for raw in _REAL_STDIN:

package/src/text/parsing.ts

@@ -5,7 +5,7 @@
  * blocks in order; everything else is prose the model uses to think out loud.
  */
 
-const FENCE = /```[ \t]*repl[ \t]*\r?\n([\s\S]*?)```/g;
+const FENCE = /(`{3,})[ \t]*repl[ \t]*\r?\n([\s\S]*?)\1/g;
 
 /** Return every ```repl``` block body, in document order. */
 export function findReplBlocks(text: string): string[] {
@@ -13,7 +13,7 @@ export function findReplBlocks(text: string): string[] {
   let m: RegExpExecArray | null;
   FENCE.lastIndex = 0;
   while ((m = FENCE.exec(text)) !== null) {
-    const code = m[1] ?? "";
+    const code = m[2] ?? "";
     if (code.trim()) blocks.push(code.replace(/\s+$/, ""));
   }
   return blocks;